This essay will seek to elaborate on the methods employed by a criminal organisation to

steal somewhere in the region of $45 million from two geographically separate banking

institutions. [1] Where once criminal entities would have had to rely on brute force, violence

and intimidation, this new form of robbery never so much as required a loaded pistol; all

was accomplished though the strokes of a keyboard.

Fearless thugs were replaced by highly accomplished computer hackers whose knowledge

and expertise allowed for the infiltration to occur without alerting the authorities. Once the

hackers had secured root access to the targeted systems, valid debit card numbers were

stolen and distributed to a global network of criminal accomplices. Using these seemingly

legitimate cards the thieves went to work targeting ATMs to withdraw cash on an enormous

scale.

What is truly remarkable about this “heist” was how relatively simple and straight forward

the methods employed by the hackers were. This attack has come to be known as an

“Unlimited Operation”.

How it happened

It is extremely difficulty to answer how the hackers managed to steal such an enormous

sum of cash with any degree of certainty. Given the very nature of how it was stolen,

to publicly reveal specifics on how the heist was accomplished could possibly leave the

institutions at the mercy of further attacks. However, the overwhelming online consensus

points to SQL Injection as the method most suitable for this form of cyber-attack. [2]

Structured Query Language (SQL) is a special-purpose programming language designed

for managing data held in a relational database management system (RDBMS). Databases

form the backbone of all financial institutions as they are responsible for recording all

customer information, transactions and records. [3]

casual observer that given the incredibly sensitive data entrusted to these institutions that

preserving the integrity of databases would be their foremost concern.

It would seem obvious to even the most

A SQL injection attack involves the alteration of SQL statements that are used within a

web application through the use of attacker-supplied data. Insufficient input validation

and improper construction of SQL statements in web applications can expose them to SQL

injection attacks. SQL injection is such a prevalent and potentially destructive attack that the

Open Web Application Security Project (OWASP) lists it as the number one threat to web

applications. [4]

This particular attack occurred over a number of months, targeting two banks (RAKBANK in

the UAE and Oman’s Bank of Muscat) [5]

(Enstage in India and ElectraCard in the US). Both attacks followed a similar pattern;

compromise the banks customer service web portal using SQL injection, steal valid debit

card numbers, remove withdrawal limits associated with the cards, circulate the valid

numbers to a worldwide criminal network, encode the valid debit card numbers to magnet

cards and begin to withdraw cash from ATM’s.

and their respective debit card processing partners

The first Unlimited Attack occurred on December 22, 2012 when the group compromised

RAKBANK before giving the go ahead for “cashers” to withdraw funds from 4,500 ATM’s in

approximately 20 countries. The concerned institutions suffered approximately $5 million

in losses but it appears that this attack was merely a test run for what was to follow two

months later.

On February 19, 2013 the group targeted the Bank of Muscat and ElectraCard. Over the

course of approximately 10 hours, casher cells in 24 countries executed approximately

6,000 transactions worldwide and withdrew about $40 million from ATMs. From 3 p.m. on

February 19 through 1:26 a.m. on February 20, the defendants and their co-conspirators

withdrew approximately $2.4 million in nearly 3,000 ATM withdrawals in the New York City

area. [6]

How the breach could have been prevented

Preventing injection requires keeping untrusted data separate from commands and queries.

1. The preferred option is to use a safe API which avoids the use of the interpreter

entirely or provides a parameterized interface. Be careful with APIs, such as stored

procedures that are parameterized, but can still introduce injection under the hood.

2. If a parameterized API is not available, you should carefully escape special characters

using the specific escape syntax for that interpreter. OWASP’s ESAPI provides many

of these escaping routines.

3. Positive or “white list” input validation is also recommended, but is not a complete

defence as many applications require special characters in their input. If special

characters are required, only approaches (1) and (2) above will make their use safe.

OWASP’s ESAPI has an extensible library of white list input validation routines. [7]

The ATM cybercrime could have been prevented also by using device intelligence to catch

rogue devices trying to access multiple accounts from unknown/unfamiliar locations.

Also, the incident could have been prevented by adding a ‘staging’ roles that catch any

strange activity, or at least report and log important activities such as increasing credit card

limits.

Further security measures would rely on the implementation of a layered architecture. For

example, compromising an outer layer would not result in a full system breach but would

slow the hacker down, automatically alert system admins to the intrusion and still preserve

system security. A common implementation of this approach is offered by Google through

their 2-Step Verification system. [8]

machine (ATM) typically requires two-step verification. To prove that users are who they

claim to be, the system requires two items: the ATM card (application of the possession

factor) and the personal identification number (PIN) (application of the knowledge factor).

In the case of a lost ATM card, the user's accounts are still safe; anyone who finds the card

cannot withdraw money as they do not know the PIN. The same is true if the attacker

has only knowledge of the PIN and does not have the card. This is what makes two-step

verification more secure: there are two layers of security.

Finally, payment card processors are typically expected to comply with the Payment Card

Industry Data Security Standard (PCI-DSS), a code of best practices created by the card

industry designed to prevent hackers from obtaining card details. [9]

The system operates as follows: an automated teller

Conclusion

At the most elementary level any corporate website that offers the user the ability to input

plain through a web form needs to be fully aware of the security concerns that are raised by

such a facility. Poorly configured webservers are rife with openly published vulnerabilities

that even the most inexperienced hacker can easily exploit. All companies that seek to

interact with their customers through the corporate website need to become more vigilant

as the form of attack detailed above has become the number one attack vector employed

by hackers. This is of particular concern for those businesses that are entrusted with large

amounts of sensitive consumer data and none more so than those in the financial sector.

References

1. http://news.softpedia.com/news/8-Members-of-Cybercrime-Ring-Charged-Accused- of-Stealing-45M-34M-from-Banks-352218.shtml 2. The Daily Beast, Michael Daly, The ATM Heist: How Did the ‘Casher’ Crew Do It?

(www.thedailybeast.com/articles/2013/05/11/the-atm-heist-how-did-the-casher- crew-do-it.html) Softpedia (2013) ‘Expert: Cybercriminals Likely Exploited SQL Injection to Pull

Off $45M / €34M Heist’, [online], available: http://news.softpedia.com/news/

Expert-Cybercriminals-Likely-Exploited-SQL-Injection-to-Pull-Off-45M-34M-Heist-

352865.shtml [Accessed 24 Feb 2014]

3. SQL reference https://en.wikipedia.org/wiki/SQL

4. Cisco definition: http://www.cisco.com/web/about/security/intelligence/

sql_injection.html

5. http://news.softpedia.com/news/Expert-Cybercriminals-Likely-Exploited-SQL-
Injection-to-Pull-Off-45M-34M-Heist-352865.shtml

6. http://www.justice.gov/usao/nye/pr/2013/2013may09.html

7. https://www.owasp.org/index.php/Top_10_2013-A1-Injection

8. With 2-step verification, you'll sign in to your Google Account with both your

password and a code that you'll get from your phone.

9. Jeremy Kirk (IDG News Service), PCWorld Magazine