ROBERT SIEGEL, HOST:
There's new evidence today that cyber thieves who recently stole $81 million from the Central Bank of Bangladesh may be connected to the Sony Pictures attack in 2014. It was also revealed today that the global banking organization SWIFT, whose system was used in the Bangladesh heist, had its network used again in an attack on a second bank. NPR's John Ydstie reports.
JOHN YDSTIE, BYLINE: This SWIFT network is used to send payment instructions between 11,000 banks around the world. In the Bangladesh attack, hackers used the system to move $81 million from the Bangladesh Bank's account at the New York Fed to an account in the Philippines. The cyber security unit at BAE Systems in Britain is investigating that attack. It says the computer code in that theft has many similarities with code used in the massive data breach at Sony Pictures in 2014. The U.S. blamed North Korea for that attack. SWIFT said today another bank has been attacked using its system, but it didn't give the bank's name or location. Bill Nelson, CEO of FS-ISAC, which focuses on the security of the global financial services industry, says the use of the SWIFT system is what makes these recent hacks unique and troubling.
BILL NELSON: This is somebody that knew how SWIFT worked. They're familiar with the confirmation acknowledgment system. They were able to manipulate that so you weren't even aware it was happening.
YDSTIE: Some analysts have speculated that the thieves may have enlisted bank employees to provide the credentials needed to access the SWIFT system. Nelson thinks it's far more likely that a bank employee clicked on a link in a phishing email that allowed the thieves to download malware into the bank's computer system. Then, they monitored activity and learned the passwords and authenticators needed to access SWIFT. Nelson says the simple defense is to have a computer for payments that's not connected to the web. He says most U.S. banks do that, but security at many banks in less-developed countries is inadequate. John Ydstie, NPR News, Washington. Transcript provided by NPR, Copyright NPR.
