Attacks on bank systems using SWIFT are only evolving, although officials at the global bank transfer system say their security processes have toughened, according to a Reuters report.
In a previously undisclosed Nov. 2 letter (seen by Reuters) that SWIFT sent to its member banks, the firm claimed that attacks on its systems have only become more sophisticated in their strategies since cyberthieves in February siphoned out $81 million from an account of the Bangladesh Bank held at the Federal Reserve Bank of New York.
The letter pressed upon the banks that attacks on their systems were increasing. "The threat is very persistent, adaptive and sophisticated – and it is here to stay," SWIFT wrote.
Attacks targeting central and commercial banks using the SWIFT network continue, even as regulators around the globe – in the wake of the cyber heist against the Bangladesh Bank account – instituted toughened bank security measures and the FBI, Bangladesh authorities and Interpol pressed their investigations. Around a fifth of them are hitting paydirt for the attackers, Stephen Gilderdale, head of SWIFT's Customer Security Programme, told Reuters last week.
Hackers have evolved their game in the strategies they use to access local bank systems, the letter stated. In particular, hackers are gaining entry to networks by exploiting technical support software. Once attackers gain access, the letter said, they communicate with victims sending phony payment instructions via the SWIFT network.
A number of attacks have been detected at member banks when anti-virus software identified malware, Gilderdale said. However, he added that regardless of new attacks, SWIFT believed the system was becoming more secure. "In 80 percent of the cases that we are aware of and where we have completed investigations, a fraud has not actually ended up taking place," he said.
In its letter, SWIFT emphasized that all detected attacks exploited SWIFT interfaces used by its customers and that its own central communications network had not been impacted.
"I personally am very pleased with the progress that we are making," Gilderdale said.
Arrests in the cyberheist of the Bangladesh Bank are expected soon, the head of the Forensic Training Institute of the Bangladesh police's criminal investigation department, told Reuters.
“Let's wake up America and think about why it is time to take your small business data seriously!,” Erik Knight, a 20-year veteran of the cybersecurity industry, told SC Media on Wednesday. "The average business is unaware and unprepared that it's being hit with more than 10 thousand attempted intrusions a day, and the number of these attacks are growing."
When a data breach does occur, it can take months to discover it, Knight said. "The days of small businesses not taking data breaches seriously are over. If a small business has an ‘it can't happen to me approach,' I guarantee they are a target for a cyber threat."
And, Knight agreed that in addition to an increase in the volume of hacking, the scams are becoming much more sophisticated, and the landscape is changing regarding culpability. "Organizations and governments are starting to hold businesses responsible for protecting customer privacy."
