Feeds

Automated bank scam 'Operation High Roller' stole from the rich

To give to unknown auto-mule crims in the cloud

Securing Web Applications Made Simple and Scalable

Security researchers have uncovered a sophisticated, multi-tiered financial fraud ring that may have defrauded businesses, wealthy individuals and banks of tens of millions of dollars.

Operation High Roller bypasses multi-factor authentication technology employed by banks to attempt fraudulent transactions of &euro,60 million ($80m) worldwide since the scam began operating at the start of the year, according to security researchers from McAfee and Guardian Analytics that uncovered the fraud.

Analysts from the two firms reckon the fraudsters targeted at least 60 banks and financial institutions of varying sizes. The figures of attempted financial fraud are based on the analysis of only a few European-based servers linked to the scam and the true figure of attempted fraudulent transactions is likely to be much higher that the $80m base estimate cited by McAfee.

Banking fraud using Zeus and SpyEye malware to compromise online bank accounts, tied in with local money-mules to compromised accounts, is all too commonplace.

Operation High Roller added a number of innovations to this basic scam including techniques to bypasses physical “chip and pin” authentication, automated mule account databases, server-based fraudulent transactions, and attempted transfers to mule business accounts as high as €100,000 ($130,000).

Initial reconnaissance and infection of victims in Operation High Roller was normally carried out using a customised version of the SpyEye banking Trojan toolkit. Less ubiquitous variants of the ZeuS cybercrime toolkit were deployed. Operation High Roller targeted at least a dozen banking groups that use active and passive automated transfer systems.

"Where transactions required physical authentication in the form of a smartcard reader (common in Europe), the system was able to capture and process the necessary extra information, representing the first known case of fraud being able to bypass this form of two-factor authentication," the researchers note.

The scam targeted high balance accounts held by either businesses or well-heeled individuals.

Compromised accounts were systematically siphoned using automated transactions. Instead of using traditional man-in-the-browser attacks on the victim’s PC, instructions to compromised PCs came from cloud-based servers maintained by the as yet unidentified crooks behind the scam. Instead of using multi-purpose botnet servers, the cybercrooks behind High Roller relied on purpose-built and dedicated servers to process fraudulent transactions.

These innovations allowed the fraudsters to achieve a "high level of automation that captures one-time passwords, checks account balance, initiates transactions, and checks a mule database to find an active mule account, all without fraudsters' active participation," Guardian analytics explains.

The fraud involved a relatively small number of attacks on high-balance accounts. Fraudsters have been at pains to carry out the fraud as surreptitiously as possible. After the transaction, the malware will erase confirmation emails, prevent printing of statements, and change transaction values to match what the victim expects to see.

The banking fraud scam ring principally targeted victims in Europe, but it also hit victims in further flung locations including Colombia and the US.

A report, Dissecting Operation High Roller, explaining the elaborate scam in greater depth, can be found here (PDF). ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.