News and Music Discovery
Play Live Radio
Next Up:
0:00
0:00
0:00 0:00
Available On Air Stations

Global Banks Warned To Review Security Systems After Major Cyberattack

ROBERT SIEGEL, HOST:

There's new evidence today that cyber thieves who recently stole $81 million from the Central Bank of Bangladesh may be connected to the Sony Pictures attack in 2014. It was also revealed today that the global banking organization SWIFT, whose system was used in the Bangladesh heist, had its network used again in an attack on a second bank. NPR's John Ydstie reports.

JOHN YDSTIE, BYLINE: This SWIFT network is used to send payment instructions between 11,000 banks around the world. In the Bangladesh attack, hackers used the system to move $81 million from the Bangladesh Bank's account at the New York Fed to an account in the Philippines. The cyber security unit at BAE Systems in Britain is investigating that attack. It says the computer code in that theft has many similarities with code used in the massive data breach at Sony Pictures in 2014. The U.S. blamed North Korea for that attack. SWIFT said today another bank has been attacked using its system, but it didn't give the bank's name or location. Bill Nelson, CEO of FS-ISAC, which focuses on the security of the global financial services industry, says the use of the SWIFT system is what makes these recent hacks unique and troubling.

BILL NELSON: This is somebody that knew how SWIFT worked. They're familiar with the confirmation acknowledgment system. They were able to manipulate that so you weren't even aware it was happening.

YDSTIE: Some analysts have speculated that the thieves may have enlisted bank employees to provide the credentials needed to access the SWIFT system. Nelson thinks it's far more likely that a bank employee clicked on a link in a phishing email that allowed the thieves to download malware into the bank's computer system. Then, they monitored activity and learned the passwords and authenticators needed to access SWIFT. Nelson says the simple defense is to have a computer for payments that's not connected to the web. He says most U.S. banks do that, but security at many banks in less-developed countries is inadequate. John Ydstie, NPR News, Washington. Transcript provided by NPR, Copyright NPR.

John Ydstie has covered the economy, Wall Street, and the Federal Reserve at NPR for nearly three decades. Over the years, NPR has also employed Ydstie's reporting skills to cover major stories like the aftermath of Sept. 11, Hurricane Katrina, the Jack Abramoff lobbying scandal, and the implementation of the Affordable Care Act. He was a lead reporter in NPR's coverage of the global financial crisis and the Great Recession, as well as the network's coverage of President Trump's economic policies. Ydstie has also been a guest host on the NPR news programs Morning Edition, All Things Considered, and Weekend Edition. Ydstie stepped back from full-time reporting in late 2018, but plans to continue to contribute to NPR through part-time assignments and work on special projects.