How police busted UK's biggest cybercrime case
Sumitomo unpicked
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Exclusive The story of the investigation into the failed multi-million pound cyberheist at Sumitomo Bank can finally be told, following the recent conviction and sentencing of its perpetrators.
The audacious Mission Impossible-style scam, which brought a pair of hackers and a bent insider together with other fraudsters, sought to spirit away £229m ($423m) from corporate accounts held at the London offices of the Japanese bank Sumitomo Mitsui in October 2004.
The conspiracy narrowly failed and no money was ever lost. Had it succeeded, the amount stolen would have dwarfed the £26m in gold bullion taken in the November 1983 Brinks Mat robbery and the £40m Securitas job in 2006.
Tech-savvy cybercrooks were smuggled into Sumitomo's offices in September 2004, where they used commercial keystroke-logging software - not spyware or specialist hardware, as initially and widely reported - to capture usernames and passwords needed to make Swift bank transfers.
Marc Kirby led the investigation
These stolen login credentials were used in an unsuccessful attempt to transfer money to ten overseas accounts under the control of fraudsters a month later.
Repeated attempts to transfer funds to accounts in Spain, Dubai, Hong Kong and Singapore failed because of errors in completing one of the fields in the Swift system used to make transfers. But for this failure, accounts held by firms including Toshiba International, Nomura Asset Management, Mitsui OSK Lines and Sumitomo Chemical would have been plundered.
The score
Returning to work after the weekend break, Sumitomo staff noticed that PCs had been tampered with. Executives reported the crime after receiving notice of the failed transfers, sparking a painstaking two-year police investigation.
The investigation was led by Marc Kirby, retired former detective inspector at the National Hi-Tech Crime Unit and later an officer at SOCA, who saw the investigation through from the first phone call from the bank and spoke exclusively to The Register.
"We quickly established something untoward had happened when we checked the CCTV footage and discovered tampering," Kirby told El Reg. "The sensitivity had been altered, turned down, so that the cameras didn't record what was happening on the trading floor."
Police quickly recognised the heist as an inside job, seizing building entry records and CCTV footage from street cameras. Security supervisor Kevin O'Donoghue, 34, became a key suspect once it was realised that computers were tampered with over the weekend.
O'Donoghue repeatedly smuggled two men - later identified as the hackers involved in the plot - into Sumitomo's London office. When challenged by other workers, O'Donoghue claimed the pair were there only for a card game.
Next page: Sneakers
COMMENTS
WTF is a "digital fingerprint"
Sure "digital fingerprint" sounds convincing, but El Reg is a technical publication. Since it seems unlikely that the PCs did a MD5 hash of every inserted USB stick, did they mean nothing more than the "make, model and serial number" of the USB stick?
@The Fuzzy Wotnot
"to rake out cash in a similar method to the Richard Pryor character in Superman 3."
I have't' thought of that in years. Robert Vaugh saying how dare the Columbians disrupt a free market, after he'd cornered it.
It's called a salami fraud. SWIFT, IIRC is was restricted to transfers quite a lot above that.. When I last looked at the system it was about £15k minimum, but I imagine it's gone up
Salamini frauds are (AFAIK) only really possible with compuererised accounting systems. You might use a SWIFT transfer to get the money out of the company once it had accumulated in a holding account, but not to remove less than pennies per transaction.
Mine will be the one with the half eaten sandwich of dry processed meat products in.
not detecting legitimate technology
"Returning to work after the weekend break, Sumitomo staff noticed that PCs had been tampered with"
"The use of legitimate technology meant the software was not picked up by anti-virus scanners. And there was no traffic going into or out of the network so it couldn't be detected that way"
This doesn't make technological sense. The ability to install any software meant the so called anti-virus scanners failed. As is demonstrated in the Cornflicker infestation. And if the bank is relying on 'anti-virus scanners' to protect the network it begs the question as to the quality of security at the bank.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
