Salacious headlines are making the rounds, complete with possibly the worst stock hacker picture ever, indicating that the $81 million dollar theft from the Central Bank of Bangladesh was pretty easy to pull off because the bank used “second hand routers” and implying that there was no firewall employed by the bank.
The money was stolen when criminals hijacked the SWIFT terminal(s) at the Central Bank of Bangladesh, and proceeded to issue transfers totally $1 billion to foreign bank accounts. Fortunately, most of the transactions were cancelled after the attackers apparently made a spelling mistake in the name of one of the recipients.
We don’t know all that much about how the crime really happened, and a Reuters story gives a little more detail, but not much more, based on comments from an investigator.
We know is the following:
- The Central Bank of Bangladesh has 4 “servers” that it keeps in an isolated room with no windows on the 8th floor of it’s office.
- Investigators commented that these 4 servers were connected to the bank network using second hand, $10 routers or switches (referred to as both in various sources).
- Investigators commented that the crime would have been more difficult if a firewall had been in place.
And so we end up with a headline that reads “Bank with No Firewall…” and “Bangladesh Bank exposed to hackers by cheap switches, no firewall: police”.
The implication is that the problem arose from the quality of the switches and the lack of a firewall. These factors are not the cause of the problem. This bank could have spent a few thousand dollars on a managed switch, and a few tens of thousands on a fancy next gen firewall from your favorite vendor. And almost certainly they would have been configured in a manner that still let the hack happen. If an organization does not have the talent and/or resources to design and operate a secure network, as is apparently the case here, they we will end up with the fancy managed switch configured to be a dumb switch and the firewall will probably have a policy that lets all traffic through in both directions. We are pointing the finger at the technology used, but the state of the technology is a symptom, not the problem.
We can infer from the story that the four SWIFT servers in the isolated room are attached to a cheap 5 or 10 port switch, plugged into a jack that connects those systems to the broader, probably flat, bank network. I strongly suspect that the bank does indeed have a firewall at it’s Internet gateway, but there was very likely nothing sitting between the football watching, horoscope checking, phishing link clicking masses of bank employee workstations to protect those delicious SWIFT terminals in the locked room*. Or maybe the only place to browse the Internet in private at the bank is from the SWIFT terminals themselves. After all, the room is small, locked and has no windows**.
It doesn’t take expensive firewalls or expensive switches to protect four systems in a locked room. But, we apparently think of next gen firewalls as the APT equivalent of my tiger repellent rock***.
*I have no idea if they really do this, but it happens everywhere else, so I’m going with it.
** I have no idea if they did this, either, but I know people who would have done it, were the opportunity available to them.
***Go ahead and laugh. I’ve NEVER been attacked by a tiger, though.