The banking coop has admitted there have been more cyber theft attempts and that the problem is not going away
SWIFT discloses more cyber theft attacks and expects banks to beef up security. SWIFT, the global financial messaging system, disclosed new cyber theft attacks on its member banks as it pressured them to comply with security procedures instituted after February’s high-profile $81 million heist at Bangladesh Bank.
In a private letter to clients, SWIFT said that new cyber theft attempts (some successful) have surfaced since June, when it last updated customers on a string of attacks discovered after the attack on the Bangladesh central bank. “Customers’ environments have been compromised, and subsequent attempts (were) made to send fraudulent payment instructions.”
SWIFT is trying coerce member banks into prioritizing cyber security by threatening to share confidential information about security lapses that banks want to keep private, said Shane Shook, an independent security consultant who advises central banks. “That type of information sharing is something that no bank likes to see happen without their direct approval and involvement, because it can affect market confidence,” Shook said.
The disclosure suggests that cyber thieves may have ramped up their efforts following the Bangladesh Bank heist, and that they specifically targeted banks with lax security procedures for SWIFT-enabled transfers.
SWIFT indicated in Tuesday’s letter that some victims in the new attacks lost money, but did not say how much was taken or how many of the attempted cyber theft attempts succeeded. It did not identify specific victims, but said the banks varied in size and geography and used different methods for accessing SWIFT.
All the victims shared one thing in common: Weaknesses in local security that attackers exploited to compromise local networks and send fraudulent messages requesting money transfers, according to the letter.
Accounts of the attack on Bangladesh Bank suggest that weak security procedures there made it easier to hack into computers used to send SWIFT messages requesting large money transfers. The bank lacked a firewall and used second-hand, $10 electronic switches to network those computers, according to the Bangladesh police.
SWIFT has repeatedly pushed banks to implement new security measures rolled out after the Bangladesh heist, including stronger systems for authenticating users and updates to its software for sending and receiving messages. But it has been difficult for SWIFT to force banks to comply because the nonprofit cooperative lacks regulatory authority over its members. SWIFT told banks Tuesday that it might report them to regulators and banking partners if they failed to meet a November 19 deadline for installing the latest version of its software, which includes new security features designed to thwart the type of attacks described in its letter. The security features include technology for verifying credentials of people accessing a bank’s SWIFT system; stronger rules for password management; and better tools for identifying attempts to hack the software.
The attacks have prompted regulators globally to press banks to bolster defenses.