Mumbaikars beware! Your bank details are being stolen and sold!

If you thought your Personal Identification Numbers PIN passwords and other financial data are privy only to you and are impenetrable you are mistaken Stashed in the distant servers of banks and other organisations whose services you regularly use this data is now easily harvested and misused by cyber criminals The fragile digital security cover in some of the leading banks Business Process Outsourcing firms BPOs and telecom service providers is resulting in increasing incidents of data breachRepresentational pictureWorse most of these institutions are ignoring weaknesses in the protocol levels in their applications websites and payment gateways mainly used to transport data leaving customers to transact in a highrisk environmentmidday investigation Heres how Mumbais private hospitals are getting rich on blood moneyldquoA decade ago it would have been unthinkable for cyber attackers to steal data from servers and systems without incurring any physical cost Now every data bank mdash in healthcare banking and automobile etc mdash is vulnerable So far in India only the government and the big corporations have been a target and individual users were insulated from these cyber attacks This is changing fastrdquo said Aseem Jakhar a security researcher from Pune and the founder of NULL Indiarsquos largest open security community for hackers researchers and security professions ldquoA single bit the basic unit of information in computing of individual data can now be easily sold to criminals and then every infected PC used in creating a chain of bots a network used in spreading banking and financial Trojansrdquo Jakhar told middayRepresentational pictureSecurity protocol levels are called ldquocryptographic protocolsrdquo in Internet parlance One may see this while using say an online payment gateway of a bank which claims to have encrypted the gateway with an ldquoSSL v30 protocolrdquo This is the Secure Socket Layers SSL v30 protocol a cryptographic protocol designed to provide secure communications over a computer network Banks and ecommerce sites use SSL to create a secure environment for online transactionsmidday investigation Hooch being made inside Sanjay Gandhi National ParkThe latest report of the Payment Card Industry Security Standards Council PCI SSC was published on February 13 2015 The Council has designed a security standard called Payment Card Industry Data Security Standard PCI DSS for organisations that offer credit and debit cards to customers This report has identified the SSL v30 protocol as ldquono longer being acceptable for protection of data due to inherent weaknesses within the protocolrdquo Due to these weaknesses no versions of SSL in banks currently meet PCI SSCs definition of ldquostrong cryptographyrdquo and stands exposedRecently when a senior security executive raised the issue of the SSL expiry with his bankrsquos management he was asked to not cause trouble ldquoWhen I raised this serious issue in the bank I was bullied into submission and haunted by management The general culture in our bank is to brush data security breach and loopholes under the carpetrdquo said a senior executive of a leading bank This infringement of businessbankingpersonal information is costing losses to the tune of thousands of crores but largely goes unreported for the fear of loss of reputation on part of the bank or company According to a January 2014 Delhi High Court report data and intellectual property IP theft in the year 2013 was estimated to be worth Rs 23000 crore in India aloneOn February 24 2015 the Europol the police force of the European Union with the assistance from Microsoft busted a cyber crime group in Rome that was learnt to be spreading the infamous Ramnit malware which affects the Windows operating system across globe The cops revealed that during its five years in operation Ramnit evolved into a major criminal enterprise infecting more than 32 million computers and harvesting banking credentials passwords cookies and personal files from victims Microsoft claims that 27 per cent of these 32 million PCs targeted ie around 86 lakh computers were in IndialdquoClearly India is emerging as the leading destination for these highly sophisticated and targeted malware attacks from across the world We donrsquot know for sure which PCs are being targeted nor can we ascertain the sectors targeted with surety But the attack was carried out continuously from September 2014 to February 2015 While we donrsquot have data to prove it it is a general consensus from people tracking the malware authors that these malware campaigns originated from Chinardquo Gabor Szappanos the principal researcher of Sophos Blog a leading malware threat research firm based out of Europe and Hungry told middayThis paperrsquos investigation exposes how computer systems in private and publicsector organisations routinely face an onslaught of malicious programs aimed at stealing data such as a trojan A trojan is a program containing malicious code when executed it carries out actions determined by the attacker operating through a distant server typically causing theft of data and possible system harmIn other cases greedy bank employees were lured into smuggling out sensitive data for anywhere between Rs 2000 and Rs 5000 per bit of data With the database running into millions of bits the sum is certainly lucrativeOur investigation highlights cases where security systems in banks telecom firms and government departments were breached with impunity either using malicious trojans or encrypted codesSome of these unreported cases include the hacking of the Mahanagar Telephone Nigam Limited MTNL website using a malicious virus intending to steal data theft of customer passwords and PINs at the State Bank of India SBI Mumbai and an attempt by attackers in Turkey to steal data from a leading cooperative bank in the city These attacks took place between 2013 and 2014 and almost none were reported to the policeLeading city online 164mn Internet user base in Mumbai the largest of all Indian citiesBank cheated of Rs 75 lakh Case study 1Organisation A leading cooperative bank in MumbaiAttack origin Turkey Effect Fraudulent transactions worth Rs 75 lakh Several banks in Mumbai and elsewhere in India were targeted last year by an Advanced Persistent Threat APT malware campaign Zeus a trojan that stole confidential information from the compromised computers of the banks This APT is a targeted network attack that is a collection of variety of sophisticated malwareGraphic Amit BandreOn September 13 2013 the makerchecker controls of a state cooperative bank were taken over using a Zbot malware a Trojan horse computer worm to not only steal data but also make fraudulent transactions worth Rs 75 lakh private investigators tracking this case confirmed to middayMakerchecker control is a twostep procedure in the bankrsquos internal process so as to not cede complete control to a single employee Every transaction has a lsquomakerrsquo employee who provides the input for the transaction and a lsquocheckerrsquo employee who verifies the data and authorises the transactionSo it was expected that one individual could not perpetrate the fraud entirely on his own and would need a maker partner in crime ldquoThese transactions were made once the computers and servers were taken over in the bankrsquos Mumbai head office The Zbot was later found originating from Turkeyrdquo said a private investigator who had worked on the caseAlmost stolenCase study 2Organisation ICICI BankAttack origin Internal employeeEffect AvertedIn 2013 an employee attempted to steal banking data of nearly 50000 customers by collecting and storing it after purging a file and later compressing it on the notepad application Purging involves lsquosanitisingrsquo memory units by permanently deleting dataThe executive was suspended and served a black memo for data purging reducing his chances of landing another banking job sources said ldquoThe data was compressed in a Purge file and masked as an outgoing email containing quotations from famous literary authors but he was caught just in time to prevent a major embarrassmentrdquo said a senior executive who is working in the security division of the bankSBI lost your dataCase study3Organisation State Bank of IndiaAttack origin Unknown Effect Mobilephone banking PINs other data stolenAt the head office of the State Bank of India Mumbai the entire database was stolen last year including mobile and phone banking PINs of customers when its server was found to be infected by a remote code injection using an OGNL ObjectGraph Navigation Language injection on the bankrsquos web application written in Struts2 an opensource framework of the Java programming language The Struts2 framework is vulnerable to OGNL which when injected leads to arbitrary Java method execution on the target serverldquoThis is akin to altering variables in two substances to cause a chemical reaction leading to the transformation of one set of chemical substances to another The bank had to ask all its customers to change their PINs immediately But as a responsible institution they didnrsquot report the breach publiclyrdquo a digital forensic investigator the firs to carry out a mandatory vulnerability assessment and penetration testing on the compromised servers saidThe theft at SBIrsquos Mumbai head office which forced the bank to issue an advisory asking customers to immediately update their information and banking passwords and PIN last year was never traced The data was lost forever and even though the customers had updated their passwords the incident is a reminder of the vulnerability of data in these organisations ldquoThe SBI data was lost forever it was possibly sold to criminal elementsrdquo said the investigatorsMalad BPOs lose client dataCase study 4Organisation Two BPOs in MaladAttack origin UnknownEffect Data lostThe Mumbai cyber police midday has learnt are separately probing at least two cases where offshore data of international clients was stolen from BPOs in Malad last year and later sold to unknown websites for 10 to 20 per bit of data ldquoMost of these BPOs store vital data of their clients based in the West The attackers know security systems in India have not yet evolved to protect a wellscripted attack We are still probing these two cases and yet to arrive at a conclusion on how and why this was donerdquo said Nandakishore More assistant commissioner of police Cyber Cell Mumbai PoliceMTNL cluelessCase study 5Organisation MTNLAttack origin PalestineEffect System taken overOn January 13 2015 when Joint Commissioner of Police Crime Sadanand Date apprised Chief Minister Devendra Fadnavis of the major cyber attacks in Maharashtra he missed a crucial point The top cop had in his presentation described the cyber attack on the website of MTNL on the eve of Independence Day two years ago as the handiwork of the Pakistan Hacking Army The reality in the case is much different and the information presented to the CM is at best rudimentary middayrsquos investigation has found that the attacker hacked the website with a Remotely Administrated Trojan RAT written in a Perl script Perl is a highlevel scripting language supporting the UNIX operating system which is a computer operating system like Windows and MacOSThe script was used to hold an executable code that delivered specific functional commands of the attackers via a command and control CnC server ldquoThis particular RAT came with a server and client file and attached itself to an empty port in MTNLrsquos systems making the server file lsquolistenrsquo to incoming connections and data going through the ports When someone ran the client file it gave out the IP address and the trojan starting receiving commands from the attacker and running them on MTNL computersrdquo a digital forensic investigator who performed a mandatory vulnerability assessment and penetration testing on the compromised MTNL servers told midday from Japan In simple language when an MTNL employee clicked on the file that may have arrived as say an innocuous email the trojan downloads itself onto the system and enters MTNLrsquos internal command centre allowing the attacker to take control of the user databaseldquoWe found it originated from Palestine and operating a backend script attempting to steal the sitersquos password and user datardquo the investigator added The investigation team working on behalf of a leading security firm found the malware was clearly directed to do an internal scan of the system and throw the configuration back to the CampC located somewhere in the territory of PalestineldquoBut before our team could do further testing on the PCs they were seized by the Mumbai Policersquos Cyber Cell and have been gathering dust in their custody ever sincerdquo this private investigator who works in the field of application security reverse engineering and malware analysis recalledThe handling of the MTNL case by the cyber police was poor in that ldquothey didnrsquot bother to preserve web and browser logs and cleaned up the website even before the private investigators arrived on the scene for a lookrdquo he added What the police did was the cyber equivalent of throwing a bucket full of soap water on the scene of murder erasing any fingerprints the killer might have left behindAttacks during MHADA lotteryCase study 6Organisation MHADAAttack origin ChinaEffect None attack spottedBelieve it or not the Maharashtra Housing and Area Development Authority MHADArsquoS annual lottery for its affordable homes this year came under attack from a remote trojan delivered from China Even as the lottery process is currently underway last week the bodyrsquos Security Information and Event Management SIEM system detected and mitigated cyber attacks especially trojans and malware delivered with the intention of stealing sensitive data The system spotted a single executable exe file hidden in a malware caught relaying messages back to an Internet service provider ISP in China The attacks continue to take place with great intensity every year during MHADArsquos lottery private investigators told middayDefence lab nearly breachedCase study 7Organisation Defence Research and Development Organisation DRDOAttack origin VietnamEffect DetectedWhen Punebased antivirus vendor Quick Healrsquos threat research team pointed out a targeted malware attack on September 13 2014 mdash a cyber espionage attempt originating from Vietnam on the Defence Metallurgical Research Laboratory DMRL attached to the Defence Research and Development Organisation DRDO mdash the company almost lost its contract with the defence body The Sinon malware a collection of complex malware pieces was an infected email sent to a select few people within DMRL When one of them opened the attachment the malware infiltrated the system and the attackers took remote control of the workstations and started exploring the system for sensitive dataThe malicious code was triggered by a specially crafted word document or RTF file for the MS Office version 2003 It later dropped a huge 28 MB avgdll file in the system to confuse debugging systemsldquoThe trojanised RTF files in Sinon exploited the CVE20120158 a vulnerability in the Windows common control We immediately notified the Indian Computer Emergency Response Team ICERT and DRDO one of our oldest clients to have used our secure system services But it only seem to make them angrierrdquo Rajesh Nikam manager threat research and response team Quick Heal said ldquoNobody is taking the threat of cyber espionage seriously in the government Even if they donrsquot trust commercial vendors like us they can get it validated from their own experts before junking our antivirus vendors claims of the attackrdquo he saidInfected with fearEven when the attacks are reported to the police it is sometimes difficult to ascertain if the breach is genuine or mere indulgence or even scaremongering In the world of Internet security fear spreads faster than a virus and the story of Kailash Katkar the CEO of antivirus firm QuickHeal Technologies Pune borders on the narrative in which Internet attacks are predicted to cause catastrophes but end up causing much less damage From doing odd repair jobs at a calculator shop in Punersquos congested Mangalwar Peth area he now owns a Rs 500crore companyKailash Katkar CEO of antivirus company Quick Heal says the dangers of the Internet are real and present Katkar entered the Internet security market in the early rsquo90s when India had just liberalised its economy His constant companions from the age of nine when he dropped out of school and started working have been Facit adding machines desktop electric calculators and ledger posting units ldquoIn those days a virus travelled from a floppy disc to a computer paralysing the system The creators of viruses did not intend to steal data and use it for financial gains They were happy to cause nuisance by simply damaging data but that has changed drastically now The dangers on the Internet are real and presentrdquo he told middayIn the case of Bangalorebased programmer Yash K S who had developed his own version of the Zeus malware to create awareness about an alleged glaring hole in the payment gateways of three leading banks including HSBC ICICI and Citibank the breach snowballed into an FIR getting registered at a Bangalore police stationIn 2013 Yash K S had released three videos on the videosharing website vimeocom showing the vulnerability in online banking that can allow a malicious attacker to use attacks like lsquoMan in the Middlersquo or lsquoMan in the Browserrsquo to steal money from bank accounts These are types of security attacks where the perpetrator installs a trojan horse on a victimrsquos computer that is capable of modifying the userrsquos Web transactions as they occur in real time The banks sent a legal notice alleging Yash was trying to ldquoforcesellrdquo them a security product while he registered an FIR against the bank for sending goons to his house ldquoThe Zeus trojan alone cost 1 billion in bank losses in the west While this trojan is still alive in the west I took a basic version of it and modified for Indian banks in 2011rdquo he said when this reporter caught up with him in PuneYash K S demonstrated through his modified Zeus malware a glitch in ICICI Bankrsquos online banking While the user thought she is transferring money to the intended payee circled the money goes to Yashrsquos accountIn one transaction Yash shows how the user logs in to ICICIrsquos online banking portal with the help of the One Time Password OTP and performs an online transaction The user was unaware that a virus was running in the background and despite the dual authentication the virus was able to manipulate the transaction in realtime without the userrsquos knowledge and redirects the fund to the attackerrsquos accountldquoIn this case the user was coordinating with the malware without his own knowledge and the bank server fails to identify what was really happening in the backend Once the transfer of money was complete the user saw the transaction online He still saw the same fake information since the malware also knows to modify transaction statementsrdquo Yash told middayEven though Yashrsquos claims remained locked in dispute with the banks most believe it is the responsibility of the bank to provide a safe mechanism because an insecure web facility cannot be a userrsquos responsibilityldquoWhen banks cannot give security for specific types of attacks they need to give insurance if they cannot solve the problem They cannot make the customer liable since there is no way anyone can expect a customer to know about such threats But most banks have now set incidence response mechanisms to ensure that as soon as a fraud happens the liability is somehow fixed on the customerrdquo said Sahir Hidayatullah partner Securus First a firm dealing in digital forensic and corporate investigations in Mumbai1132 Number of cyber crime cases registered by the Mumbai police from 2010 to 2014Banks upping security but government is still asleepThe banks claim to have set up alternative data centres at an lsquooffsitersquo location which they stated can be used in case of a system crash or intense cyber attacks Three executives of HSBC HDFC and ICICI banks confirmed their banks have either put in place or are in the process of setting up an offsite backup server plantThe state forgot to deface ereceipts worth Rs 14504 crore leading to risk of misuse ldquoThis offsite server can store as much as 12 years of data and recover it in quick time if the main system goes down in case of a hack or attack Our internal security operations remain stringent so much so that every document that goes and comes in the bank is password protected and sends out an alarm every time a mail is send out of the bank While there are data leakages we are doing everything possible to avoid themrdquo said a senior HDFC Bank executiveAnother executive from HSBC Bank said security controls are divided into many levels to avoid a breach ldquoSo even when an employee tries taking out any data a highvolume activity is spotted in the layered systemrdquo he said HDFC has even begun deducting salaries of its executives should they fall for mock cyber attacks launched as part of their internal awareness campaigns ldquoWe send a mock phishing email enticing employees to click on a gift voucher containing a trojan A dayrsquos salary is deducted as punishment if the employee falls for itrdquo said the senior executiveYet the banks are not reporting the cases to the police because of fear of losing reputation ldquoThe Indian banking system works purely on trust and the banks fear if the customer finds out about these system breach there would be a massive loss of reputation It is the responsibility of the companies and the banks to report a breach but that never happensrdquo said Venkatesh Murthy project coordinator Data Security Council of India DSCI Bangalore which has set up eight cyber labs across the country in coordination with the National Association of Software and Services Companies NASSCOM a trade association of Indian software companies and BPOs These labs including those in Mumbai and Thane seek to assist cops in cracking complicated cyber crime casesThere are a total of 1132 cases that have been registered by the Mumbai policersquos Cyber Cell in the past five years and the state Adjudicating Officer AO is probing another 124 highly sensitive cases under Sections 43 44 and 45 of the Information Technology IT Act dealing mostly in crimes related to ldquoillegal money transferrdquo in banks or ldquotheft of source coderdquo in software companies at best The AO the IT secretary of the state is empowered to provide only civil remedies to cyber crime cases State lags behindThe issue of data theft seems to have completely missed the Maharashtra governmentrsquos radar as corporates rely more on private audit and security consultancy firms rather than the archaic cyber forensic and investigation standards in state labs In his investigation report while probing a case related to illegal contravention of ldquostealingrdquo and ldquoalteringrdquo computer source code by a firm in Nashik Rajesh Aggarwal former state adjudicating officer bemoaned the poor quality of cyber forensic and investigation standards hampering his investigations in MaharashtraldquoIt is unfortunate that the state Police and Forensic lab have not given any meaningful report in this case The allegations must be tried under other relevant laws rather than the IT Act 2000rdquo he wrote in the report while investigating the case between Ms Bullet Link Technologies and TechCruiser of NashikThe Maharashtra government does not even have a data security policy and is doing a shoddy job of protecting critical information and dataIn 2008 the state came up with a virtual treasury an online receipt system called Government Receipt Accounting System GRAS hosted in the data centre of Tata Telecommunication Ltd TCL But while it was made mandatory for the concerned departments to electronically lsquodefacersquo ereceipts generated on providing services to the payee the latest audit of the GRASrsquo database revealed that state departments forgot to deface receipts worth a shocking R14504 crore over the past five years of GRASrsquo accounting life Defacing of ereceipts involves introducing a digital watermark see pic above to prevent their misuseA report of the Comptroller and Auditor General CAG released on April 10 said ldquoThis nondefacement of challans led to risk of availing of services on unauthentic ereceipts weak monitoring of services and loss of government revenuerdquo CAG said that of the 369 senior officers who were allowed access to the system nearly 300 did not change their originally assigned passwords 43 did not change their passwords for more than 100 days ldquoThese users were not even aware of the information security risks present in the systemrdquo it saidThe industry has not come far from the days of Indiarsquos first indigenous virus lsquoHappy Birthday Joshirsquo which struck Indian PCs back in the rsquo90s ldquoMy days went in formatting machines and reloading the operating system after killing the virus in thousands of PCs Even now this government and private organisations are not taking cyber threats trojans ATP attacks seriouslyrdquo said Katkar CEO Quick Heal TechnologiesAll of this clearly shows that the cyber security framework in leading public and private institutions has not evolved while the city continues to pay a high cost of doing business and suffers as organisations do a shoddy job of protecting personal information of their unsuspecting customers It is only a matter of time before a major attack on a bank or any other institution unleashes chaos and causes huge financial lossesMajor cyber crime cases in INDIAgtgt Punjab National Bank was cheated to tune of Rs 139 crore through false debits and credits in computerised accountsgtgtRs 25 lakh misappropriated from Bank of Baroda through falsification of bank accountsgtgtThe Hyderabad police arrested an unemployed computer operator in a fivestar hotel for misusing credit card numbersgtgtA software professional in Bangalore was arrested for stealing source code of a product and using it to launch a new productgtgtIn 2001 over 200 Indian websites were hacked and defaced The hackers put up words like bugz death symbol Pakiking etcgtgtA website 123medicinindiacom was hacked and a message left behind lsquocatch me if uuu can my deraz lazy adminzzzrsquogtgtIn 2000 lsquohacktivistsrsquo propagating the lsquoright to pornographyrsquo attacked the website of Punersquos Asian School of Cyber Law with a Distributed Denial of Service DDOS attack The school had spearheaded an international campaign against porn on InternetgtgtPune Traffic Police website hacked in 2012gtgtHacking of a government website wwwjanwaniorg on the development of Pune city in 2013 In MumbaigtgtIn July 2001 Mumbai Policersquos website wwwmumbaipoliceorg was hacked using an FTP password cracking software name Brutus The two attackers Mahesh Mhatre and Anand Khare replaced the home page with porn The duo was arrested in 2002This is the first of a twopart series of middayrsquos investigations into malicious cyber attacks in IndiaHungryfor data 155GBsec Data transaction traffic in Mumbai the highest in the country