Cybercriminals steal $45 million from ATMs: UPDATE 2

Another update posting on the recent cybercrime of $45 million stolen from 2 banks in the Middle East via pre-paid debt cards.

My first posting is HERE, the first update is HERE.

Another article I stumbled upon is HERE.

Per this article, the individual killed in the Dominican Republic (named in this one) is said to be the "mastermind" of the whole thing, not just of the US Cell.  Its claimed it was due to a dispute among rival gangs over the dispursement of the haul.  Still not sure if this means he's the overall mastermind, but does seem to indicate that he was killed by others within the overall scheme.

The article also reports that German authorities have arrested two Dutch nationals in connection with this crime.  It sounds like they were part of the large group hitting the ATM systems, so who knows were this will lead.

Again, as I see more will pass it allow.  You can help by adding comments about this matter.

Cybercriminals steal $45 million from ATMs: UPDATE 1

The matter of the $45 million stolen worldwide by a cybercriminal ring is something I plan to keep an eye on.   See my previous posting on it.

In a search of news items, most seem a repeat of what we've already seen.  A new article I saw in Forbes HERE does delve into how they got away with it.

Per the author, there are 4 things the thieves exploited:

1. Using pre-paid debit cards
2. Using cards with magnetic strips instead of chips
3. Breached oversees card processors
4. Large number of confederates utilizing cards worldwide

Each of these had their own issues.  The thing with using pre-paid debt cards is that unlike credit cards, there is no usage of buying habits to discover issues.  As I had both my main credit card numbers stolen recently, I know that it was by their unusual buying habits that this was caught.  (one card they started to use down in Brazil, the other was to make purchases across the state from me).

While some credit cards can have smart chips in them, they are sadly not universal in the US.  Magnetic cards are easily cloned, not an issue with smart cards.

The usage of oversees processors shows the weakness of their process.

And usage of all their confederates spread the risk to a large number.  There is the possibility that the use of them could be tracked back to the ringleaders.  This remains to be seen.

I still wonder why only cards issues by 2 banks in the Middle East were targeted.  There must be a reason.  And who killed the leader of the US gang in the Dominican Republic.  Hopefully as this case progresses, we'll learn more.

Cybercriminals steal $45 million from ATMs

I hope that most IT security people are taking a look at the recent cybercrime that broke in the last couple of weeks, of an organized group of criminals who stole $45 million from ATMs thru the use of pre-paid debit cards.  This happened in February of this year, and only came to light recently.

From the information so far, they did this by exploiting 2 weaknesses:

• Broke into bank computers and stole prepaid debt cards, erasing their withdrawal limits.
• Got the data into the hands of others who cloned the cards and hit numerous ATMs.

And apparently, doing this two things in coordination is what made this successful for this group.  Better oversight could have stopped the first.  And the use of smart chips instead of magnetic strips in cards could have dealt with the second, but this is rare in US credit/debit cards.

We are seeing the rise of such organized cybercrime.  And frankly, the numbers in just this case are staggering:  thieves were in 27 countries, and they made about 36,000 withdrawals over 10 hours to accumulate $45 million.  That works out to about a withdrawal of $1,111 every 10 seconds.

All the cards stolen were MasterCard prepaid debit cards, and only 2 banks were targeted.   In December, it was cards issues by the National Bank of Ras Al-Khaimah PSC (RAKBANK) in the United Arab Emirates.  Then in February it was cards issued by the Bank of Muscat in Oman.  I have to wonder if there was a reason those banks were the target.

What I haven't seen is the size of this overall group, which may not be known at this point.  A small group has been arrested in the US (apparently the "US cell"), and another individual who was apparently the leader of that cell was killed in the Dominican Republic (by who is not clear).   What about the overall ringleaders?  Maybe they killed the guy US ringleader to prevent any links back to them.  (yeah, I guess I read too many thrillers...)

Am sure we will get more info on this case as it moves along.  I wonder how procedures may be changed or improved in light of this.

Here are some of the articles on this matter:

Global Post on the heist.   Business Insider on how it was done.   NPR on it.
Dark Reading on the 8 caught in NY