Billion Dollar Hacking

A talk at hillhacks 2016 on the recent Bangladesh Bank heist.

Transcript

1. @captn3m0
   hillhacks 2016
   Billion Dollar Hacking
   

   View Slide

2. Who?
   Nemo (@captn3m0)
   I do payment security at @Razorpay
   

   View Slide

3. What?
   $101 M stolen
   $850 M recovered
   Almost a billion dollars :)
   

   View Slide

4. View Slide

5. How?
   Fraudulent SWIFT
   transactions
   

   View Slide

6. Who?
   From Bangladesh Bank
   To
   Federal Reserve Bank of NY
   Sri Lanka, Philippines Bank (RCBC)
   

   View Slide

7. How Again?
   

   View Slide

8. How (2)
   

   View Slide

9. The patch
   The malware enumerates all processes, and if a process has the module
   liboradb.dll loaded in it, it will patch 2 bytes in its memory at a specific offset.
   The patch will replace 2 bytes 0x75 and 0x04 with the bytes 0x90 and 0x90.
   

   View Slide

10. liboradb.dll
    SWIFT's Alliance software suite (powered by Oracle Database):
    • Reading the Alliance database path from the registry;
    • Starting the database;
    • Performing database backup & restore functions.
    

    View Slide

11. SQL Hacking
    1. Find relevant SWIFT transfers
    2. Manipulate them
    SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%
    s%%' AND MESG_TRN_REF LIKE '%%%s%%';
    The MESG_S_UMID is then passed to DELETE statements, deleting the transaction from the local
    database.
    DELETE FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';
    DELETE FROM SAAOWNER.TEXT_%s WHERE TEXT_S_UMID = '%s';
    

    View Slide

12. sudo make me a millionaire
    UPDATE SAAOWNER.MESG_%s SET MESG_FIN_CCY_AMOUNT = '%s' WHERE
    MESG_S_UMID = '%s';
    UPDATE SAAOWNER.TEXT_%s SET TEXT_DATA_BLOCK = UTL_RAW.
    CAST_TO_VARCHAR2('%s') WHERE TEXT_S_UMID = '%s';
    

    View Slide

13. Printer Hacking
    The malware intercepts the confirmation SWIFT messages and then sends for
    printing the 'doctored' (manipulated) copies of such messages in order to cover
    up the fraudulent transactions.
    To achieve that, the SWIFT messages the malware locates are read, parsed, and
    converted into PRT files that describe the text in Printer Command Language
    (PCL).
    

    View Slide

14. What next?
    1. $850 Million was recovered because Fed Bank noticed the fraudulent
    transactions
    2. SWIFT is calling for an update to the Bank network security
    a. We have made a mandatory software update available to customers to help them enhance
    their security and to spot inconsistencies in their local database records.
    3. Other Banks have been targeted by the same vulnerability as well
    4. The Treasurer of RCBC has resigned, and the manager of one of its branches
    is facing criminal charges after she withdrew $427,000 from an account
    linked to the theft.
    5. Bangladesh Bank chief governor Atiur Rahman resigned from his post
    

    View Slide

15. References
    1. http://baesystemsai.blogspot.in/2016/04/two-bytes-to-951m.html
    2. http://arstechnica.com/security/2016/04/billion-dollar-bangladesh-hack-
    swift-software-hacked-no-firewalls-10-switches/
    3. https://en.wikipedia.org/wiki/2016_Bangladesh_Bank_heist
    4. http://www.nytimes.com/2016/05/27/business/dealbook/north-korea-
    linked-to-digital-thefts-from-global-banks.html?_r=0
    5. http://www.smh.com.au/business/banking-and-finance/printer-error-foiled-
    billiondollar-bank-heist-20160317-gnljm4.html
    6. http://www.reuters.com/article/us-usa-nyfed-bangladesh-malware-exclusiv-
    idUSKCN0XM0DR
    

    View Slide