Feeds

Automated bank scam 'Operation High Roller' stole from the rich

To give to unknown auto-mule crims in the cloud

Choosing a cloud hosting partner with confidence

Security researchers have uncovered a sophisticated, multi-tiered financial fraud ring that may have defrauded businesses, wealthy individuals and banks of tens of millions of dollars.

Operation High Roller bypasses multi-factor authentication technology employed by banks to attempt fraudulent transactions of &euro,60 million ($80m) worldwide since the scam began operating at the start of the year, according to security researchers from McAfee and Guardian Analytics that uncovered the fraud.

Analysts from the two firms reckon the fraudsters targeted at least 60 banks and financial institutions of varying sizes. The figures of attempted financial fraud are based on the analysis of only a few European-based servers linked to the scam and the true figure of attempted fraudulent transactions is likely to be much higher that the $80m base estimate cited by McAfee.

Banking fraud using Zeus and SpyEye malware to compromise online bank accounts, tied in with local money-mules to compromised accounts, is all too commonplace.

Operation High Roller added a number of innovations to this basic scam including techniques to bypasses physical “chip and pin” authentication, automated mule account databases, server-based fraudulent transactions, and attempted transfers to mule business accounts as high as €100,000 ($130,000).

Initial reconnaissance and infection of victims in Operation High Roller was normally carried out using a customised version of the SpyEye banking Trojan toolkit. Less ubiquitous variants of the ZeuS cybercrime toolkit were deployed. Operation High Roller targeted at least a dozen banking groups that use active and passive automated transfer systems.

"Where transactions required physical authentication in the form of a smartcard reader (common in Europe), the system was able to capture and process the necessary extra information, representing the first known case of fraud being able to bypass this form of two-factor authentication," the researchers note.

The scam targeted high balance accounts held by either businesses or well-heeled individuals.

Compromised accounts were systematically siphoned using automated transactions. Instead of using traditional man-in-the-browser attacks on the victim’s PC, instructions to compromised PCs came from cloud-based servers maintained by the as yet unidentified crooks behind the scam. Instead of using multi-purpose botnet servers, the cybercrooks behind High Roller relied on purpose-built and dedicated servers to process fraudulent transactions.

These innovations allowed the fraudsters to achieve a "high level of automation that captures one-time passwords, checks account balance, initiates transactions, and checks a mule database to find an active mule account, all without fraudsters' active participation," Guardian analytics explains.

The fraud involved a relatively small number of attacks on high-balance accounts. Fraudsters have been at pains to carry out the fraud as surreptitiously as possible. After the transaction, the malware will erase confirmation emails, prevent printing of statements, and change transaction values to match what the victim expects to see.

The banking fraud scam ring principally targeted victims in Europe, but it also hit victims in further flung locations including Colombia and the US.

A report, Dissecting Operation High Roller, explaining the elaborate scam in greater depth, can be found here (PDF). ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.