The hackers behind a large-scale Bangladesh bank hack went further than simply stealing money. Now it turns out that they created malware that could compromise the way in which international banks use the SWIFT payment system.
BAE Systems researchers tell Reuters that the hackers who took the central bank of Bangladesh for a ride created malware that was able to deceive banks using the SWIFT system. SWIFT has confirmed to Reuters that it’s “aware of malware targeting its client software.” The organization plans to issue an update for its software some time today to protect the payment systems from attack.
The malware, called evtdiag.exe, allowed the hackers to change records on SWIFT databases in order to hide what they were up to. The criminals could delete records of transfer requests, intercept messages about payments and manipulate the displayed account balances to cover their tracks.
The software was apparently specifically written to attack the Bangladesh bank, but the theory could, according to the researchers, be applied elsewhere. Adrian Nish from BAE Systems told Reuters that it was one of the most elaborate malware hacks he’d ever come across.
The Bangladesh bank hack until now seemed like a farcically amusing comedy of errors. First, the hackers were brought to a halt because they managed to misspell “foundation” as “fandation”—a typo that was noticed by Deutsche Bank, ultimately bringing the heist to an abrupt end. The criminals did, however, manage to make off with $80 million before they were found out.
Then, just last week, a forensic analysis of the hacks found that the bank had been using second-hand $10 network switches without a firewall to link its computers. Those computers were connected to the SWIFT global payment system, which meant the hackers were able to gain access to the credentials required to make high-value transfers straight into their own accounts.
Reuters claims that the attackers actually targeted a very specific piece of SWIFT software known as Alliance Access. So while the SWIFT system is used by thousands of banks and financial institutions, not all of them are affected by the malware.
Update: This article has been updated to reflect comment we received from SWIFT, explaining that:
SWIFT is aware of a malware that aims to reduce financial institutions’ abilities to evidence fraudulent transactions on their local systems. This malware has no impact on SWIFT’s network or core messaging services.
We understand that the malware is designed to hide the traces of fraudulent payments from customers’ local database applications and can only be installed on users’ local systems by attackers that have successfully identified and exploited weaknesses in their local security.