Re: Tales from the UK: Basel Part IV

> Received: from toad.com [140.174.2.1] by alcor.process.com
>            with SMTP-OpenVMS via TCP/IP; Tue, 25 Jun 1996 11:11 -0400
> Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id HAA10621 for cypherpunks-outgoing; Tue, 25 Jun 1996 07:04:53 -0700 (PDT)
> Received: from mailhost.IntNet.net (mercury.IntNet.net [198.252.32.180]) by toad.com (8.7.5/8.7.3) with SMTP id HAA10616 for <cypherpunks@toad.com>; Tue, 25 Jun 1996 07:04:46 -0700 (PDT)
> From: winn@Infowar.Com
> Received: from 198.252.40.157 by mailhost.IntNet.net (SMI-8.6/SMI-SVR4)
> 	id KAA24757; Tue, 25 Jun 1996 10:06:02 -0400
> Date: Tue, 25 Jun 1996 10:06:02 -0400
> Message-Id: <199606251406.KAA24757@mailhost.IntNet.net>
> MIME-Version: 1.0
> Content-Type: text/plain
> Content-Transfer-Encoding: 7bit
> Subject: Tales from the UK: Basel Part IV
> To: Nmunro@access.digex.net
> X-Mailer: SPRY Mail Version: 04.00.06.17
> Sender: owner-cypherpunks@toad.com
> Precedence: bulk
> 
> June, 1996: Basel, Switzerland
> More on the London Attacks: Part IV

winn writes:

[...]
> The perpetrator(s) would first place a call to the upper management of the 
> intended victim announcing his/her intention. "We will take down your bank (or 
> financial organization) unless you pay us a lot of money not to." 
> 
> The intended victims each sluffed off the threats. Shortly thereafter (within a 
> day or two) their financial systems would seemingly collapse for no reason at 
> the prescribed time and as promised by the caller. Banking services and/or 
> trading would come to a halt, for about an hour or so, and then the affected 
> systems would come back on line. Backups were ineffective; typical disaster 
> recovery methods, I was told, just didn't work.
[...]
> I was told unequivocally that all of the four attacks used the same methodology: 
> malicious software was somehow injected into the systems but neither was either 
> forthcoming or knowledgeable about the specifics. They specifically denied that 
> HERF techniques were used. But many questions remained, and I was unsuccessful 
> at getting what I would call good answers to these and more queries:
> 
> 	- Which systems were affected exactly?
> 	- How were the backup/redundancies disconnected?
> 	- Exactly what do you mean by remote control?
> 	- Did you ever find the offending software?
> 	- Was it an insider job?
> 	- Was it pure hacking?
> 	- Was is mission critical application software gone awry?
> 	- And so on . . . .
[...] 
> 		        Winn Schwartau - Interpact, Inc.
> 		        Information Warfare and InfoSec
> 		       V: 813.393.6600 / F: 813.393.6361
> 			    Winn@InfoWar.Com

I used to work in a major money center bank (late, lamented Irving Trust). I find this
account highly improbable, considering the precautions I've seen used in these
situations.

The only possibility seems to be an inside job, inserting a logic bomb into some
crucial piece of software, and then setting it off either through an inside collaborator,
or by sending an appropriate message through the system from outside: "if you
see a transfer from acct 346769 to 56789 of $3,141,592.65, shut down for an
hour".

Inserting a bomb like this would have been extremely difficult, if not impossible, at IT.
Code modifications were always checked by more than one programmer, and an
extensive 'backout' mechanism existed which permitted us to go back to older versions
of the software in a matter of minutes.

Cracking the system from outside is also unlikely - the operational machines had
no internet connection, dial in, or connection to our development or administrative
lans, nor did they run any of the usual demons 
through which attacks are made. They were connected only to other parts of the
operational system. Even the developers did not have direct access to them - 
putting on new software involved writing it to a removable HD which was then 
physically transfered to the operational systems. Only the operators were permitted
to touch the consoles of the operational systems.

Finally, we maintained a 'hot site' duplicating most of our capability, at a location
about 100 miles away, in case of catastrophe. Switching to that would have taken
a few hours, but was certainly doable.

>Thereafter, a second call would be made to senior executives of the victim
>firms, and the extortion demands for payment made again. In these cases,
>electronic payments to Switzerland were made, and the monies were then
>secreted from their temporary Swiss home within seconds - destined for
>places unknown or unannounced.

I also find the claim improbable - the Swiss authorities are quite cooperative when
there is good reason to beleive a crime is being committed.

If it's an inside job, then it's not much of a threat, since each financial institution
would need to be penetrated separately. 

The only way in which this might NOT be an inside job would be if a logic bomb
was inserted into some piece of commercial software used by all of the targets,
such as a message database. If so, then there is no reason not to identify the
package.

Until names get named, I'm going to view this story with extreme skepticism.


Finally, people may wish to look at the source of the posting. Mr Schwartau
is a consultant who makes his living by advising institutions on how to protect
themselves against attacks of the type claimed in this story. 

Peter Trei
Senior Software Engineer
Purveyor Development Team                                
Process Software Corporation
http://www.process.com
trei@process.com

Time to insert a cautionary thought into this whole Info-war HERFsteria:

I'm just an EDP Security Specialist with 10 years experience in
Mainframe, PC and Network systems, and not some great expert with an
international reputation to protect, so take this for what it's worth.

However, I get the impression that there are some pretty smart people on
these lists.  You know, the kind of people who, when you say, "someone
just did the impossible," will figure out how they did it to solve the
mystery.  And there are also some people who like to look pretty smart by
going around and saying the kind of things that those pretty smart people
figured out, in order to enhance their reputation and keep their audiences
worried.  And there might even be people who'd be inclined to go out and
try those things that the pretty smart people figured out.

So, let's say that some public wanna-be-smart decides that they need to
scare people with stories of evil things that might be done, and so they
post a story of how they've already been claimed to be done, just to see
how the really-are-smart folks respond.  And then they go and take all
that free stuff and make a bundle off of it, and maybe hackers use it,
and, well, you get the idea.

Now, I'm not saying anyone on these lists does any of this stuff, 'cuz I
don't know.  But when it gets to speculation, well, maybe lets just say
the bogeyman did it, with help from his evil hacker friend Foobar.  It's a
lot safer, and maybe just as true.

-----
$0.02

- Reg Harbeck     (URL: http://www.freenet.calgary.ab.ca/~rharbeck)