Instead of blaming the US Federal Reserve after $101 million went missing, Bangladesh should look in the mirror.
That’s the conclusion of cyber security experts after a breach that saw funds from Bangladesh's account at the New York Fed transferred to the Philippines and beyond. Attempts to withdraw another $850 million were foiled in part because the hackers misspelled the name of one of the recipients.
"Relying on poor spelling should not be a security policy," Andrey Dulkin, a senior director at CyberArk, a Jerusalem-based cyber security company, said in an e-mail. "If the Bangladesh Bank had been monitoring the activity of these accounts, it could've quickly identified the anomalous behaviour and not have been completely reliant" on third parties to flag suspicious activity, he said.
Bangladesh Finance Minister Abul Maal Abdul Muhith has lashed out at the Fed and his own central bank as the government leads a multi-country effort to retrieve the funds. Last week he accused the Fed of "irregularities" that led to the unauthorised money transfer and promised a legal battle. On Sunday, he called Bangladesh Bank's handling of the situation "very incompetent."
'Quite shocking'
There's little dispute that Bangladesh could've done more to prevent a bold heist that is turning into a cautionary tale for central banks around the globe. The issue is particularly urgent for developing countries like Bangladesh that have seen growth rates and foreign reserves jump in recent years.
"All central banks have since looked into their systems," Sri Lanka central bank Governor Arjuna Mahendran said in an interview with Bloomberg Television in Singapore on Tuesday. "The messaging system with the Fed is under scrutiny. The key is people. They get lazy, they develop bad habits."
Bangladesh should be "very concerned" about the risk of copy-cat attacks, said Victor Keong, a partner at consultant Deloitte Touche Tohmatsu Ltd. in Singapore.
"It is quite shocking," Keong said. "If a central bank can have such lapses – and it is the regulator – then those it regulates might not be so well protected."
While countries like Singapore, South Korea and Japan have introduced coherent cyber policies to protect their institutions, nations including Thailand and the Philippines needed to improve their defenses, according to 2015 rankings on "cyber maturity" published by the Canberra-based Australian Strategic Policy Institute, known as ASPI. Bangladesh, absent from the ranking in 2015, will be included this year.
Finger wagging
"It is interesting that the Bangladeshi government came and finger wagged at the Fed to deflect attention from their own bank," said Tobias Feakin, director of the national security program at ASPI.
The US, Canada, Norway, Brazil and Germany rank among the highest in a Global Cybersecurity Index published by ABI Research and the International Telecommunication Union. Toward the bottom are smaller less developed economies, including Cambodia, Cuba and Honduras.
A Fed spokeswoman said last week that instructions to make payments from the Bangladesh central bank's account followed protocol and were authenticated by the SWIFT codes system commonly used for international transactions. There were no signs the Fed's systems were hacked, she said.
'Weakest link’
Malicious software code, known as malware, had been introduced into the bank's systems in January without the knowledge of the bank's information systems staff, according to an official familiar with the Bangladesh Bank investigation. The hackers struck the systems on Feb 4, said the official, who declined to be named because he's not authorised to speak about the probe.
"We don't know how the malware got into the system, but there seemed already to be high-level understanding of how this bank operated and information about the people going in and out," said Feakin from ASPI. "With cyber, it will always be the case of targeting the weakest link."
Bangladesh Bank is investigating eight officials who carry out foreign exchange transactions by rotation, according to a Finance Ministry official who asked not to be identified because he's not authorised to speak about the probe. Some of the officials found the central bank's computer systems inoperative a day after the theft, but didn't immediately inform their supervisors, the official said.
Forensic team
Bangladesh Bank said the integration of all modern protection systems on its information technology platform to prevent future cyber attacks "was progressing fast."
Subhankar Saha, a spokesman for Bangladesh Bank, said it had no comment on the Finance Minister's remarks accusing it of incompetence. The central bank has set up a forensic team led by Rakesh Asthana, chief executive officer of World Informatix, a Virginia-based cyber security company. The bank also hired Mandiant, a unit of US-based cyber security firm FireEye Inc.
"Asia’s financial institutions face increasingly sophisticated cyber threat actors, and most need to improve their capabilities in order to better protect their systems," said Bryce Boland, chief technology officer for Asia Pacific at FireEye.
‘Bigger targets’
The Philippines is also helping out following reports that the money ended up in Manila. Authorities are preparing charges and hope to return some of the stolen cash, Teresita Herbosa, the chairman of the Securities and Exchange Commission, told reporters in Manila on Monday.
In order to carry out the attack on the central bank, hackers would've had to target Bangladesh Bank system administrators and application accounts that would enable an attacker to operate inside its network and execute high volume transfers, said Dulkin from CyberArk.
He said the attack on Bangladesh Bank was similar in nature to recent attacks carried out by the Carbanak gang, which stole as much as $1 billion from banks and other financial institutions and described in a Feb 2015 report by Kaspersky Lab, Russia's biggest maker of antivirus software.
"Attackers look for the credentials that would enable them to reach their goals," Dulkin said. "We can expect attacks of this nature to become more aggressive and cyber attackers in general to become bolder and more audacious, going after bigger targets for greater sums."
Bloomberg
Tue Mar 15 2016
![Don't blame the Fed: Bangladesh seen at fault for bank heist Don't blame the Fed: Bangladesh seen at fault for bank heist](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/http://img.astroawani.com/2015-09/61442735094_cybersecurity.jpg)
Bank robbers successfully made five transfers out of the Bangladesh bank's account at the New York Fed. Of the $101 million they stole, $80 million ended up in accounts located in the Philippines, and $21 million went to Sri Lankan accounts.
![Ringgit kekal dibuka tinggi, menjelang data KDNK suku kedua Malaysia esok Ringgit kekal dibuka tinggi, menjelang data KDNK suku kedua Malaysia esok](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/https://img.astroawani.com/2024-01/41705320699_TBringgitmalaysia.jpg)
Ringgit kekal dibuka tinggi, menjelang data KDNK suku kedua Malaysia esok
Pada 8 pagi, ringgit meningkat sedikit kepada 4.4150/4250 berbanding dolar AS daripada 4.4170/4235 ketika ditutup pada Rabu.
#AWANIRingkas 15 Ogos 2024 | 9 AM
Berikut merupakan rangkuman berita setakat 9 pagi, 15 Ogos 2024
1️⃣ TPM wakili Malaysia di EMM di Peru
2️⃣ Misteri kehilangan Nidza Afham
3️⃣ Rundingan gencatan Gaza di Qatar hari ini
#awaniringkas
1️⃣ TPM wakili Malaysia di EMM di Peru
2️⃣ Misteri kehilangan Nidza Afham
3️⃣ Rundingan gencatan Gaza di Qatar hari ini
#awaniringkas
Belia & pekerjaan: Pengangguran belia global menurun, cabaran tetap ada
Walaupun kadar pengangguran belia global menurun, kebimbangan meningkat mengenai belia NEET (tidak bekerja, belajar, atau menjalani latihan). Laporan Pertubuhan Buruh Antarabangsa (ILO) mendedahkan jurang dan cabaran besar yang terus menghantui belia, terutama di wilayah tertentu dan kalangan wanita muda. Bagaimana untuk menganalisis tren global dalam konteks keadaan tempatan bagi memastikan penemuan antarabangsa dapat disesuaikan dengan strategi nasional?
AWANI Pagi I UiTM 25 Tahun, Apa Seterusnya?
Dalam meraikan pencapaian UiTM yang telah mencapai usia 25 tahun, ia kekal sebagai universiti teramai melahirkan graduan yang menyumbang tenaga, dan kemahiran merentas industri di Malaysia.
Ikuti AWANI Pagi untuk kita ikuti bagaimana UiTM mahu kekal melahirkan graduan graduan relevan dalam pasaran dunia yang semakin berubah.
Ikuti AWANI Pagi untuk kita ikuti bagaimana UiTM mahu kekal melahirkan graduan graduan relevan dalam pasaran dunia yang semakin berubah.
![SUHAKAM gesa penggantungan semua operasi pengusiran Bajau Laut SUHAKAM gesa penggantungan semua operasi pengusiran Bajau Laut](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/https://img.astroawani.com/2022-12/51670516991_suhakam.jpg)
SUHAKAM gesa penggantungan semua operasi pengusiran Bajau Laut
SUHAKAM gesa penggantungan segera semua operasi dan aktiviti pengusiran yang sedang berlaku di Semporna.
Data & Statistik: Kadar pengangguran global belia 2024
Walaupun kadar pengangguran belia global menurun, jumlah belia yang tidak bekerja, belajar, atau menjalani latihan golongan NEET masih membimbangkan. Laporan terkini Pertubuhan Buruh Antarabangsa (ILO) menunjukkan cabaran serius untuk belia, terutamanya di kawasan tertentu dan dalam kalangan wanita muda.
![Pencipta biskut Famous Amos meninggal dunia pada usia 88 tahun Pencipta biskut Famous Amos meninggal dunia pada usia 88 tahun](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/https://img.astroawani.com/2024-08/51723685297_WallyAmosJrFamou.jpg)
Pencipta biskut Famous Amos meninggal dunia pada usia 88 tahun
"Famous Amos adalah kisah kejayaan besar Amerika dan sumber kebanggaan bagi masyarakat kulit hitam."
![Lebih 1,600 premis PKS sertai program SOLVE 4 SME Lebih 1,600 premis PKS sertai program SOLVE 4 SME](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/https://img.astroawani.com/2024-08/71723651455_TBSOLVE.jpg)
Lebih 1,600 premis PKS sertai program "SOLVE 4 SME"
JKKP memaklumkan penyertaan itu melebihi sasaran jabatan itu dan telah memberi manfaat kepada 70,824 pekerja PKS.
![PRK Nenggiri: PN ada peluang menang, tapi jangan over-confident - Muhyiddin PRK Nenggiri: PN ada peluang menang, tapi jangan over-confident - Muhyiddin](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/https://img.astroawani.com/2024-04/51713678198_MuhyiddinYassin.jpg)
PRK Nenggiri: "PN ada peluang menang, tapi jangan over-confident" - Muhyiddin
Muhyiddin optimis dengan kemenangan calon PN, Mohd Rizwadi Ismail sekali gus mempertahankan kerusi DUN Nenggiri.
![Ahli ekonomi yakin pertumbuhan KDNK sekitar 5.8 peratus pada suku kedua 2024 Ahli ekonomi yakin pertumbuhan KDNK sekitar 5.8 peratus pada suku kedua 2024](https://resizer-awani.eco.astro.com.my/tr:w-177,h-100,q-100,f-auto/https://img.astroawani.com/2024-06/81717305735_EkonomiMalaysia.jpg)
Ahli ekonomi yakin pertumbuhan KDNK sekitar 5.8 peratus pada suku kedua 2024
Kalangan ahli ekonomi yakin KDNK Malaysia bagi suku kedua 2024 akan berkembang pada 5.8 peratus berbanding 4.2 peratus pada suku pertama tahun ini.