Original URL: https://www.theregister.com/2009/03/19/sumitomo_cyberheist_investigation/
How police busted UK's biggest cybercrime case
Sumitomo unpicked
Posted in Security, 19th March 2009 11:02 GMT
Exclusive The story of the investigation into the failed multi-million pound cyberheist at Sumitomo Bank can finally be told, following the recent conviction and sentencing of its perpetrators.
The audacious Mission Impossible-style scam, which brought a pair of hackers and a bent insider together with other fraudsters, sought to spirit away £229m ($423m) from corporate accounts held at the London offices of the Japanese bank Sumitomo Mitsui in October 2004.
The conspiracy narrowly failed and no money was ever lost. Had it succeeded, the amount stolen would have dwarfed the £26m in gold bullion taken in the November 1983 Brinks Mat robbery and the £40m Securitas job in 2006.
Tech-savvy cybercrooks were smuggled into Sumitomo's offices in September 2004, where they used commercial keystroke-logging software - not spyware or specialist hardware, as initially and widely reported - to capture usernames and passwords needed to make Swift bank transfers.
Marc Kirby led the investigation
These stolen login credentials were used in an unsuccessful attempt to transfer money to ten overseas accounts under the control of fraudsters a month later.
Repeated attempts to transfer funds to accounts in Spain, Dubai, Hong Kong and Singapore failed because of errors in completing one of the fields in the Swift system used to make transfers. But for this failure, accounts held by firms including Toshiba International, Nomura Asset Management, Mitsui OSK Lines and Sumitomo Chemical would have been plundered.
The score
Returning to work after the weekend break, Sumitomo staff noticed that PCs had been tampered with. Executives reported the crime after receiving notice of the failed transfers, sparking a painstaking two-year police investigation.
The investigation was led by Marc Kirby, retired former detective inspector at the National Hi-Tech Crime Unit and later an officer at SOCA, who saw the investigation through from the first phone call from the bank and spoke exclusively to The Register.
"We quickly established something untoward had happened when we checked the CCTV footage and discovered tampering," Kirby told El Reg. "The sensitivity had been altered, turned down, so that the cameras didn't record what was happening on the trading floor."
Police quickly recognised the heist as an inside job, seizing building entry records and CCTV footage from street cameras. Security supervisor Kevin O'Donoghue, 34, became a key suspect once it was realised that computers were tampered with over the weekend.
O'Donoghue repeatedly smuggled two men - later identified as the hackers involved in the plot - into Sumitomo's London office. When challenged by other workers, O'Donoghue claimed the pair were there only for a card game.
Sneakers
Another strand of the investigation focused on the accounts established by the fraudsters. "We established where the money would have gone and took it from there," Kirby explained. "Because the bank accounts were outside UK jurisdiction we had to go through diplomatic channels. I'm still waiting for some requests."
Meanwhile, computer forensics examination established that commercial key-logging software had been loaded onto compromised machines. "It was a standard key-logger available on the net from a reputable firm of the type parents use to keep an eye on their children," Kirby said. "The use of legitimate technology meant the software was not picked up by anti-virus scanners. And there was no traffic going into or out of the network so it couldn't be detected that way."
The software used in the scam, iOpus Starr, is normally used for remote surveillance of networked PCs.
The crooks obtained two sets of Swift login credentials, one for an ordinary user and one for a supervisor account, needed to authorise transactions, from two machines. They had also tested the software on another machine. The compromised PCs were then formatted in a failed, rather crude attempt to destroy evidence.
Computer forensics evidence obtained from these machines, CCTV footage from the bank and elsewhere, telephone call records, building access logs and travel records became the principal planks of the investigation. Analysis of the laptops of suspects also played an important role. Since the heist failed, there was never a money trail to follow.
Traces of guilt
The investigation involved a team that varied from seven to 14 officers, at time of peak demand, and stretched over two years.
Following interviews with bank staff, O'Donoghue was arrested and charged. He claimed he was coerced into driving the two hacking suspects to the bank and letting them in.
"O'Donoghue was arrested within the first few days of the operation. His involvement was clear from the CCTV footage which showed him escorting [the hackers] into the bank," Kirby explained. "We took about two more years to identify Mr P and Mr Van O [the hackers]," he added.
Much effort was spent in the painstaking task of examining CCTV footage. From this the two hacking suspects were identified, initially known to the police only as Laptop and Ponytail. O'Donoghue's mobile phone records were seized. He'd changed his phone during the course of the investigation but this failed to throw police off the scent.
Phone call and location records allowed police to identify the two hackers as Belgian Jan van Osselaer, 32, and Frenchman Gilles Poelvoorde, 35. Poelvoorde (Ponytail) was arrested with a USB stick that had the same digital fingerprint as the key-logging program used in the Sumitomo scam, along with instructions on how to carry out the same hack on another bank outside the UK.
Phone records involving van Osselaer and Poelvoorde, in turn, led to the identification of other members of the conspiracy. Other lines of inquiry turned out to be dead ends.
Sand dunes and cyberfraud
Accomplices to the scam turned up at a bank in Abu Dhabi with screenshots of the attempted transaction and demands to receive their money. The copy of the transaction was sent from a fax from a shop in Cheltenham. Shop staff created a video fit of the customer who sent the fax. Kirby considered appearing on Crimewatch to make an appeal requesting information on the suspect, but rejected the idea over concerns it might cause the gang he already had in his sights to destroy evidence and go to ground.
The Abu Dhabi accomplices for the gang have never been identified. Kirby explained that the assistance he had from overseas forces varied enormously. He singled out French and Belgian police for particular praise for expediting his requests. Without this help it would have been impossible to identify Osselaer and Poelvoorde, neither of whom was known to British police.
"There were no prints or DNA on record," Kirby told El Reg. Nothing was overlooked in the investigation - Kirby's team even went through Sumitomo's wastepaper baskets for the weekend before the botched transfers in a failed attempt to find fingerprint evidence.
Other strands of the investigation allowed police to identify Hugh Rodley, 61, of Tewkesbury, Gloucestershire, and Soho sex shop owner David Nash, 47, of Durrington, West Sussex, as suspects in setting up an international network of bank accounts used in the scam. Phone records of the two hacking suspects were key to this along with subsequent police surveillance.
"Overlapping pieces of evidence was a feature of the case. There was lots of traditional evidence alongside the electronic and travel records," Kirby explained. "When questioned, nobody admitted anything, but the evidence was strong enough for the hackers to confess and to secure other convictions."
Case closed
The investigation led to guilty pleas by O'Donoghue and the two hackers, and a trial against the other fraudsters implicated in the scam that led to two guilty verdicts last week.
Van Osselaer and Poelvoorde were jailed for three and a half years and four years respectively, while O'Donoghue was ordered to serve four years and four months behind bars. Rodley, found guilty of conspiracy to defraud and conspiracy to transfer criminal property, was sent away for eight years.
Nash was jailed for three years after a jury found him guilty of conspiring to transfer criminal property. Rodley's alleged business partner Bernard Davies, 74, killed himself just before the trial was due to begin. Swedish national was accused of fraud but cleared on all charges.
The successful conclusion to the case has allowed Kirby to reflect on its outcome and what lessons might be learnt.
"The bank was very helpful. Their assistance saved months of work. They had the social responsibility to report the case in the first place, knowing it would generate adverse publicity," Kirby explained. "Bank staff were subjected to sometimes robust questioning.
"I was very proud of the team that worked for me. They never lost sight of the ultimate goal, never wavered in their enthusiasm and were selfless in pursuit of the crooks. They should be proud."
The case ought to serve as a wake-up call to banks, according to Kirby, who said it illustrated the need to place security under constant review and to "minimise exposure to third parties" as well as the dangers posed by key-logging software. ®