Online finance is a multibillion-dollar industry. PayPal processed more than 4.9 billion transactions worth $282 billion in 2015 alone. But with big numbers comes big risk: Web-based financial sites are now high-value targets. As noted by Threatpost, financial transaction network SWIFT is tapping users to fast-track their fight on cyberfraud.
Money in Motion
The Society for Worldwide Interbank Financial Telecommunications (SWIFT) is a popular tool for financial organizations to send and receive secure money transfer requests. The problem? Cybercriminals are also interested. Banks in Bangladesh, Vietnam and Ecuador have all been targeted by attackers who leverage the SWIFT network to send fake transfer requests, which are quickly processed and often approved.
Cybercriminals who infiltrated Bangladesh Bank were able to steal more than $80 million after a set of authenticated SWIFT instructions were sent to the U.S. Federal Reserve Bank asking for a $1 billion transfer. More than $101 million was moved before anyone noticed a problem; so far, just $20 million has been recovered.
In response to these attacks, the company is asking financial institutions to report any issues with SWIFT-based cybercrime. The transaction service maintained that its own network is secure and put the onus on banks to beef up their defenses so attackers can’t grab SWIFT access.
This isn’t just a polite request; SWIFT pointed out that sharing fraud data is part of its service contract and isn’t optional for its users. If investigations bear fruit, the company said it will share relevant data so all registered members can benefit from the results.
The Cyberfraud Blame Game
SWIFT’s position on security is clear: According to a statement on the company’s official website, a SWIFT user is “responsible for the security of its own systems interfacing with the SWIFT network and their related environment — starting with basic password protection practices — in much the same way as they are responsible for their other internal security considerations.”
But not all financial institutions agree they’re the problem. One official at Bangladesh Bank claimed that SWIFT technicians introduced several weaknesses into the system during installation, which granted easy access to anyone with a password.
As noted by CSO Online, others find SWIFT’s security documentation and recommendations lacking, thanks in part to a focus on threats prevalent 10 years ago rather than those that are relevant today.
SWIFT is in the cyberfraud line of fire. In many respects the company is taking the right track: The more data shared by users, the better picture they paint of common attack vectors. Haranguing banks about their cybersecurity efforts, however, may not be the best tactic. Financial infighting is exactly what malware-makers need to fast-track exploitation efforts.