Blame for the February cyber theft of $81 million dollars from the Bangladesh central bank New York reserves in February has been levelled at SWIFT technicians by the investigating Bangladeshi police, according to Reuters. Swift has rejected these claims.
Mohammad Shah Alam, head of the criminal investigation department of the Bangladesh police, told Reuters, “We found a lot of loopholes. The changes caused much more risk for Bangladesh Bank.”
The accusation is that SWIFT technicians introduced vulnerabilities when they connected SWIFT to the bank’s first real-time gross settlement (RTGS) system. An unnamed bank official claimed, “It was the responsibility of SWIFT to check for weaknesses once they had set up the system. But it does not appear to have been done.”
The police suggest that it was Swift’s responsibility to install the RTGS to SWIFT connection on a separate firewalled LAN. Reuters reports, “When they installed a networking switch to control access to SWIFT, they chose to use a rudimentary old one they had found unused in the bank, rather than a more sophisticated, managed switch that gave the bank the ability to control access to the network, police said.”
Hackers were then able to send forged instructions, ostensibly from the central bank in Dhaka, to the New York Fed seeking to transfer almost $1 billion from the bank’s account. Most of the transfers were blocked, but $81 million dollars was sent to a bank in the Phillipines – a country with secretive bank rules and lax (or non-existant) money-laundering controls in its casinos.
The Bangladeshi bank claims that both SWIFT and the New York Fed share some responsibility for the theft.
SWIFT has quickly and fiercely denied any responsibility for making the bank’s systems less secure. “SWIFT rejects the false, inaccurate and misleading allegations made by Bangladesh Bank and Bangladesh Police’s Criminal Investigation Department (CID) officials to Reuters. The accusations have no basis in fact,” it said in a statement posted yesterday.
In fact, SWIFT denies any responsibility. “As a SWIFT user like any other, Bangladesh Bank is responsible for the security of its own systems interfacing with the SWIFT network and their related environment – starting with basic password protection practices – in much the same way as they are responsible for their other internal security considerations.”
This is a fairly common position among ‘cloud’ providers, and closely follows Microsoft’s recent statement on who is responsible for what when connecting to Microsoft cloud. According to Microsoft there is a clear separation of responsibility. The provider (SWIFT) is responsible for the physical aspects of the its own IT infrastructure and the software that it provides. The customer (Bangladesh Central Bank) is responsible for its own data.
SWIFT certainly appears confident in its position and annoyed at the bank’s suggestions. “SWIFT looks forward to the meeting with Bangladesh Bank and New York Federal Reserve Bank officials in Basel on 10th May, when the bank’s security issues and these baseless allegations will be discussed. SWIFT will not comment further ahead of that meeting.”