Taming the Digital Bandits: An Analysis of Digital Bank Heists and a System for Detecting Fake Messages in Electronic Funds Transfer

摘要

In recent years, financial crimes and large scale heists involving the banking sector have significantly increased. Banks and Financial Institutions form the economic and commercial backbone of a country. An essential function of banks is the transfer of funds domestically or internationally. Most banks today transfer money by using electronic fund transfer systems such as the Automated Clearing House (ACH) or messaging systems such as SWIFT, FedWire, Ripple, etc. However, vulnerabilities in the use of such systems expose banks to digital heists. For example, the 2016 heist in the central bank of Bangladesh used the SWIFT network to send fake messages. It almost resulted in the theft of nearly $1 billion, which is one-sixth of the total foreign currency reserve of Bangladesh. Similar attacks have happened in many other countries as well. In this paper, we discussed multiple such incidents. From those incidents, we systematically analyze two such events - the Bangladesh Bank heist and the DNS takeover of Brazilian banks - to understand the nature and characteristics of such attacks. Through our analysis, we identify common and critical security flaws in the current banking and messaging infrastructures and develop the desired security properties of an electronic funds transfer system.