Published:  12:17 AM, 14 January 2020

The Bangladesh Bank heist: Lessons in cyber vulnerability

The Bangladesh Bank heist: Lessons in cyber vulnerability

How do you steal a billion dollars?

It takes time, planning, manpower - and capitalizing on your target's vulnerabilities.


The thieves were organized, well networked, and well funded. But their success was, more than anything else; down to weaknesses in the institutions they robbed.

Understanding exactly what went wrong in the BCB hack - which has been suggested by some to be linked to the WannaCry ransomware attack of May 2017 - can provide businesses with invaluable lessons in how to improve their security strategies.

The Hack


The theft involved manipulating the SWIFT system - a digital messaging platform that manages many of the world's interbank financial transfers - to fool the New York branch of the U.S. Federal Reserve (which holds many international banking assets) into transferring funds to accounts owned by the thieves.


SWIFT usually notifies banks of transfers by sending the order to a bank's printers. But in this case, the attackers disabled the BCB's printers with a piece of malware. This meant the bank's employees in Bangladesh were not aware that the heist was going on.

By the time the BCB reactivated its printer and received the notifications of the transfers - and requests from the New York Fed for clarification - it was already too late and the money had been sent.

While a series of spelling and formatting errors in the thieves' SWIFT instructions halted the vast majority of the transactions, a total of $81 million was transferred to banks in Southeast Asia and quickly laundered through, among other places, the Manila casino system.


Beware Of Human Error





As Dennis Distler, Director, Cyber Resilience at Stroz Friedberg, an Aon company, puts it: "Humans are the weakest link in any security program." And much of this human error can result from relatively innocent mistakes - the malware that sabotaged the BCB's printers could have entered the system via a spear phishing campaign targeted at specific BCB employees, or via an infected USB drive.

However, some investigators, including the FBI, have speculated about the possibility of an inside job. Security cameras were switched off during the attack, and it's still unclear how the SWIFT credentials were acquired. And if a USB drive was used, it would have to be introduced into the office by someone who was at least partly aware of the plan.

Ed Stroz, Co-Founder of Stroz Friedberg, sees people - and the risks they pose - as a central part of any cyber-protection strategy: "The root cause of many cyber breaches is human behavior. As technologies evolve to become more secure at a technical level, the employee becomes the soft target, and the weak link in security. An employee might pose a risk unconsciously, through carelessness.

They could be tricked into clicking on a link or attachment through a spear-phishing campaign. Or they could pose a more active risk, because of anger or disgruntlement at work. If you don't address the human element in cyber vulnerability, you are not going to be able to deploy an effective strategy. It's dangerous to be overly focused on technology."

While the idea of "an inside job" might seem like the plot of a Hollywood blockbuster, there are plenty of reasons for organizations to worry about the risk posed by their staff. "It's unpleasant to admit, but people can just be out for themselves. Or they could have an axe to grind with the company. And what if they're being blackmailed from someone outside the company?" asks Stroz. "An employee with any of these motivations can pose a serious risk to the integrity of an organization's defenses."


The Problems with Protocols: People and Organizations

The potential for people to fail to do what they're supposed to is why organizations have security protocols and guidelines. But these are worthless if they're not followed or enforced. Organizations need to ensure their staff are properly educated and trained in what to do, how to do it, and educated in the consequences of failing to follow proper processes.

However, the risks don't end there. It's easy to think that by issuing protocols, you've solved the problem. But what if you've got the wrong set in the first place? In the BCB hack, the New York Fed did not have a real-time fraud detection system. Instead, requests were reviewed and any suspicious transactions addressed periodically. This gave the thieves a window of opportunity to launder the money before fraudulent activity was identified. According to its rules, the Fed did nothing wrong. The problem was that those rules were not up to the task at hand.



What the BCB Heist Can Teach Us


The cyber thieves were skilled, but their real success was in exploiting vulnerabilities in the organizations they targeted - vulnerabilities which may have been invisible beforehand.

By looking at what happened, identifying the key weak points - in understanding vulnerabilities, in maintaining security procedures, in training employees, and in testing processes - companies can work to mitigate similar weaknesses in their own organizations.

The Bangladesh attack was not the first cyber attack to lead to serious losses, nor will it be the last. Only by approaching every such event with fresh eyes will organizations learn to respond to - or prevent - these threats.

Talking Points

"As more financial services are delivered over the Internet, there will be growing security and privacy concerns from cyber threats. And maybe even systemic concerns. It is not inconceivable that the next financial crisis is triggered by a cyber-attack." - Ravi Menon, Managing Director, Monetary Authority of Singapore



There should be training, and it should inform people as to how to use their devices more appropriately, including how to write emails. There are always changes in what is permissible, and those updates should be a part of this ongoing training." - John Carlin, Partner at Morrison & Foerster, former Assistant Attorney General, U.S. Department of Justice.

The article first appeared in
The One Brief

Leave Your Comments

Latest News

More From OP-ED

Go to Home Page »

Site Index The Asian Age