Downloaded from YTS.MX
Official YIFY movies site: YTS.MX
It's Friday,
and it is, of course, the Muslim prayer day.
Everyone's off, except for the skeleton staff
at the Bangladeshi Bank,
including Zubair Bin Huda, who is the duty manager.
He's part of the elite team of employees
who run the SWIFT banking system,
which is a highly secure banking system
that sends money around the world.
Now, Bin Huda goes, as he does every day,
to the SWIFT printer
to check up on the transactions from the day before.
There are usually printouts
of transactions that came in overnight.
The SWIFT software would print out a ledger every single day,
an audit trace of every single transaction that occurred
on paper.
But when they came in on February 5th morning,
as they usually do,
they found there were no SWIFT messages at all.
In fact, the printer's shut down. It won't work.
They try and turn it on.
Nothing will kick it back into life.
He assumes it was simply a technical error,
shrugs, goes home for the night,
comes back in on Saturday morning
to check the system again.
The next day,
they somehow manually get the printer to work.
This deputy head manager walks in the room,
the printer starts working, and these weird messages come out.
The printer starts spewing out
all of these transactions,
including individual requests to the Fed in New York
for $1 billion.
At that moment, it's panic stations.
When I was growing up, the biggest crime in Britain
ever recorded was the Great Train Robbery.
It was an extraordinary thing. They stole about £2.5 million.
That's about $4 million.
And that story ran literally for 30 years.
Four million dollars.
What you're about to hear
is the story of an attempt to steal...
a billion dollars
It's told by world-leading
cybersecurity and legal experts and journalists:
the very people who uncovered the facts
and threaded them together
to reveal how dangerous the world of cybercrime is today.
So, there are four big threats
to the world and to the human race.
One of them we've just experienced,
that's the pandemic.
Then you've got weapons of mass destruction.
You've got climate change.
But barrelling down towards us before those is cyber.
This is the possibility
of our overdependency on network technologies
being undermined, either by malfunctioning of the system...
New problems are emerging
the day after an Amazon web service outage.
Massive and mysterious, a global outage...
...or by a targeted attack.
More than a thousand companies
have been crippled by this attack so far.
Sounds like we're looking at a 2022 with more hacks,
more lost money.
So, when I started hunting hackers in the early 1990s...
our enemy was really simple.
All the malware, all the viruses,
all the attacks were done by teenage boys.
What will your parents think?
I've been doing this job for two decades now.
When we first started,
the people writing viruses and malware
were doing it for fun,
to get their name in lights, to say, "Look what I can do."
No flash, please.
When I started analysing viruses, they looked like this.
Malware was still spread on floppy disks.
They were spreading at the speed of people travelling the world
and carrying the viruses with them.
Michelangelo has proven less harmful than feared.
All the stuff you've got in there you may really want,
it's just gone?
Then the internet came around, and suddenly,
malware outbreaks could go around the world in seconds.
For the last 36 hours,
the ILOVEYOU virus has been creating havoc around the world.
Experts have reason to worry. The first attack, July 19th,
infected about 300,000 systems in nine hours.
First of all, the guys who make a living doing security
and are trying to protect themselves
are scared shitless of you, because you can just ruin 'em.
After the period of time
where hackers were just doing things for fun,
some of them realised that they could use it to make money.
Prior to, like, the 2000s...
cyber was primarily around a disruption of websites...
defacement of a webpage.
Just as we got around 2000, the dot-com boom, the explosion,
we started into what would become
financially motivated hackers.
This really flourished, especially in Eastern European,
Russia, CIS bloc countries.
This was the time of gangster capitalism,
when everyone's world in Eastern Europe was falling apart,
where organised crime and...
former members of the intelligence services
were taking hold of the economy.
So you had a lot of young people in the 1990s
who were very good mathematicians, physicists,
computer scientists,
who simply took the logic and the morality
of gangster capitalism online.
Virus writers were writing viruses
to infect Windows computers,
and those computers were then sold to email spammers,
who were using those machines to send Viagra spam
or what have you, basically making money.
And that changed everything.
People at that time began to use online banking,
and they began to steal people's online banking credentials,
from there, also get credit card numbers,
and use that to basically transfer funds.
Just in hundreds of dollars at a time from these individuals.
They eventually realised that going after individuals
was much more difficult
than just going after the banks themselves.
Get into databases,
those databases held credit card numbers.
Take those numbers and then sell them on the black market.
Originally, the internet was set up at the Pentagon...
just to be able to share resources between computers.
And it was really never designed to have
banking attached to it,
critical infrastructure attached to it.
It was really designed for availability.
It was never designed for security.
Whereas in the early 1990s
when there was only 30,000 people connected to it
and several hundred systems, we've moved to a system
which essentially is the backbone of global finance.
The fact that it's able to do that...
the fact that it's able to sustain currently between
15 and 20 percent of GDP globally
tells us something about just how important
this infrastructure is.
Why did people move into the internet
to seek economic opportunity?
Because that's where the economic opportunity was,
untethered by norms,
untethered by national boundaries,
and essentially limited only by the creativity
that these individuals had.
The user nagged the Federal Reserve Bank
with 35 payment instructions worth $951 million.
We'd just never heard of such a thing before.
We'd been investigating cybercrime
for a couple of decades at that point.
You see cyber criminals go in,
and they try to transfer a few hundred thousands of dollars,
maybe a million, a couple of million.
But conducting a cyber-attack to try to steal one billion?
That was an order of magnitude that we had never seen before.
It was clear from early on
that it was one of the biggest cyber heists in the world.
When we first started hearing rumours
about something affecting SWIFT network,
I didn't understand how big it was.
But when we started realising
this is at a completely different scale,
it just blew my mind.
Once they realised
that the money actually was really gone,
then the panic began to set in.
They lost $81 million instantly to a bank in the Philippines.
They see the $81 million has already gone
and that nearly $900 million extra has been requested.
They basically try to figure out what to do next.
They have no idea what to do.
They hunted for ways to contact the New York Fed.
Desperate calls are made by them.
And it goes to an answering machine.
You've reached the Federal Reserve Bank...
Because it's Saturday in New York,
and nobody's picking up the phone.
- Please call back... - It's a complete shitshow.
Total disorganisation, at both ends, I would stress.
The New York Times Magazine was planning a true-crime issue,
and my editor came to me
and asked I was interested in doing it.
I looked into it a bit.
There definitely were some intriguing elements,
and made me pay attention.
The Federal Reserve has pretty much
depended on the SWIFT banking system,
and since there has rarely been a hack, if ever,
of the SWIFT banking system...
the Federal Reserve has never instituted
any sort of 24-7 hotline.
Eventually, they get hold of somebody at SWIFT,
and SWIFT says,
"Just shut the whole lot down
until we know what's going on here."
Badrul Khan decides before he can actually make that decision,
he has to talk to the deputy governor of the bank,
which he does.
Deputy governor doesn't want to take the decision upon himself,
so he talks to the governor. And guess what.
The governor says, "It's probably a mistake.
We won't shut it down."
Work week begins at the Bangladesh Bank
on Sunday morning,
and it's then that the general manager of the bank
comes in and begins to take stock of what had happened.
They're running out of options.
They're not sure what to do. Fed is still closed in New York.
They go through all the SWIFT material,
discover that most of the money has gone
to the bank in Manila.
And these desperate messages are sent out:
"Stop the transactions.
Hold that money. Do not allow it to be withdrawn.
It's our money. It's been stolen."
But there's a problem.
Five, four,
three, two, one!
Happy New Year!
It's Chinese New Year,
and the Rizal Commercial Bank is closed.
The thieves chose a sequence of days...
from Friday, Saturday, Sunday and Monday,
when one or another of the three countries
that would be communicating with one another
was shut down for a holiday.
You've got to hand it to these guys.
They knew it.
They knew that if they did it over that weekend,
with the Friday, the Muslim holiday,
the Sunday and the Saturday, everything closed in New York,
and the Monday, Chinese New Year.
They've got four days to get the heist done.
This is really classy planning.
In that respect, it was really an ingenious plan.
It's kind of like a great film director in a malevolent way,
planning out, you know, a very complex film.
The country of Bangladesh
is the 170th poorest country in the world.
One billion dollars is huge to them.
When we talk about cyber-attacks,
they're not just zeros and ones.
We're not just talking about people
moving around zeros and ones, deleting zeros and ones.
One billion dollars to Bangladesh
potentially means that people starve in the country.
These things have potential serious repercussions.
The Bangladesh Bank heist was significant
because it showed how fragile global banking was as a whole.
Banks don't just operate as single isolated entities.
They're part of a system.
And that system is vulnerable.
The US Federal Reserve holds trillions of dollars in accounts
kept by central banks all around the world.
Its computer security systems are state of the art, making it
one of the most difficult financial institutions to hack.
The criminals realise that it can't get into
the network system of the Fed,
but the Fed has to talk to other central banks
around the world,
and this is where they find a flaw.
The criminals turn their attention
to the banks' communication systems.
Every day, the Fed places thousands of transactions
on behalf of the central banks that hold US dollar reserves
at the Fed.
The Federal Reserve has pretty much depended
on the SWIFT banking system
to get its instructions about transfers.
SWIFT sends money around the world
to thousands of member banks.
It's the main way that banks dispatch money to one another.
SWIFT allows you to transfer money
from one bank to another,
no matter where you are in the world.
Make international wire transfers.
The whole banking system is integrated,
and they depend above all else on SWIFT,
the international transaction mechanisms, to work.
What it means is, all it takes
is a single weak link to bring down the whole network.
So although the target is the Fed,
they are looking for a bank with which the Fed communicates,
which holds a lot of its reserves in New York.
But it's a long way away,
in a distant time zone from the Fed,
and it's likely to have
patchy security systems in place in its computer network.
My colleagues in Dhaka,
they were chasing it for a long time.
It was a robbery of a scale that we hadn't heard of.
The first thought that came to my mind was,
because it was the Bangladeshi Central Bank,
I thought the hackers found it
somehow easier to target it.
Because it was Bangladesh,
I suspected they would be more vulnerable
to cyber-attacks as such.
"Hmm. A Bangladeshi bank.
Probably doesn't have the same level of security
and if they do, it's probably one or two people,
not a team of 6,000 working on it.
Let's go for it."
These attackers weren't just skilled
in breaching networks,
figuring out how to get into an organisation.
They had to study that SWIFT software deeply.
This attack happened well before that February 5th,
when the bank employee walked in
and saw that printer hadn't printed out the audit jobs
and couldn't figure out what was going on.
This attack started more than a year prior to that.
These attackers had been working for months
in the build-up until that day.
It is a mistake for people to think
that this was something that happened overnight.
It is a mistake for people to think
that this happened in a month, or two months or three months.
It is a slow, methodical approach,
because it's a business, all right? You build it.
Bank robberies used to be something that happened
in the real world.
Now they only happen in the online world.
If you would try to steal $100 million in banknotes,
that would be, like, ten trucks full of notes.
If you drive ten trucks full of notes out of the bank,
someone would notice.
But when you do the same thing online, no one notices anything.
Every movie you've ever seen of them breaking into a bank
is them doing it over a bank holiday
or something of that nature.
Same concept here.
This isn't Matthew Broderick sitting in front of a computer,
like War Games back in the 1980s,
some kid in their basement.
These are criminal organisations.
Each person has a skill set.
It's kind of like that Ocean's Eleven-type thing.
You know, "This guy could crack the bank,
this guy could do the surveillance cameras,
this is the getaway, this is the conman."
You all have a role to play,
and you need everybody to execute their role
to the best of their abilities
for you to be successful and get it out.
So how do you pull off a heist of this magnitude?
It takes the right crew of highly skilled specialists.
And it all starts not with ones and zeros, but with people.
Cybercrime is about gaining credentials
to gain access,
stealing the keys.
The social engineer is critical to a hack.
It's how you get in, and you get in
not through digital means, you get in through human means.
It's to do with psychology.
The criminals have to ensnare one of the employees
of the Bangladeshi Bank,
beginning by going through their social media profiles
and looking for suitable targets.
Our relationship with the computer
is one of perceived intimacy;
that when we're using a computer,
no one else can see what we're doing, we believe,
and it's just us and the screen.
And if we were to read an email from a friend,
we tend to believe it at face value.
They found close to three dozen employees.
And they constructed a simple spear-phish email:
an email message that pretended to be from a guy
named Rasal Alam.
And Rasal Alam said,
"Hey, I just wanna work at your company.
Here's a résumé attached. Have a look."
And it turned out that they mailed that
to about 36 different employees, and three of them
opened that attachment connected to that email.
It was a zip file,
and the zip file contained just a document inside.
They opened up the document and it was his résumé.
It was a résumé for Rasel Ahlam, who wanted to work at the bank,
but unbeknownst to those individuals,
also contained malicious code inside.
We can look at any data breach,
and the root cause has either been
a technical problem
or a people problem.
And the technical problems can be really hard
and really expensive and really slow to fix,
but at least we can fix them.
But in the end, we have no patch for human brains.
There's no way to fix the people who do stupid mistakes.
When attackers try to send
these spear-phishing emails, they try to do two things.
They try to look very normal. It was just a résumé.
They try to fly under the radar,
to look as legitimate as possible.
And the second is they often try to use enticing techniques.
New dangers tonight from the Love Bug computer virus,
this time disguised as a friendlier email.
The first internet virus that went around the world
in less than 48 hours was called the ILOVEYOU virus.
And already, business interruption costs
are estimated at more than a billion dollars.
You would be sitting there working away,
and then suddenly, in your inbox,
you get an email which says, "I love you."
And it could well be that this is a person
who you've always held a torch for.
And so, of course, you're very excited,
and you press on the link, and then you're doomed.
What happens is, the virus infects your machine
and proceeds to email everyone you've ever emailed.
The end result of that is the mail servers
get bogged down,
and the only way to solve the problem
is to shut the servers down, hence the interruption.
The ILOVEYOU virus was one of the first viruses
that had really worldwide impact.
It was still a virus written by a guy
that just wanted to get his name in lights.
He wanted to see his virus
travel around the world a little bit
and maybe get in the news somewhere,
and then him be able to say, "Oh, I wrote that."
Mr de Guzman hardly seemed to comprehend the chaos
inflicted on the world's computers.
But what happened was, it spread so quickly and so fast,
it brought down email all over the world,
and having email go down was monumental.
Experts say that the ILOVEYOU virus could end up costing
the world economy $10 billion in lost work time.
It became the first sign to show that we relied on the internet.
The internet was the basis for our financial transactions,
for the way we do business.
I would talk to people
and remind them and educate them and say,
"Look, you can't just click
on any attachment that comes to you in an email."
I remember talking to a guy about the Anna Kournikova virus
that purported to be nude pictures of Anna Kournikova.
And he told me, he said, "Yeah, I knew it was a virus.
I thought it was probably a virus. But what if it wasn't?
What if it really was nude pictures?
So I double-clicked on it."
People just don't realise
what clicking on that attachment means.
Cyber criminals and hackers realised a long time ago
that your username and password,
particularly to your email account,
could get them into your stock brokerage account,
to your online banking account,
to send phishing emails to other contacts.
If you protect yourself properly,
the chances are you won't be a victim
of what one would call "drive-by hacking".
If, however, you're being specifically targeted
by a hacking group, they will follow that trace.
And they will get you.
Now, we know that at least three members of the Bangladeshi Bank
were targeted by this after the social engineer
had scanned all of their social media,
and at least three of them
opened the letter and took the bait.
Once that code began executing
on those bank employees' computers,
it would reach out back to the attackers
and tell them that these machines are now infected
and give them full control,
as if they were sitting in front of the keyboard,
just like those employees.
There was malware in the system
that was actually copying screenshots,
copying keystrokes of employees, and no one knew.
They've got their foot in the door.
This is the essential first step.
The first layer of security has been breached.
And the digger, the person who is getting deeper and deeper
into the computer network,
has to be a very advanced hacker.
This is when you need a real professional.
They're like ghosts. Nobody can see them,
but they're mapping every single bit of that network.
In the Bank of Bangladesh,
you had computers that are all interconnected to each other,
and they're connected using what's called a switch.
In your average bank, that has a good security program,
those switches are what's called segmented.
So each of those switches only allow
a certain number of computers to talk to each other
rather than every computer to talk to each other.
But in the case of the Bank of Bangladesh,
in the back-office network, they were using these very cheap,
literally $10 switches that didn't do any segmentation.
Every computer was potentially connected to each other.
Basically, it's a cost-cutting exercise.
But that cost-cutting exercise was what the digger needed.
Those attackers began to do
what we call a lateral traverse across the network,
search for other computers to infect,
look for credentials.
Whenever you log into a computer,
your credentials are cached.
They're put into the memory of the computer.
Attackers are able to filter through that memory
and find used usernames and passwords.
They don't always know what they're for,
so they try to collect as many credentials as they can
and see, "What computers can I see from this computer?",
and just begin to use them over and over again
and just try them.
Eventually, they hop on
and are able to connect to another computer.
They get onto that one.
It's still not what they're interested in,
but they're able to find more usernames and passwords
and try those on all the other computers
they can see from that advantage point.
That's how they move across the network over and over again.
They would delete all traces of themselves
as they moved across the network,
ultimately jumping from computer to computer
until they found the SWIFT terminal,
their ultimate goal in order to make wire transfers
out of the Bank of Bangladesh.
It takes a long time.
They're there for months. This is an ongoing process.
If at any moment they're discovered to be in there,
then the whole operation is finished.
With the Bangladeshi Bank heist,
you basically have two operations running in parallel.
You have an offline operation going on,
which is to do with the money laundering.
It's the fence's responsibility
to set up the recipient accounts.
They're gonna end up with cold, hard cash,
and they need individuals on the ground
to pick up that cash and move it.
And so, in May of 2015,
before they'd even got into the SWIFT terminal,
they were able to recruit a Chinese individual
to go to the Philippines and open up four bank accounts there
at a bank called RCBC.
You have to make sure those people inside the bank
in the Philippines
have been properly corrupted
and properly instructed as to what their role is.
The fence opens up these accounts,
puts $500 in each of them,
and then they just go to sleep for nine months.
These attackers were inside the Bank of Bangladesh
for a full year, which is incredible.
They actually got onto that SWIFT terminal
exactly one year later...
on January 29th, 2016.
In any bank, you have different employees.
You have back-office employees, administrative employees,
but you also have computers that are connected
directly to financial transactions.
And only users who have specific access to those machines
are allowed to use them.
When we talk about the case of the Bank of Bangladesh,
there was a single computer that had credentials
from a shared employee.
You had an employee that would use that SWIFT terminal,
but also had their own computer in the normal back-office area.
Once they got onto that employee's computer,
they were able to jump across.
They waited. They basically did a recon on the system.
They crawled around.
They looked and tried to fully understand how this worked,
how SWIFT worked, how each bank employee would make a request
into the SWIFT system, where it would go,
how to direct that to branches
where they had set up these accounts.
And in this case, it was just very simple and very clever.
The thief is not so much someone
who is physically taking out the money
and stuffing it into a bag.
They're making sure
that every bit on the system is coordinated.
There are all sorts of things to get right
before that fatal moment when the request is made.
Everything has to be
really, really precisely coordinated
to get all the timing right. You've got four days.
You can't afford a slip-up.
When the attackers got into the SWIFT terminal
on January 29th of 2016, they paused for about five days
to get their malicious software ready
that allowed them to cover their tracks
when they were on that SWIFT terminal.
They decided to wait until February 4th.
And this is no accident.
They have chosen a long weekend
due to holidays in different parts of the world.
That means, instead of the usual two days
they have to get away with it
before alarms start going off everywhere,
they've got four days. It's brilliant.
February 4th, 2016, was a Thursday.
That's the last day of the working week in Bangladesh.
In Bangladesh, they work from Sunday to Thursday.
So, at some point late in the afternoon,
the SWIFT transaction operator in the Bangladeshi Bank
logs off his terminal.
But three hours later,
the thief logs into that terminal
and starts to impersonate him.
They logged into that SWIFT terminal at 8:36 p.m.,
after they believed, or really knew,
that all the bank employees had gone home for the weekend.
And they put forward 35 different wire transactions
from that SWIFT terminal, totalling $951 million,
almost $1 billion, completely unheard of.
Ten hours behind Bangladesh,
New York is waking up.
The first thing that the Fed sees
is 35 requests
for almost the entire holdings of the Bangladeshi Bank.
Usually, it's figures of sort of $300,000, $500,000.
They want almost a billion!
The operator, perhaps unsurprisingly, rejects it,
sends it back to Bangladesh.
But he rejects it not because
this is an absolutely crazy amount of money,
but because the requests are wrongly formatted.
As much research that they had done,
they didn't really understand how to fill out
those SWIFT transfers.
They were missing what's called an intermediate bank.
New York Federal Reserve replied to them,
via the SWIFT system, back to their computer
that they were sitting in front of, virtually,
saying, "Hey, these transactions are missing information."
They think on their feet.
They reformat the requests, send them back...
and hold their breath to see what happens.
They ultimately corrected 34 of them.
They had forgotten one.
The one did have the intermediate bank
went to Deutsche Bank.
That order was for $20 million
to a charity called the Shalika Foundation in Sri Lanka.
But they had made a typo as well,
and they had misspelled "foundation" as "fandation".
And so Deutsche Bank saw that typo
and questioned it and, again,
held that transaction due to that typo.
We use that as the poster child
for why you need to learn how to spell.
Otherwise, you can lose $20 million.
Ultimately, when they return the other 34...
Bingo.
The operator approves them.
Four of them went through.
The green light is given. The heist is on.
Those four went through to those bank accounts
in the Philippines that had been opened
more than six months earlier.
And they were able to transfer out $81 million
to the bank in the Philippines.
Ultimately, they were about to transfer $1 billion
from the Bank of Bangladesh,
but they didn't want anyone to find out.
They began to cover their tracks.
Normally, as a bank employee,
you'll load up the SWIFT software,
you'll see on the screen all the latest transactions,
you can make transactions.
And so the attackers deleted all records of those transactions.
But it's not just digital.
In the world of finance, everything must be a hard copy.
And the attackers knew that as well.
Every SWIFT transaction that takes place
is immediately printed out locally in the Bangladeshi Bank.
So that printer cannot be working
when the heist is going on.
The attackers hijacked all of those print jobs,
replaced all of those print jobs with zeros
so that nothing would come out of the printer.
Now, the other 30 wire transactions sat around.
And, ultimately, the attackers waited,
and they waited...
And they logged out at 3:59 a.m. Bangladesh time.
Potentially, they thought that in New York,
the business day ended at five p.m.,
and they weren't gonna hear any more.
The New York Fed had actually stopped
the rest of the transactions,
because the address for the bank in the Philippines
was on Jupiter Street. J-U-P-I-T-E-R.
Right, now this is when the story gets really weird.
In a totally unrelated incident two years earlier,
we have a Greek shipping magnate, Dimitris Cambis,
and he is buying eight tankers.
What Dimitris knew, but not many other people,
was that the money for these eight oil tankers
came from Iran,
and Iran was under US sanctions.
Someone in the US caught wind of the fact
that the Iranians were financing Mr Cambis.
His company was put on the sanctions watch list,
and his company was called Jupiter Seaways.
It was just their bad luck
that they designated the money transfers
to go to the Jupiter branch of the Rizal Bank in Manila.
As the transfers were being sent out from the New York Reserve
to the Philippines,
the Jupiter name was caught by the computer system.
It halted these transactions.
The Fed had to take a second look.
They stopped it because they realised,
"Wait, we have somewhere in the order 35 transactions
coming from the Bank of Bangladesh,
adding up to $1 billion? You know, this isn't usual."
So they held them and sent a message back,
asking for confirmation.
Had the attackers waited just one more hour,
they could have replied to them via the SWIFT system,
saying these transactions were not a mistake.
Ultimately, the Bank of Bangladesh
might have lost much, much more.
So far, they managed to get $81 million.
But, boy, did they come close to hitting the jackpot.
Just under $1 billion
was very, very nearly stolen from this bank.
The next day, the bank employees came in,
and the printer wasn't working,
because they installed their malicious code
to prevent that from happening.
Ultimately, those bank employees
didn't get it fixed until February 6,
which would have been a Sunday.
When the printer started, all these messages came out,
messages from the Fed asking,
"What are these 30 transactions? Did you mean to make these?"
That triggered the Bank of Bangladesh
to realise something had gone wrong.
It was very clear that they were in deep,
such that the bank manager... This is the Bank of Bangladesh,
the federal bank, the national bank of the country,
did not notify the leaders,
the government of Bangladesh. He kept it under wraps.
He notified someone he knew who knew about security.
"Get on a plane, get to Bangladesh.
I need you to look at these computer systems."
Initially, the governor and his whole team
were quite perplexed.
They didn't quite know what had happened.
So they thought that some money had been routed
to a wrong account; it would come back.
I get this strange phone call from the governor's office
asking me if I would drop everything
and come to Dhaka, Bangladesh.
So I assembled a team...
and we flew down.
When we arrived there, we met with the Bangladesh Bank team.
And that's when I discovered all the horrifying details
of what had actually happened.
They decide, "Let's look at the CCTV.
What's that going to tell us?"
There were eight hours' worth of tapes
that had to be gone through.
Your gut instinct is, you have a malicious insider.
A physical person had to go in,
log into that machine and try to make these transfers,
because this attack hadn't happened before.
They had a SWIFT room, which was locked.
And typically when the SWIFT operators
needed to do something on SWIFT, they had to go into the room,
sit in that chair and terminal,
and there was only one shadow we could find.
We eventually decided it was the person
sweeping the place after hours.
They were saying, "How could somebody process the transaction
when there was nobody there?"
I mean, even after the payment instructions had been sent,
they had no idea for a very long time what was happening.
They didn't think it was a hack. They had no traces of a hack.
But they watched eight hours of that footage over that weekend
and realised there was no one at that computer.
Nothing.
They had no idea that the Bank of Bangladesh
had been breached by hackers.
Only after we see these things happen over and over again,
we realise that cyber has such capabilities.
Bangladesh was a bit of a bombshell for all of us.
Hackers and most cybercrime,
it's like smash-and-grab crime.
Quickly grab something and monetise it
as swiftly as you can.
You know, storm a bank with shotguns, blow a safe,
fill some bags with cash.
Cybercrime...
It doesn't lend itself well to long conspiracy
and lots of investigation and investment
into understanding your target.
I mean, you couldn't do Bangladesh
unless you really understood the internal workings
of the central bank and all the actors involved.
That's not something that freelance hackers
really are good at.
That requires a level of investment into resources
and frankly intelligence that has to be sustained.
To organise something of that complexity
and for it not to be noticed
by the intelligence agencies of the state
where that is being planned
would be very, very difficult indeed.
These hackers went in and looked at the zeros and ones
in the software and reverse engineered it,
turned it back into understandable code.
That's not something that happens overnight.
It was pretty clear
that this isn't just normal criminals.
This has to be something bigger.
Once attackers have gained access to their target network,
they want to stay undetected.
And we've seen many interesting examples
of how exactly this is done.
What exactly happened
at the Natanz nuclear facility last week?
It's a question people in Iran around the world
have been asking since a fire was reported
at Iran's main uranium enrichment facility on Thursday.
We're used to Trojans and viruses on the internet,
but this is the first worm
designed to damage the physical world.
In 2010, attackers created a piece of malicious software
that was designed to infiltrate Iran's nuclear programme,
to get into their centrifuges,
in particular, get onto computers
that controlled their centrifuges.
Iran says it will retaliate against any country
that conducts cyber-attacks on its nuclear sites.
The intention was to spin the centrifuges
of Iran's nuclear capabilities out of control,
make the centrifuges explode
and push them ten years back
in the uranium enrichment programme.
As a piece of malware,
it was 40 times larger than any piece of malware
that had ever been encountered before.
It would have taken the most advanced,
brilliant computer engineers
years and years of human working hours
to produce this.
Why was it so big?
Because it needed to cover itself up.
The attackers were actually recording
the network traffic, the normal network traffic,
and then playing it back to the sensors
when they started modifying the operations of the centrifuges
they were trying to break.
This is the equivalent of, in the real world,
recording the CCTV footage from a security camera
and then playing it back to the camera
when you're doing something bad.
That's what Stuxnet was doing.
And in the Bangladesh heist,
they were doing something similar.
Once they made their transactions,
they wanted to make sure no one realised they had happened.
They were actually falsifying the information
about transactions.
The recording of the transactions were being done
both in electronic format,
but also falsifying the data being sent to the printers,
which actually looked like everything was fine.
So you find out how you're being tracked,
and then you try to cover your tracks.
Stuxnet did that.
The Bangladeshi heist did it as well.
Once that money arrived in the Philippines,
they needed to change that money into cold, hard cash.
Right now, it's still in digital ones and zeros,
just a transaction that said the money has moved
from the Bank of Bangladesh
to these accounts at RCBC. Four accounts.
The thieves had to get it out of the Philippines,
make it disappear.
So how were they going to do that?
There is one industry in the Philippines
where there is absolutely no oversight,
where it's a cash-only business. There are no records, no names.
That is the casino industry.
When we talk about laundering funds,
we're talking about taking dirty, illicit funds,
running them through a legal business
so that if I came to you and said,
"Hey, where'd you get that $81 million?",
you could have a paper trail to show that you won it back.
The hard part is not stealing the money.
The hard part is moving the money into a form you can use
without getting caught.
And one method we've seen for quite a while is gambling.
It was very clear that,
if, at all, there was a place for you to do that,
it would have been the Philippines,
because the casinos are not regulated at all.
It's like a lot of high-flying gamblers
who'd kind of fly to Manila,
crowd these numerous casinos in Manila,
lots of money coming in.
People don't question that kind of money.
I mean, you know...
"Well, as long as it's coming to us,
we don't bother too much about where it is coming from."
The thieves knew if they could get that money
into the casinos, it would essentially be lost.
What happened was,
the manager from the Philippines bank,
she was the one who'd opened those four accounts
using fraudulent IDs.
She got the money withdrawn from the bank in the Philippines.
From there, it started to go
through something called Philrem.
It's a bit like a Western Union in the Philippines,
transferred into pesos.
I don't know if you've ever used
Philippine pesos before,
but that's one hell of a lot of pesos, $22 million.
In fact, it's over one million banknotes.
They actually had to request that cash
to come from a sister branch location,
that arrived in boxes.
The bank manager was seen by one of the other bank employees
collecting those boxes and literally going outside
and loading them up into a Lexus.
And that money was driven away.
So, we're talking stacks of bills carried in vans
to the Solaire Casino right by the airport.
It allows the Chinese gamblers to come off the plane.
Five minutes, they're on the floor playing baccarat.
The money goes to this place. It's wheeled in wheelbarrows
across the casino floor up to this guarded escalator.
There's so much physical cash involved,
they've enlisted their own crew of gamblers
to launder the stolen funds.
And they just played baccarat,
all day long.
They had individuals,
mostly appeared to be Chinese nationals that they had,
I assume, hired to take those funds and launder them.
You change that cash into casino chips,
play a few games,
cash in the chips.
And when you get that cash back, that is then laundered.
And this wouldn't have been unusual.
This was the Chinese lunar week.
That would've been very common for individuals,
high rollers, to come into the Philippines
and play at the casinos during that time.
Spending $22 million in a casino over a weekend,
let's face it, could be fun.
Doing this story and trying to figure out
where in history to sort of place this thing.
Was this the biggest heist of all time?
No, but it certainly looked to be the biggest cyber heist
of a bank in history.
And over the next few days, I just remember
calling up my sources at Symantec
and a couple other cybersecurity firms
and getting in touch with a guy named Eric Chien.
We have all kinds of sensors sitting on networks
and computers all over the world.
Any time some sort of cyber criminal, some attacker,
is trying to breach a computer, they're leaving traces behind.
Every attack has a signature.
If you look at it long enough,
if you study it, if you work it long enough,
you can understand the way they do things.
The way they state something,
the way they code a particular way,
the methodology of the attack, the step-by-step approaches.
It might be considered like Sherlock Holmesian
to come up with this idea.
"Because he walks with a gait this way,
and he does this..." But it is true.
We see those signatures. We see those patterns.
What we discovered was,
by looking at the artefacts that these attackers had used,
the malicious binaries they had used,
the code inside of it,
as well as the email accounts that they used
to send the initial spear-phishing messages,
we were able to map this back to an attacker back in 2014.
Sony Pictures is mainly housed in Culver City.
And in 2014,
Sony Pictures went down, which was unheard of.
On that day in November,
people would have come in, tried to swipe their badge
and not even be able to get into the office.
They get into the building finally
and then they discover that nothing else is working either.
Printers aren't working, computers aren't working.
People who had laptops connected to the network
would have immediately seen
skulls and crossbones show up on their screens,
scrolling with scary Halloween-type music
playing in the background.
And it said, "Hacked by the GOP."
Guardians of the Peace.
A mysterious crew of hackers,
also known as the Lazarus Group.
We'd call them the Lazarus Group.
They've been responsible
for many, many attacks over the years.
You know, political statements
and bringing down some websites in South Korea
and also the White House in the United States and the Pentagon.
Now, at this point, the penny has dropped.
Sony has been hacked.
The hack attack has had a devastating effect
on the entertainment company, with an avalanche of leaks
revealing personal information of employees
and salacious email exchanges of A-list celebrities.
They ultimately compromised Sony Pictures Network,
got inside and wiped 10,000 computers.
On top of that, they actually stole
all kinds of documents and emails from Sony Pictures.
The hack on Sony Pictures
is rocking Hollywood's very foundation;
the industry, warts and all, exposed.
Initially, we had no link between the SWIFT attack
and the Sony Pictures attack.
But when we were looking at the malware,
we found an interesting detail.
There was a component called an indexing manager,
which was saving the logs during the SWIFT attack
into an encrypted file.
The file was encrypted with a really long key,
and when we just googled for the key,
we found that the same key, exactly,
was used 18 months earlier in the Sony Pictures attack.
This was the moment we realised
the Bangladeshi SWIFT attack
was probably perpetrated by the Lazarus Group.
So, who is Lazarus?
Well, from what we know,
they're a trans-global criminal organisation
that's been trained at a nation-state level.
The nation states really started coming in on a criminal side...
when sanctions started.
When we start limiting the capability of a nation
to get cash, and we up the methodology
to monitor the way they're getting cash,
they turn to different approaches.
So if you're a country that's under sanction
and your ability to get funds has been compromised,
you may be motivated to go to the Lazarus Group
to fix your problem.
It's like a job for them. It is a job for them.
They get recruited. It's a nine-to-five job.
They come in, and each of them has their specialties.
They have managers,
they have targets that they're told to go after.
When you talk about nation states,
obviously, for your average nation state,
most cyber offensive campaigns are under the military.
It's very similar to how a military organisation
would be organised for their cyber offensive campaigns.
There is a hotel, for example, in China
where they've taken over multiple floors
where they essentially have dormitories.
They go to sleep in that hotel, they eat in that hotel,
and they don't come out of that hotel.
They just move from one room to another,
hack all day and night.
And the Lazarus Group is thought to be made up
of these state-trained hackers.
What's amazing about cyber,
when you talk about nation states,
is the cost to entry is extremely low.
We have nation states who have been
trying to create nuclear missiles,
tried to create a nuclear programme.
Places like Iran, for example.
The dollars it costs to do so, it's extraordinary.
But if you want to build a cyber offensive campaign,
you get two, three, four, five guys
and potentially threaten to disable the power grid
in some country.
When you talk about trying to rob a bank
or produce illicit drugs and sell them,
the amount of people required on the ground,
the amount of connections,
and for the dollars that you would receive,
is nothing compared to,
"Let's get three guys, break into a bank
and potentially transfer $1 billion."
Back in the VIP room of the Solaire Casino in Manila,
the money-laundering operation is in full flight.
They just spend hours upon hours gambling away,
collecting chips.
They transfer those chips back into cold, hard currency.
You put a hundred gamblers into the VIP lounge
playing cash, so maybe the house has a one or two percent margin.
But all the rest is untraceable money that they walk out with.
What's interesting about these individuals,
they weren't interested in winning.
They were just interested in playing.
If you lose the money,
the money doesn't go to the casino,
it goes to the other players.
So you can play the table where the other players are,
your partners.
Then you can lose the dirty money on purpose,
moving the money to your partners.
Now it's cashed out.
Now it looks like it came from a great win in a poker tournament
instead of being stolen from somewhere.
So, casinos are a good way of laundering money.
Real-world criminals have done that for decades.
Online criminals are doing it today.
They played for a whole week, that whole lunar week,
every day, like workers,
nine to five, essentially, in that casino.
Finally, the Chinese New Year celebrations
have come to an end.
The staff at the RCBC bank in Manila are back at work.
Now, the Bangladesh Bank is still desperately trying
to put a stop on any further withdrawals
from those accounts in the Bank of the Philippines.
They've lost $22 million already,
but there's still $59 million left that they can save.
They're firing message after message to Manila,
"Hold all transactions."
In the Philippines, they got those messages.
They got those messages
as part of many other transaction messages they got
that were sitting in a printer queue
at the bottom of the stack,
and ultimately, they never saw those messages.
At this point, the fence gets in touch with the manager
of the bank in Jupiter Street.
"Can you please authorise the transfer of $59 million?"
She authorises that $59 million.
It goes straight to the Solaire Casino.
More money laundering.
Five hours later,
after increasingly urgent calls from the Bangladesh Bank,
the manager finally puts a block on all of the accounts.
But, really, it's too late.
The money's gone.
It's incredible when you think what the Lazarus Group
was able to pull off with just some ones and zeros.
They guide their bespoke malware
into the computer network of a bank,
and then a year later,
they're literally washing $100 million
through a casino in the Philippines.
It's astonishing.
But what's really, really scary
is what happened just a year later.
Now back to the major cyber-attack,
the ransomware crippling 200,000 computers in 150 countries.
The thousands of targets all received this ominous message
in English on their screens:
Everyone was basically locked up with this malware
that we discovered had been launched by the same attackers
as the Central Bank of Bangladesh.
So they design this malware,
and then they lose control of it entirely.
And that caused chaos.
Ambulances were diverted to other hospitals.
Patients were turned away, their operations cancelled.
You know, the first sign that something
was seriously wrong was when hospitals in the United Kingdom
started telling patients, "Don't come."
That their systems had been locked up with ransomware.
It's unclear if it was accidentally released too early,
it appears so,
or if it was designed not to work
and just begin wiping computers, because it didn't matter.
Even if you paid them, you would not get the decryption key.
They didn't have the decryption key.
They couldn't decrypt your files anymore.
Japan, Turkey and the Philippines
were also affected. In the US, FedEx was hit.
That virulent virus spiralled out of control.
In Germany, it attacked the network of the Deutsche Bahn,
German Railway.
In Spain, WannaCry hit Telefonica,
the biggest telecommunications company.
It hit the banking systems, and ATMs didn't work.
This thing was hitting companies in something like 150 countries.
Other targets in the US
include Merck Pharmaceutical in New Jersey.
Even the company that makes Oreo cookies may have been hit.
So, you had the health service, you had transport,
you had communications, you had the finance system,
and you had governance
all with one tiny piece of crappy malware, WannaCry.
In other attacks,
they have to send you a spear-phishing email,
trick you into double-clicking on an attachment.
In this case, your computer just had to be on,
connected to the internet,
and it would have got infected by WannaCry.
It succeeded because the crappy malware
was being infiltrated into the systems
on the back of a much more powerful tool
called EternalBlue,
which had been developed by the National Security Agency
in the United States.
The thing the NSA never wanted to talk about
was the fact that it was travelling on a digital missile
that had been built at its own intelligence agency.
They repurposed something created by the US government,
leaked by the Russian government,
put it into their ransomware that allowed it to spread
all over the world, any computer on at that time.
So one crappy piece of malware
can hit every single aspect
of the critical national infrastructure
within the space of about ten days
in different countries.
Eventually, there's a court case after about a month.
There's a court case in Manila.
Ultimately, the bank manager didn't want anyone to find out.
But when he finally got in touch
with the Bank of the Philippines, they said,
"If you need this money returned,
you need to get a court order." So he files a court order,
but court orders are public in the Philippines,
like in many other countries.
A reporter spots it and realised that this has happened,
publishes it in a newspaper, and it all comes out.
The $81 million money-laundering scandal
is now considered one of the biggest bank heists in Asia.
But how exactly did thieves steal
such a huge amount of money?
Not just known in the Philippines
and the Bank of Bangladesh,
when the Bangladesh government finds out
the bank manager has been doing this behind the scenes,
but the whole world finds out.
And ultimately, the Bangladesh Bank
needs to get assistance from the FBI.
The New York Fed is involved. The United States is involved.
This becomes a whole worldwide issue
and begins to ripple across the financial industry
that this was even possible.
Experts believe that hackers
were able to break into the New York Federal Reserve's
special account for Bangladesh,
getting away with $81 million.
Now, Bangladesh's Central Bank governor, Atiur Rahman,
has resigned after hackers stole tens of millions of dollars
from the nation's foreign reserves.
The bank was criticised for its handling of the breach...
The governor was an excellent central banker.
I have a lot of respect for him.
He was deemed one of the top bankers by the Asia MoneyWeek.
And poor fellow, that time,
he was faced with this sort of scenario
which he honestly didn't understand.
He had really pushed the financial system
in Bangladesh into the 21st century.
He had to essentially fall on his sword and resign
in disgrace, and his career was ruined.
Many others at the bank had to resign as well.
An emotional Maia Deguito, the manager of the RCBC branch
in Jupiter Street in Makati, insists she is innocent
in the face of accusations
she is involved in the money-laundering scheme.
So far, only the branch manager
has been charged by the Anti-Money Laundering Council.
One of the great injustices of this whole scandal
is that the only person who got convicted of anything
was Maia Deguito,
and she was just the mid-level branch manager of the RCBC,
the bank in the Philippines that received the actual funds.
Typical, isn't it?
A crime that was conceived and carried out
by a whole bunch of men,
and the only person who gets done for it is a woman
who probably wasn't that guilty in the first place.
But she received a sentence of 56 years in jail
and a fine of $109 million,
which is significantly more than the thieves actually stole.
To my mind,
there's no question that she was a scapegoat.
I mean, the currency traders who turned that $81 million
into pesos got off scot-free.
There are a couple of Chinese operators
who brought these gamblers in from China.
We know that they received tens of millions of dollars in cash.
They vanished back to Macau. No trace of them was ever found.
We can't say for sure, but certainly it looks like
people at the Rizal Bank headquarters
buried these requests to stop these transactions.
But nobody else at the Rizal Bank was ever accused.
Oddly enough, in this giant scheme that involved
a half a dozen countries, nearly $1 billion,
only one bank employee in a small branch in Manila
was ever convicted of doing anything wrong.
It's incredible. Total impunity.
I think the most important lesson
of the Bangladesh Bank
is a lesson of scale.
The internet is a fantastic thing.
It's made our world much, much smaller.
You can do all sorts of things. It's fantastic.
But that interconnectivity,
where everything is linked to everything else,
means that if you get bad actors in that system,
then the damage
is infinitely more immense than it was before.
When I started this job two decades ago,
you had to explain to people, what is a virus?
What is a cyber-attack?
Today, we don't talk about
making sure this file doesn't get deleted any more.
We literally talk about making sure the supply chain is up,
food can reach people's tables.
Our job is not just to protect people's computers.
Our job is to ensure society is up and running.
Everything that we use now,
water, electricity,
the financial system, the comms system,
depends on the integrity
of unbelievably complex networked computer systems.
And our dependence is becoming such
that, should anything go wrong,
be it a technical hitch or be it a hack,
it can actually lead to our lives grinding to a halt
in a very short space of time.
We're sort of in a state
where we're increasing our vulnerability
and our attack surface every single day.
And instead of pausing
and thinking about how to lock up our power grid,
really, where our energy has been focused is on escalation.
Countries like the United States, China and Russia
have already arrogated the right to themselves
to attack with full force,
whether cyber or conventional weapons,
against anyone who brings down
a serious piece of critical national infrastructure.
We've had Stuxnet blowing up the Natanz centrifuge plant.
We've had ransomware attacks, which hit the Eastern Seaboard.
There was no gas to the Eastern Seaboard
for a whole week in the United States.
We had Russia against the Ukraine,
shutting out the power in the middle of winter.
We're talking about people losing their lives.
We've also had cyber-attacks
that potentially affected US elections.
We had the healthcare in the UK brought down,
dialysis machines no longer working.
This is an extremely fragile situation,
much more fragile than the period of détente,
because so many more countries have these weapons.
Malware is much more difficult to control than nuclear weapons.
People always warn me of the cyber Pearl Harbor
or the cyber 9/11,
but it's almost worse than that.
Every day, there are thousands of cyber-attacks,
and we're just getting more and more and more inured to them.
It's like a plague.
I think we'll see much more hostile cyber activity,
much more cyber bank robberies,
much more cyber espionage.
We'll see much more cyber war.
In many ways, I think we've seen nothing yet.
As attacks increase in their sophistication
and their range,
then the impact can be ever greater.
There is a cyber-attack on critical national infrastructure
coming to a place near you
within the next five to ten years.
If it's done well, and if it's really malicious,
that could be catastrophic.
What's amazing about the Bank of Bangladesh heist is...
they almost walked away with $1 billion.
The mistakes that they made
that led to them only walking with $81 million
were literally a typo in a name
and potentially not being patient enough,
waiting just one more hour.
We could be telling a completely different story.
Presumably, these guys
kept perhaps 95 percent of that cash.
You could walk out
with 95 percent of what you came in with,
have nobody trace that money, no record of it whatsoever,
and get on a plane with it, and you're home free.
Even if you had invested a year's work,
that you had recruited a really decent set of hackers,
that you had corrupted bank officials,
you'll be looking at a profit of about $75 million.
For a year's work, not a bad pay-off.
The Bank of Bangladesh heist showed them what was possible.
They proved that they could do it.
After that attack, it didn't stop.
We saw continued attacks on various banks across Asia,
I think in the Philippines again.
And also, they started hacking the cryptocurrency exchanges,
where people store their Bitcoin and Monero digital currency,
which has proved to be incredibly lucrative for them.
In 2017, Lazarus was thought
to have successfully attacked
at least five Asian cryptocurrency exchanges.
That's a total of $571 million that was lost.
Cryptocurrency exchanges just have the bare minimum
of security, we're learning now.
In 2020, as the global pandemic spiralled,
AstraZeneca, makers of one of the key vaccines,
was hit by an attack, extorting the company
and stealing sensitive information for profit.
The sums involved are astronomical,
and Lazarus is still very much at large.
They have been designated by the United States an APT;
that's an advanced persistent threat.
Now, the fundamental criteria
is that they represent a threat
to US national security and national infrastructure.
So, just by dint of it being called an APT
means that the Lazarus Group is serious stuff.
Marvel fans, think HYDRA.
James Bond films, think of SPECTRE.
It's something like that.
Now, it's tempting to think this comparison is absurd,
but this is the scale that Lazarus operates on.
Arguably, they're the most potent cyber criminals
in business today.
So the nation state's involvement in cybercrime
means that cybercrime has actually morphed
into cyber warfare.
You can have zero trust in these systems.
You need to assume that everything has been broken,
everything is being listened to,
that everything can be captured, and operate accordingly.
If a small group can plan something
and get away with $81 million,
which involved the Fed in New York,
SWIFT in Brussels,
the Bangladeshi Bank in Dhaka,
and then all the peripherals in Manila,
just think about what one of the really professional operations
in China, Russia,
the NSA, GCHQ,
just think what havoc they could wreak.
And every year, the hacks get bigger, the damage greater,
the implications graver.
Armies literally have hackers hammering at the gates.
And it just takes a simple breach,
one person, one weak link,
and those armies will storm the defences
and bring down a network that our way of life depends on.
It happened in Bangladesh in 2016.
And believe you me, it's going to happen again very soon.
Iyuno