Incident: NSA Exploited Software Vulnerabilities to Access SWIFT Money-Transfer System

Published Date: 2017-04-15

Postmortem Analysis
Timeline 1. The software failure incident involving the U.S. National Security Agency accessing the SWIFT money-transfer system through vulnerabilities in commercially available software likely happened in 2013 [50610, 58927].
System 1. Windows servers (vulnerable at the time in 2013) [50610, 58927] 2. Cisco firewalls (specifically ASA firewalls) [50610, 58927] 3. Microsoft exploits [50610, 58927] 4. SWIFT money-transfer system [50610, 58927] 5. Oracle databases handling SWIFT transactions [50610, 58927]
Responsible Organization 1. The U.S. National Security Agency (NSA) was responsible for causing the software failure incident by exploiting vulnerabilities in commercially available software to gain access to the global system for transferring money between banks [50610, 58927].
Impacted Organization 1. SWIFT money-transfer system [50610, 58927] 2. SWIFT service providers in the Middle East and Latin America [50610, 58927] 3. Al Quds Bank for Development and Investment [50610] 4. EastNets, a SWIFT contractor [50610, 58927]
Software Causes 1. Vulnerabilities in Windows servers that were exploited by the NSA using Microsoft exploits [50610, 58927] 2. Vulnerabilities in Cisco firewalls that were exploited by the NSA using a tool codenamed BARGLEE [50610, 58927]
Non-software Causes 1. Lack of proper cybersecurity measures in place at SWIFT service providers, allowing for vulnerabilities to be exploited [50610, 58927] 2. Failure of the SWIFT service providers to update and patch their systems in a timely manner, leaving them vulnerable to known exploits [50610, 58927] 3. Insufficient monitoring and detection systems in place to identify and prevent unauthorized access to SWIFT networks [50610, 58927]
Impacts 1. The software failure incident led to the exposure of vulnerabilities in commercially available software, allowing the U.S. National Security Agency (NSA) to gain unauthorized access to the global system for transferring money between banks [50610, 58927]. 2. The incident compromised the security of SWIFT service providers' systems, potentially allowing the NSA to target computers interacting with the SWIFT network using Microsoft exploits [50610, 58927]. 3. The breach of firewalls, particularly using a tool codenamed BARGLEE, highlighted the weaknesses in the security measures of SWIFT affiliates and service providers [50610, 58927]. 4. The incident raised concerns about the security of financial transactions and the potential exploitation of vulnerabilities by national intelligence agencies for espionage purposes [50610, 58927].
Preventions 1. Regularly updating software: Keeping software up to date with the latest patches and security updates could have prevented vulnerabilities that were exploited by the NSA in the SWIFT system [50610, 58927]. 2. Implementing strong firewall security measures: Strengthening firewall configurations and ensuring they are properly configured could have helped prevent unauthorized access to the SWIFT system [50610, 58927]. 3. Conducting regular security audits: Regular security audits and assessments could have identified and addressed any weaknesses or vulnerabilities in the SWIFT system before they were exploited by hackers [50610, 58927].
Fixes 1. Patching the vulnerabilities in the Windows servers and Cisco firewalls that were exploited by the NSA [50610, 58927]. 2. Updating software versions to ensure that prior patches have fixed the flaws exploited by the NSA programs [50610, 58927]. 3. Implementing comprehensive updates to protect against the newly released exploits [50610, 58927].
References 1. Hackers (Shadow Brokers) [50610, 58927] 2. Matt Suiche, founder of Comae Technologies [50610, 58927] 3. Microsoft [50610, 58927] 4. Cisco Systems Inc [50610, 58927] 5. EastNets [50610, 58927]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to the breach of SWIFT service providers' security firewalls using Microsoft exploits and Cisco firewalls happened again at the same organization, specifically at the SWIFT service providers. The NSA targeted nine computer servers at a SWIFT contractor, Dubai-based service bureau EastNets, using lines of code to query the SWIFT servers and Oracle databases handling the SWIFT transactions [50610, 58927]. (b) The incident involving the exploitation of vulnerabilities in commercially available software to gain access to the global system for transferring money between banks has not been explicitly mentioned to have occurred at multiple organizations in the provided articles.
Phase (Design/Operation) design, operation (a) The software failure incident in the articles can be attributed to the design phase. The incident occurred due to weaknesses in commercially available software that were exploited by the U.S. National Security Agency (NSA) to gain access to the global system for transferring money between banks. The NSA likely used vulnerabilities in Windows servers and Cisco firewalls to breach the SWIFT service providers' security firewalls and target the computers interacting with the SWIFT network [50610, 58927]. (b) The software failure incident can also be linked to the operation phase. The NSA targeted nine computer servers at a SWIFT contractor, EastNets, and used lines of code to query the SWIFT servers and Oracle databases handling the SWIFT transactions. This operation phase involved the actual exploitation and querying of the systems to gain unauthorized access and extract information [50610, 58927].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident was within the system as the National Security Agency (NSA) likely used weaknesses in commercially available software to gain access to the global system for transferring money between banks. The NSA accessed the SWIFT money-transfer system through service providers in the Middle East and Latin America by targeting machines using Microsoft exploits after bypassing firewalls [50610, 58927]. The breach of firewalls and exploitation of vulnerabilities within the system allowed the NSA to compromise the SWIFT network.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the articles was primarily due to non-human actions. The incident involved hackers exploiting vulnerabilities in commercially available software, such as Windows servers and Cisco firewalls, to gain access to the SWIFT money-transfer system [50610, 58927]. (b) Human actions also played a role in the software failure incident. For example, the NSA targeted specific computer servers at a SWIFT contractor and used lines of code to query the SWIFT servers and Oracle databases handling the transactions [50610, 58927]. Additionally, the use of Microsoft exploits by the hackers to target computers interacting with the SWIFT network was a result of human actions in developing and deploying those exploits [50610, 58927].
Dimension (Hardware/Software) hardware, software (a) The software failure incident reported in the articles is primarily due to contributing factors that originate in hardware. The incident involved the U.S. National Security Agency (NSA) using weaknesses in commercially available software to gain access to the global system for transferring money between banks by exploiting vulnerabilities in hardware components such as Cisco firewalls and Windows servers [50610, 58927]. (b) The software failure incident also had contributing factors originating in software. The NSA used Microsoft exploits to target the computers interacting with the SWIFT network after penetrating the firewall of the SWIFT service providers, indicating a software vulnerability that was exploited in the incident [50610, 58927].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. The incident involved hackers releasing documents and computer files that revealed how the U.S. National Security Agency (NSA) exploited weaknesses in commercially available software to gain unauthorized access to the global system for transferring money between banks. The hackers provided a blueprint showing how the NSA likely used vulnerabilities in SWIFT affiliates' Windows servers and Cisco firewalls to compromise the SWIFT network [50610, 58927]. The NSA targeted specific servers at a SWIFT contractor and used lines of code to query SWIFT servers and Oracle databases, indicating a deliberate and targeted attack on the financial system [50610, 58927]. The NSA's actions, as described in the articles, were aimed at espionage and gaining unauthorized access to sensitive financial information, demonstrating a malicious intent to harm the system.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: - The software failure incident involving the U.S. National Security Agency (NSA) accessing the SWIFT money-transfer system through vulnerabilities in commercially available software was primarily due to poor decisions made by the NSA to exploit these weaknesses for espionage purposes [50610, 58927]. - The NSA targeted SWIFT service providers' security firewalls using a tool codenamed BARGLEE, indicating a deliberate effort to breach the system [50610, 58927]. - The NSA used Microsoft exploits to target computers interacting with the SWIFT network after penetrating the firewalls, showcasing a strategic decision to exploit software vulnerabilities for unauthorized access [50610, 58927].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence is evident in the articles as it was reported that the U.S. National Security Agency (NSA) likely used weaknesses in commercially available software to gain access to the global system for transferring money between banks. The NSA accessed the SWIFT money-transfer system through service providers in the Middle East and Latin America by exploiting vulnerabilities in Windows servers and Cisco firewalls [50610, 58927]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the articles.
Duration permanent (a) The software failure incident in the articles appears to be permanent. The incident involved the U.S. National Security Agency (NSA) exploiting vulnerabilities in commercially available software to gain access to the global system for transferring money between banks. The NSA used tools and exploits to breach the security firewalls of SWIFT service providers and target computers interacting with the SWIFT network. The incident was part of a series of disclosures by a group called the Shadow Brokers, indicating a systematic and ongoing exploitation of software weaknesses for espionage purposes [50610, 58927].
Behaviour value, other (a) crash: The software failure incident did not involve a crash as the system was not reported to have lost state and stopped performing its intended functions [50610, 58927]. (b) omission: The software failure incident did not involve omission where the system failed to perform its intended functions at an instance(s) [50610, 58927]. (c) timing: The software failure incident did not involve timing issues where the system performed its intended functions too late or too early [50610, 58927]. (d) value: The software failure incident involved a value issue where the system performed its intended functions incorrectly, allowing unauthorized access to the SWIFT money-transfer system through vulnerabilities in commercially available software [50610, 58927]. (e) byzantine: The software failure incident did not exhibit byzantine behavior where the system behaved erroneously with inconsistent responses and interactions [50610, 58927]. (f) other: The software failure incident involved a security breach where the National Security Agency (NSA) exploited vulnerabilities in software to gain unauthorized access to the SWIFT system for transferring money between banks [50610, 58927].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the articles involved the U.S. National Security Agency (NSA) using vulnerabilities in commercially available software to gain access to the global system for transferring money between banks, specifically the SWIFT money-transfer system. The hackers released documents indicating that the NSA accessed SWIFT through service providers in the Middle East and Latin America, potentially compromising the security of financial transactions [50610, 58927]. This breach of security could have led to potential financial losses or impacts on the integrity of the banking system, affecting people's material goods, money, or data.
Domain finance (a) The failed system was related to the finance industry, specifically the global system for transferring money between banks known as SWIFT (Society for Worldwide Interbank Financial Telecommunication) [50610, 58927]. (h) The incident involved a breach of the SWIFT money-transfer system, which is crucial for financial transactions between banks, making it a significant failure in the finance industry [50610, 58927].

Sources

Back to List