Tech
How to Commit a Bank Robbery (Or Stop One) Using the Internet
Staff Reporter
First Posted: Oct 21, 2013 11:33 PM EDT
Two recent incidents have shown that you no longer need to risk life and limb to rob a bank. In September, an attempted cyber-robbery at a London branch of Santander was stopped in its tracks and shortly afterwards, details emerged of a similar earlier, and more successful attack that had taken place at a Barclays branch in North London. The culprits escaped with £1.3 million.
By Eerke Boiten, University of Kent
Now several people have been arrested in connection with both crimes. Although a link between the two has not been stated publicly, both offer an insight into the new threats faced by financial institutions now that cyber-criminals have developed their tool kits and techniques.
The Keyboard Video Mouse
The Keyboard Video Mouse is crucial in bank robbery 2.0. This is a device that connects to the communication channels of the mouse, the keyboard and the monitor of a computer or even several computers. In the case of Santander, one of the culprits posed as a computer engineer, gained access to the branch machines and attached a KVM.
It is likely only a single computer was attacked, as this type of KVM would have to be conspicuously wired to all the computers it was intended to control. Crucially, it would also need to be directed from inside the building. This would all mean that a larger and on-going inside job would be needed.
KVMs sell for about £10 but from the picture released by the police from the Barclays incident, it appears that a more sophisticated type was used. This is the KVM over IP, or “iKVM”, which can be bought for about £25 and can be used to fully control a computer via the internet.
So a different type of connection needed to be created on the spot. Wireless access might have been an option but would have required someone nearby to control the iKVM - risky for a bank robber - and wireless signals can also be distorted as a safety measure. Instead, it looks like a basic 3G router was attached to the iKVM so that it could be accessed through the mobile network. The fake engineer would only have had to glance at his phone during his visit to confirm the signal strength.
Making it an inside job
Once the KVM is in place, the final element of the attack is to make sensible use of the controlled computer, which is, in essence, just like an “inside job” by bank staff.
To prevent traditional inside jobs, banks limit the amount of damage individual staff members can do using their own computer, and monitor them for unusual behaviour. The possible involvement of 11 other people in the Santander case shows the plan was never to install the iKVM and then hope for the best. The roles of the other people alleged to have been involved in the conspiracy may have been to circumvent the bank’s various protection mechanisms.
Another option is to identify a single, specific, profitable target action for the compromised computer to complete. This would possibly be something more sophisticated than transferring money to a bank account in the Cayman Islands. For example, if the computer is used for processes involving customer bank cards, it might gather enough information for cloning cards, which could be used or sold on. Indeed, it has been reported that searches following the arrests turned up details of thousands of credit cards.
Fending them off
What is very interesting about these stories is that they involve security protection measures at many different levels. In the age of cyber-crime, a bank needs to have physical security, network security, application and communication security.
To protect its physical security, a bank needs stringent access controls for computer rooms. Even bank staff should not be allowed to connect hardware to their computers, let alone open them up to install cards. Now this particular attack has been exposed, many more banks are probably having their computers checked out for rogue cards and devices.
Network firewalls should prevent malicious incoming and outgoing communications and, within local networks, intrusion detection software can flag up unusual data. But if the mobile network was indeed used to access the iKVM in the Santander case, banks may need to do more to monitor and disrupt mobile communications in critical parts of their buildings.
Application security should defend against insider attacks. It should spot unusual behaviour, and limit the damage that can be done by a corrupt user.
Finally, communication security cannot be overlooked. It is unlikely that the fake engineer, once arrested, immediately named all his co-conspirators or that he had a handy mailing list called “Santander” in his email client. Indeed, police undertook a long-standing surveillance operation, based on some initial suspicion. Maybe this was something observed in or around the bank. Or was it intelligence from other criminal investigations that sparked it all off?
Some of these security measures, such as firewalls, are well understood and widely employed. But others are still in the early stages of development. Researchers in cyber security at Kent are looking at how security systems can self-adapt and respond automatically to anomalous behaviour such as that characterised by the “insider attack” scenario described above. Cyber crime is still on the rise, and banks will need to adopt a range of established and novel security measures in different areas to stay ahead of this new breed of robber.
Eerke Boiten is a senior lecturer in the School of Computing at the University of Kent, and Director of the University's interdisciplinary Centre for Cyber Security Research. He receives funding from EPSRC for the CryptoForma Network of Excellence on Cryptography and Formal Methods.
See Now:
NASA's Juno Spacecraft's Rendezvous With Jupiter's Mammoth Cyclone
This article was originally published at The Conversation.
More on SCIENCEwr
First Posted: Oct 21, 2013 11:33 PM EDT
Two recent incidents have shown that you no longer need to risk life and limb to rob a bank. In September, an attempted cyber-robbery at a London branch of Santander was stopped in its tracks and shortly afterwards, details emerged of a similar earlier, and more successful attack that had taken place at a Barclays branch in North London. The culprits escaped with £1.3 million.
By Eerke Boiten, University of Kent
Now several people have been arrested in connection with both crimes. Although a link between the two has not been stated publicly, both offer an insight into the new threats faced by financial institutions now that cyber-criminals have developed their tool kits and techniques.
The Keyboard Video Mouse
The Keyboard Video Mouse is crucial in bank robbery 2.0. This is a device that connects to the communication channels of the mouse, the keyboard and the monitor of a computer or even several computers. In the case of Santander, one of the culprits posed as a computer engineer, gained access to the branch machines and attached a KVM.
It is likely only a single computer was attacked, as this type of KVM would have to be conspicuously wired to all the computers it was intended to control. Crucially, it would also need to be directed from inside the building. This would all mean that a larger and on-going inside job would be needed.
KVMs sell for about £10 but from the picture released by the police from the Barclays incident, it appears that a more sophisticated type was used. This is the KVM over IP, or “iKVM”, which can be bought for about £25 and can be used to fully control a computer via the internet.
So a different type of connection needed to be created on the spot. Wireless access might have been an option but would have required someone nearby to control the iKVM - risky for a bank robber - and wireless signals can also be distorted as a safety measure. Instead, it looks like a basic 3G router was attached to the iKVM so that it could be accessed through the mobile network. The fake engineer would only have had to glance at his phone during his visit to confirm the signal strength.
Making it an inside job
Once the KVM is in place, the final element of the attack is to make sensible use of the controlled computer, which is, in essence, just like an “inside job” by bank staff.
To prevent traditional inside jobs, banks limit the amount of damage individual staff members can do using their own computer, and monitor them for unusual behaviour. The possible involvement of 11 other people in the Santander case shows the plan was never to install the iKVM and then hope for the best. The roles of the other people alleged to have been involved in the conspiracy may have been to circumvent the bank’s various protection mechanisms.
Another option is to identify a single, specific, profitable target action for the compromised computer to complete. This would possibly be something more sophisticated than transferring money to a bank account in the Cayman Islands. For example, if the computer is used for processes involving customer bank cards, it might gather enough information for cloning cards, which could be used or sold on. Indeed, it has been reported that searches following the arrests turned up details of thousands of credit cards.
Fending them off
What is very interesting about these stories is that they involve security protection measures at many different levels. In the age of cyber-crime, a bank needs to have physical security, network security, application and communication security.
To protect its physical security, a bank needs stringent access controls for computer rooms. Even bank staff should not be allowed to connect hardware to their computers, let alone open them up to install cards. Now this particular attack has been exposed, many more banks are probably having their computers checked out for rogue cards and devices.
Network firewalls should prevent malicious incoming and outgoing communications and, within local networks, intrusion detection software can flag up unusual data. But if the mobile network was indeed used to access the iKVM in the Santander case, banks may need to do more to monitor and disrupt mobile communications in critical parts of their buildings.
Application security should defend against insider attacks. It should spot unusual behaviour, and limit the damage that can be done by a corrupt user.
Finally, communication security cannot be overlooked. It is unlikely that the fake engineer, once arrested, immediately named all his co-conspirators or that he had a handy mailing list called “Santander” in his email client. Indeed, police undertook a long-standing surveillance operation, based on some initial suspicion. Maybe this was something observed in or around the bank. Or was it intelligence from other criminal investigations that sparked it all off?
Some of these security measures, such as firewalls, are well understood and widely employed. But others are still in the early stages of development. Researchers in cyber security at Kent are looking at how security systems can self-adapt and respond automatically to anomalous behaviour such as that characterised by the “insider attack” scenario described above. Cyber crime is still on the rise, and banks will need to adopt a range of established and novel security measures in different areas to stay ahead of this new breed of robber.
Eerke Boiten is a senior lecturer in the School of Computing at the University of Kent, and Director of the University's interdisciplinary Centre for Cyber Security Research. He receives funding from EPSRC for the CryptoForma Network of Excellence on Cryptography and Formal Methods.
See Now: NASA's Juno Spacecraft's Rendezvous With Jupiter's Mammoth Cyclone