The Digital Bank Heist: Part 1

The joke above reminded me of the Bangladesh Bank heist which was described in this excellent DarkNet Diary podcast. We’ve heard of million-dollar heists in so many Hollywood movies. That’s a lot, but when you go for digital robbery, the sky’s the limit. The amount they tried to rob from the Bangladesh Bank? A billion dollars. No typos, that’s indeed a billion dollars.

 

You’d rightly be asking the question the podcast asks:

“Who would have a billion dollars lying around for someone to grab?”

National banks, that’s who (the equivalents of RBI). That’s why the hackers picked the Bangladesh Bank as their target:

“The plan was to hack into the Bangladesh Bank and transfer out as much money as they could before anyone could catch them.”

 

How did they get into the bank’s network? Good old phishing mails (yes, the ones we are warned not to click on) got them in. From that one computer, the hackers hopped around the bank’s network, familiarizing themselves with details of the network, how to move money etc. Banks use a system called SWIFT to transfer money. The hackers soon found the system that could do SWIFT transfers.

 

Most of the reserves of the Bangladesh Bank were with the New York Fed. So that’s where the billion dollars lay. Of course, attempting to transfer a billion dollars at one shot was risky:

“A big transfer like that might require additional authorization or something.  Why put all your eggs in one basket?  If that one-billion-dollar transfer fails, then everything fails.  The hackers decided to break up the theft into many smaller transfers.”

The hackers decided to split it into 36 different transfers.

 

The “prep work” to create accounts to receive these electronic transfers was completed. A year in advance. This was a long, patiently done heist. The time they chose to strike was pure (evil) genius. They picked a long weekend, both in Bangladesh (source) and the Philippines (destination). Why did this matter? It reduced the odds that anyone would be present at both ends of the sender-receiver banks, should anyone get suspicious and call to confirm. In addition:

“Three time zones, here; you’ve got Bangladesh Bank which is the bank that’s been hacked into where the money’s gonna be transferred from, you’ve got where the actual money is which is New York, which is obviously a different time zone, and you’ve got where the money is going which is the Philippines which is yet another time zone. What they did was played these three time zones to their advantage.”

 

But things didn’t go to plan. The New York Fed started the transfers. One of the early ones went to a Sri Lankan charity, but the spelling was wrong. It caught someone’s attention, which set off questions in the New York branch. But Friday was a holiday in Bangladesh and nobody responded. The New York Fed stopped all further transfers. But by then, 81 million dollars had already been transferred.

 

Surely there’d be some checks in Bangladesh to notice huge transfers? Indeed there were. A printer was set to print the transactions as they happened (why paper? Because digital logs can be erased). And an employee was supposed to look at the printouts immediately. But the hackers were a step ahead:

“The thieves hacked the printer to make it print blank pages of transaction records.”

 

As I said, $81 million had already been stolen before the US side stopped the transfers. But how does one take that much money out of the Philippines (and other) banks for good? Won’t it leave an electronic trail? And how do you launder it quickly? All that and more in the next blog.