Operation High Roller
Alejo Maciel II
March 25, 2015

Introduction
Operation High Roller (OHR) was a brazen cyber-attack discovered in January, and made public in July of 2012 by computer security firms McAfee and Guardian Analytics. OHR targeted high balance accounts of both individual consumer and business financial institutions, using a new extensive level of automation built on previously known Trojans Zeus and SpyEye. Although no person or group has ever been identified for the conspiracy and execution of the operation, the attackers were traced to servers performing these attacks in Russia, Albania, and China.
According to the McAfee/Guardian Analytics report “Dissecting Operation High Roller,” the firms first identified the group’s initial attack in Italy. Analyzing the attack and identifying the new tactics the group used to successfully target the Italian Bank, the firms found strong evidence of a replication attack against a German bank. It wasn’t until subsequent evidence of attack campaigns within Latin American and the United States were found that the global nature of these attacks was validated (Marcus & Sherstobitoff, 2012). Over an undisclosed time period an approximate amount of $78 million, with a potentially maxed attempt of $2 billion, was successfully siphoned during OHR (Quain, 2012).
Analysis
The group responsible for these attacks built their tactics on previously existing malware, custom malware, and an in-depth awareness of global banking transaction procedures. Their impact on information security set new precedencies in the use of automation during an attack; essentially removing any known manual transaction required from previously observed and documented uses of Zeus and SpyEye malware. Additionally, this attack has forced banking institutions to realize their vulnerabilities and begin assessing how mobile transactions will likely now be targeted as consumers migrate to user friendly mobile applications.
Zeus and SpyEye Evolve
Zeus and SpyEye are both part of the family of Trojan malware that primarily use the cracking technique of “man-in-the-browser” to steal sensitive banking information. The uniqueness of these Trojans when first released was their ability to bypass security mechanisms used by financial institutions such as SSL/PKI and the Two-Factor Physical Authentication protocols (Nahorney & Falliere, 2014). These Trojans where capable of capturing data used by banks to authenticate clients and facilitate strategies that attackers would execute to commit fraudulent transactions without the bank or client aware their money had been stolen until it was too late.
The evolution of the malware used during OHR evolved in parallel to the target. Prior to 2012, financial institutions believed using the Two-Factor Authentication methodology was sufficient to protect the integrity of financial exchanges; the strongest believed to be using a digital token created by two physical devices: a smartcard and smartcard reader. The malware discovered during OHR, was the first to bypass this security combination. Using an authentic simulation of when a token is created, the attackers were able to capture this token during a victims log in attempt and use the token during the transfer authorization process.
During McAfee/Guardian Analytics dissection of OHR, the companies identified 426 variants of Zeus and SpyEye malware used. A distinct difference found between the original versions of Zeus and SpyEye, and the malware used during OHR, was the amount of automation discovered in the code. Prior to OHR, Zeus and SpyEye still required a degree of manual components and active participation by the attacker; such as identifying a mule account the hacker uses to transfer the money to. During OHR, the strains of Trojans used, automated this traditionally manual step by searching for active mule accounts from a separate database. The automation in the code used was so extensive, depending on the client; the malware would perform the fraudulent transfers either from the client’s side during attacks against an individual, or from the attacker’s server if targeting a business. If targeting a business, all of the fraudulent activities were performed from the attacker’s server located at a “bullet proof” ISP and moved frequently to avoid blacklisting and reputation-centric software used by banks.
A Banking Industry Rocked
The news headlines around the world nearly all read “Bank hack: 'Operation High Roller' has netted $78M – so far” (Messmer, 2012). The global fraud ring became notorious following the release of the McAfee/Guardian Analytics report. The list of victims ranged from individual to business, European to Latin America and American, and to all manners of banking institutions: credit unions, regional banks, and large global banks. The most impacted victims were two banks in the Netherlands whose total sum of all transaction initiated to mules were over 35million euros (Messmer, 2012). The total sum of all compromised bank accounts during OHR was over 2billion dollars.
The report detailed the obvious for cybersecurity professionals; the security protocols financial institutions used were severely compromised. The confidentiality of the victims account information was compromised by phishing scams aimed at targeting individuals and businesses with accounts holding large sums of money. The integrity of financial exchanges was circumvented by gaining access to the information needed to successfully initiate fraudulent transfers; namely information to satisfy the Two-Factor Authentication requirements. The availability of the services provided by the bank was interrupted as the malware would purposefully stall the user from accessing their services and executing transfers during this interruption. Data would later be manipulated by altering banking statements to limiting functions to peripherals to prevent detection of any fraud.
What’s next? In a McAfee follow up report conducted by the security company, it predicted “Financial institutions, regulators, and security researchers should expect the likely next target to be Automated Clearing House payment channels. The fraudsters will build on the methods, malware, and infrastructure employed in Operation High Roller, laced with new ideas and locations to be discovered” (Sherstobitoff, 2012). Since OHR occurred, both the Zeus and SpyEye malware used for the foundation of the attacks have been publicly released. Zeus was believed to be leaked by its creator, an anonymous hacker now known to be Evgeniy Mikhailovich Bogachev, and SpyEye was released by a French security team known as RED Crew. The public release of these Trojans has already generated a new wave of malware that continues to build off of its foundation and attack new technologies used by financial institutions. Some of the new malware strains (e.g. Zitmo), now are capable of installing mobile malware on your smartphone, which enables criminals to steal one-time security codes, widely used by financial institutions for online transaction authentication.
Summary and Conclusions
In conclusion, OHR was a clear reminder, to both financial institutions and cybersecurity professionals that well-resourced fraud detection departments don’t necessarily equate to a guarantee of safety. OHR successfully attacked some of the world’s most respected financial institutions. In essence, they developed a virtual map to success based on automation, obfuscation, and creativity. However, looking towards the future, models used in industry cooperation against fraud have shown promise and progress. Examples include the work conducted by the originators of the report used for the basis of this paper, McAfee and Guardian Analytics. Through education and experience we can continue to develop our layers of security that can eventually become proactive in preventing the success of future attacks.

References
Marcus, D., & Sherstobitoff, R. (2012). Dissecting Operation High Roller. Santa Clara: McAfee, Inc. Retrieved from http://www.guardiananalytics.com/researchandresources/researchstudies_resources/Dissecting_Operation_High_Roller_Research_Report.pdf
Messmer, E. (2012, June 26). Bank hack: 'Operation High Roller' has netted $78M - so far. Retrieved from Network World: http://www.networkworld.com/article/2189619/malware-cybercrime/bank-hack---operationhigh-roller--has-netted--78m---so-far.html;
Nahorney, B., & Falliere, N. (2014, October 15). Trojan.Zbot. Retrieved from Symantec: http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99
Quain, J. R. (2012, June 26). Cyber bank robbers attempt billion-dollar heist, targeting your money. Retrieved from Fox News: http://www.foxnews.com/tech/2012/06/26/cyber-bank-robbers-attempt-billion-dollar-heist-targeting-your-money/
Sherstobitoff, R. (2012, October 23). Operation High Roller Revisited. Retrieved from McAfee Labs: https://blogs.mcafee.com/mcafee-labs/operation-high-roller-revisited