The billion-dollar hit job
FROM PAGE b1
RCBC was the perfect choice for the hackers, according to a court document of a case filed with the New York court by the BB.
The Filipino bank had correspondent bank accounts with commercial banks in New York City that would serve as intermediary accounts to receive, directly from the New York Fed, the Bangladesh Bank’s stolen funds and then transfer them out of the US to fictitious accounts.
Five fictitious US dollar accounts were opened on May 15, 2015, almost nine months before the theft. Each was opened as an account to hold US dollars, signalling that conspirators understood, intended and plotted to reach into the US -- specifically into New York and the BB’s account at the New York Fed -- to steal funds.
The accounts sat unused -- with no transactions -- until February 5, 2016 when it received the stolen funds. Virtually the entirety of that amount by the four account was withdrawn by February 9, 2016.
A fifth fictitious US dollar account was opened in the name of Ralph Campo Picache also with a deposit of $500.
It sat unused, and remained unused throughout the conspiracy, although not for lack of trying.
Approximately $170 million in fraudulent payment instructions were destined for the fictitious Picache Account but, unlike the other four fictitious accounts, none of the payment instructions to this account were executed by the New York Fed.
“RCBC has since admitted that all of these accounts were fake, and established for fictitious persons, which begs the question of who could legitimately operate these accounts when there was no real owner,” the court documents said.
“The answer is that the only entity that could transfer funds in and out of these accounts -- which had no other owner -- was RCBC itself, by and through its personnel, which involved multiple individuals up to the highest levels of RCBC,” the document added.
Later that year, on December 8, 2015, about two months before the theft, RCBC opened accounts for each of the five fictitious beneficiaries. These accounts were held in the Philippine peso, not the US dollar like the earlier fictitious accounts.
RCBC opened the five new accounts of the fictitious beneficiaries with no initial deposit, unlike the fictitious US dollar accounts, and the accounts never held any funds and were never involved in any transactions.
They were preparatory, opened only to be used in the event that the thieves needed additional peso accounts to distribute and launder the stolen funds. As it turned out, the accounts were not needed, the court document showed.
NORTH KOREAN HACKERS
The wide-ranging conspiracy to rob hundreds of millions of dollars from the BB began years earlier with, on information and belief, North Korean hackers.
According to the FBI, among others, before the North Korean hackers executed their fraudulent transfer of funds from the BB’s New York Fed account, they first used the same or similar tools and techniques to accomplish the well-publicised attack on Sony.
Indeed, computer forensics firms including BAE Systems have reviewed the “attack toolkit” of malware used against the BB (and then against other banks) and those firms have concluded that the malware was custom-configured to “register itself as a service and operate in an environment running SWIFT’s Alliance Access software suite, [and] allow transactions to be deleted and records changed”.
Starting in 2014, the hackers used the same tools and techniques that they would later use on the BB, and try to use on other banks, to infiltrate the computer systems of Sony, a multi-national, global, and sophisticated company, and steal huge amounts of data, financial information and records, credentials and user information. And they covered their tracks on the way out.
By January 2015, as explained by the FBI, the North Korean hackers had specifically identified BB, among other banks, as one of the targets of their attack and theft.
The criminal enterprise had come together, and the co-conspirators began to open more fictitious bank accounts held in US dollars at RCBC in the Philippines, the court document showed.
The North Korean hackers also began their spear-phishing email campaign, sending fraudulent emails to the bank’s employees misrepresenting that the fake senders were seeking employment.
The link to the “resumé and cover letter” hosted the malware that enabled the initial access to the BB’s computers.
The North Korean hackers also sent fraudulent spear-phishing emails to the BB’s employees appearing to be “LinkedIn” invitations. This is how the North Korean hackers first fraudulently gained access to those users’ computers.
From there, by March 2015, the North Korean hackers had installed other forms of malware specifically designed to create a backdoor into the BB network, allowing the North Korean hackers to access the network, collect information, crawl across different computer systems, and then fraudulently communicate within the network over a custom binary protocol designed to appear merely as Transport Layer Security traffic.
In other words, the North Korean hackers covered their tracks by using a communication protocol that misrepresents itself as authentic encrypted communications and allowed North Korean hackers to communicate the stolen data and information without tripping security alerts.
These techniques, known to the international cybersecurity and law enforcement community, were traceable only after the attack was uncovered.
Finally, on January 29, 2016, only six days before the theft, the hackers began to covertly move across the BB network, from the computers in which they had originally installed the malware, to the SWIFTLIVE system critical to the processing of SWIFT messages like those used to execute the heist.
The Farashuddin report criticised SWIFT for its odd-looking attempt to get a copy of the Mandiant report, which proved that it was liable for the heist directly or indirectly.
About the Fed’s role, the probe said when the New York Fed received the fund transfer requests, it became suspicious.
It had kept the fund transfer on hold and sought more information and interpretation about beneficiaries. But by the time, it sought the additional information, it was already 3:59am Friday in Dhaka.
The weekend had already started. Before receiving any responses from the BB, it executed five payment instructions. After transferring the funds, it sent queries to the central bank as it was suspicious about the beneficiaries.
So, the New York Fed could not evade its responsibility of stealing of the funds from the BB’s reserves, the probe report said.
The liability of the Fed was created after it transferred the funds despite having suspicions about the payment instructions and the beneficiaries.
The primary responsibility for the $81 million reserve heist lies with SWIFT authorities, the report said. BB steps aimed at forestalling unauthorised payments were not adequate, the probe report said.
The central bank officials did not try to employ the manual system to retrieve the messages from the New York Fed when they return to work on Friday morning. Besides, they did not immediately apprise the higher authorities about the incident.
“We have not got any conclusive evidence to say conclusively whether any BB officials were knowingly involved with the heist. But we have serious suspicion about collusion of at least two officials,” the probe report said.
The lackadaisical work style of the BB officials paved the way for the criminals to hatch the plan.
RECOMMENDATIONS
“It was not right to connect the computers of the BB with the SWIFT network through the RTGS,” the probe report said.
The process to send SWIFT messages was made insecure in August-October 2015, when the SWIFT system and the BB-RTGS was connected.
It will be logical to de-link the BB-RTGS from the SWIFT and kept the SWIFT system alive in a standalone system.
Special training should be arranged for the people responsible to send payment instructions and there should be the highest level of security clearance in place.
The probe report recommended taking comprehensive measure through political leadership and diplomatic strategy and using legal experts.
It called for preparing and maintaining policy documents listing high-level requirement about network architecture and security.
Proper network segmentation needs to be placed at all levels and user workstations should never reach a server without passing through a firewall.
Operating systems of all machines should be up-to-date with latest security and other fixes and anti-virus software should be installed and regularly updated in all machines.
Remote desktop feature should be disabled in critical servers and workstation users should be cautioned not to browse irrelevant websites.
Access credentials of all the network equipment should be changed periodically, the report recommended.
SWIFT should introduce an SOS message type to immediately warn all concerned parties about possible system breach. Proper IT training needs to be arranged for users at all levels. Periodic auditing of different aspects of IT infrastructure, security and system usage needs to be performed.
Skilled and educated workforce need to be employed to manage the network and system operations, the report said.
DELAY IN PUBLISHING REPORT
As the report was not sent to the central bank from the government, it could not implement the recommendations, said Abu Hena Mohd Razee Hassan, a former deputy governor of the BB and now head of the Bangladesh Financial Intelligence Unit. He was one of the deputy governors at the time of hacking.
In an interview with The Daily Star recently, AMA Muhith, who was the finance minister when the heist took place, said: “We didn’t publish the Farashuddin committee report as the Fed had something to do with it -- they didn’t want the publication of the report.”
“I don’t think it would have caused any harm if the report was published. Maybe at first there would have been problems but not now. I don’t think if it is published now it will cause any problem. It has been so long.”
The government can’t disclose the Farashuddin-led committee’s investigation report on the BB reserve heist so that probe by the Criminal Investigation Department is not influenced, Finance Minister AHM Mustafa Kamal told the parliament in February last year.
The probe body thanked the BB for bringing forward the hiring of world-renowned cyber security firm FireEye Mandiant to probe the incident.