An Indian bank that did not have a valid firewall license, had not employed phishing protection, lacked an intrusion detection system and eschewed use of any intrusion prevention system has, shockingly, been compromised by criminals who made off with millions of rupees.

The unfortunate institution is called the Andra Pradesh Mahesh Co-Operative Urban Bank. Its 45 branches and just under $400 million of deposits make it one of India's smaller banks.

It certainly thinks small about security – at least according to Hyderabad City Police, which last week [1]detailed an attack on the Bank that started with over 200 phishing emails being sent across three days in November 2021. At least one of those mails succeeded in fooling staff, resulting in the installation of a Remote Access Trojan (RAT).

[2]

Another technology the bank had chosen not to adopt was virtual LANs, so once the RAT went to work the attackers gained entry to the Bank's systems and were able to roam widely – even in its core banking application.

[3]

[4]

Hyderabad Police's analysis of the attack found that Mahesh Bank had carelessly allowed its population of super-users to reach ten – some with identical passwords. The attackers compromised some of those accounts and gained access to databases containing customer information including account balances.

The attackers also created new bank accounts and moved customers' funds into those accounts. Over $1 million of such stolen funds were shifted to hundreds of other accounts at Mahesh Bank and other financial institutions.

[5]

To complete the heist, the attackers made withdrawals at 938 ATMs across India and made off with the cash.

[6]Pakistan's tax office denies pirated software caused outage – admits it sometimes runs unsupported software

[7]Mailchimp: Crook stole cryptocurrency clients' mailing-list subscriber info

[8]Borat RAT: Multiple threat of ransomware, DDoS and spyware

Hyderabad City Police wrote they were able to spot the attack and freeze another ~$2 million of funds before they could be lifted.

The force's report of the incident is not kind to Mahesh Bank, noting that it had "no proper network infrastructure", took no precautions to isolate head office applications from its branches, lacked many basic security tools, did not train its staff for the eminently foreseeable eventuality of a phishing attack, and did not have a valid license for its firewall at the time of the attacks.

The latter is not uncommon because enterprise software is often priced to western standards, and users in less prosperous nations who find the cost prohibitive roll the dice on unsupported and/or out of date code.

"Investigation so far revealed the hackers, and the main kingpins are located outside India, most likely in UK and Nigeria," Hyderabad City Police has stated. "The amount withdrawn is transferred to Nigeria, most likely through Hawala or crypto currencies."

[9]

Hyderabad Police has detailed the attack in the video below – most of which is not in English, but does feature diagrams in that language. ®

[10]Youtube Video

Get our [11]Tech Resources



[1] https://www.facebook.com/hyderabadpolice/posts/1971771309662264

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YkwTU2wqIG1OtZsyIUDIRgAAAM8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkwTU2wqIG1OtZsyIUDIRgAAAM8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkwTU2wqIG1OtZsyIUDIRgAAAM8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YkwTU2wqIG1OtZsyIUDIRgAAAM8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2021/08/26/pakistan_federal_board_of_revenue_software_licensing_snafus/

[7] https://www.theregister.com/2022/04/05/mailchimp_confirms_breach/

[8] https://www.theregister.com/2022/04/04/borat-rat-ransomware-ddos/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YkwTU2wqIG1OtZsyIUDIRgAAAM8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[10] https://www.youtube.com/watch?v=AlO1y2tX-94&t=55s

[11] https://whitepapers.theregister.com/