Security threats Toolkit

Inside the biggest bank raid that never was

Tags:
Hackers,
Sumitomo

Dan Ilet ZDNet.co.uk

Published: 21 Mar 2005 10:25 GMT

As Yaron Bolondi faces charges of money laundering and fraud, police are actively hunting down other suspects in the attempted hacking-based theft of £220m from Sumitomo Mitsui Bank (SMB).

The National Hi-Tech Crime Unit and the bank itself are keeping quiet over the affair, and technical details of the hack are still sketchy, But reports suggest that the would-be thieves used keystroke loggers to snatch sensitive information from SMB's employees and were thus able to manipulate the bank's systems.

If this proves to be true, it still unclear whether the key stroke logging system used was based around a hardware device fitted to the back of certain computers, or was purely software based — potentially sent by an email virus.

"They are being very cagey about how the hack was done," said Graham Cluley, senior technology consultant for antivirus company Sophos. "I even heard that there were no keystroke loggers. In many ways, hardware keystroke loggers are harder to detect than software. They can be fitted easily. So maybe it was an inside job."

Legal experts also feel an internal employee may have facilitated the attack. "My gut feeling is that this came from the inside," said Mark Smith, a solicitor for law firm Olswang. "It shows that you can't rely on perimeter security. Intrusion detection gets a lot of bad press because people don’t know how to operate it, but that can really help."

Chief information security analyst Paul Wood of email security firm MessageLabs said it was unimportant which type of keystroke logger they used as the bank had the right auditing practices in place to catch the thieves.

"Whether it's a hardware or software keystroke logger, that's all supposition," said Wood. "But they are all a threat to business. We don’t know whether the keystroke logger was from an email-borne virus or it was a physical keylogger. There are quite a few ways of detecting [keystroke loggers]. It goes to show that if you have sufficiently strong auditing, you have at least a chance of catching it before it's too late."