http://www.theregister.co.uk/2009/03/19/sumitomo_cyberheist_investigation/<=
br>
How police busted UK's biggest cybercrime case
Sumitomo unpicked
By John Leyden
Posted in Crime, 19th March 2009 11:02 GMT
Exclusive The story of the investigation into the failed multi-million
pound cyberheist at Sumitomo Bank can finally be told, following the
recent conviction and sentencing of its perpetrators.
The audacious Mission Impossible-style scam, which brought a pair of
hackers and a bent insider together with other fraudsters, sought to
spirit away £229m ($423m) from corporate accounts held at the London
offices of the Japanese bank Sumitomo Mitsui in October 2004.
The conspiracy narrowly failed and no money was ever lost. Had it
succeeded, the amount stolen would have dwarfed the £26m in gold bullion
taken in the November 1983 Brinks Mat robbery and the £40m Securitas job
in 2006.
Tech-savvy cybercrooks were smuggled into Sumitomo's offices in September
2004, where they used commercial keystroke-logging software - not spyware
or specialist hardware, as initially and widely reported - to capture
usernames and passwords needed to make Swift bank transfers.
Marc Kirby led the investigation
These stolen login credentials were used in an unsuccessful attempt to
transfer money to ten overseas accounts under the control of fraudsters a
month later.
Repeated attempts to transfer funds to accounts in Spain, Dubai, Hong
Kong and Singapore failed because of errors in completing one of the
fields in the Swift system used to make transfers. But for this failure,
accounts held by firms including Toshiba International, Nomura Asset
Management, Mitsui OSK Lines and Sumitomo Chemical would have been
plundered.
The score
Returning to work after the weekend break, Sumitomo staff noticed that
PCs had been tampered with. Executives reported the crime after receiving
notice of the failed transfers, sparking a painstaking two-year police
investigation.
The investigation was led by Marc Kirby, retired former detective
inspector at the National Hi-Tech Crime Unit and later an officer at
SOCA, who saw the investigation through from the first phone call from
the bank and spoke exclusively to The Register.
"We quickly established something untoward had happened when we
checked the CCTV footage and discovered tampering," Kirby told El
Reg. "The sensitivity had been altered, turned down, so that the
cameras didn't record what was happening on the trading
floor."
Police quickly recognised the heist as an inside job, seizing building
entry records and CCTV footage from street cameras. Security supervisor
Kevin O'Donoghue, 34, became a key suspect once it was realised that
computers were tampered with over the weekend.
O'Donoghue repeatedly smuggled two men - later identified as the hackers
involved in the plot - into Sumitomo's London office. When challenged by
other workers, O'Donoghue claimed the pair were there only for a card
game.
Sneakers
Another strand of the investigation focused on the accounts established
by the fraudsters. "We established where the money would have gone
and took it from there," Kirby explained. "Because the bank
accounts were outside UK jurisdiction we had to go through diplomatic
channels. I'm still waiting for some requests."
Meanwhile, computer forensics examination established that commercial
key-logging software had been loaded onto compromised machines. "It
was a standard key-logger available on the net from a reputable firm of
the type parents use to keep an eye on their children," Kirby said.
"The use of legitimate technology meant the software was not picked
up by anti-virus scanners. And there was no traffic going into or out of
the network so it couldn't be detected that way."
The software used in the scam, iOpus Starr, is normally used for remote
surveillance of networked PCs.
The crooks obtained two sets of Swift login credentials, one for an
ordinary user and one for a supervisor account, needed to authorise
transactions, from two machines. They had also tested the software on
another machine. The compromised PCs were then formatted in a failed,
rather crude attempt to destroy evidence.
Computer forensics evidence obtained from these machines, CCTV footage
from the bank and elsewhere, telephone call records, building access logs
and travel records became the principal planks of the investigation.
Analysis of the laptops of suspects also played an important role. Since
the heist failed, there was never a money trail to follow.
Traces of guilt
The investigation involved a team that varied from seven to 14 officers,
at time of peak demand, and stretched over two years.
Following interviews with bank staff, O'Donoghue was arrested and
charged. He claimed he was coerced into driving the two hacking suspects
to the bank and letting them in.
"O'Donoghue was arrested within the first few days of the operation.
His involvement was clear from the CCTV footage which showed him
escorting [the hackers] into the bank," Kirby explained. "We
took about two more years to identify Mr P and Mr Van O [the
hackers]," he added.
Much effort was spent in the painstaking task of examining CCTV footage.
>From this the two hacking suspects were identified, initially known to
the police only as Laptop and Ponytail. O'Donoghue's mobile phone records
were seized. He'd changed his phone during the course of the
investigation but this failed to throw police off the scent.
Phone call and location records allowed police to identify the two
hackers as Belgian Jan van Osselaer, 32, and Frenchman Gilles Poelvoorde,
35. Poelvoorde (Ponytail) was arrested with a USB stick that had the same
digital fingerprint as the key-logging program used in the Sumitomo scam,
along with instructions on how to carry out the same hack on another bank
outside the UK.
Phone records involving van Osselaer and Poelvoorde, in turn, led to the
identification of other members of the conspiracy. Other lines of inquiry
turned out to be dead ends.
Sand dunes and cyberfraud
Accomplices to the scam turned up at a bank in Abu Dhabi with screenshots
of the attempted transaction and demands to receive their money. The copy
of the transaction was sent from a fax from a shop in Cheltenham. Shop
staff created a video fit of the customer who sent the fax. Kirby
considered appearing on Crimewatch to make an appeal requesting
information on the suspect, but rejected the idea over concerns it might
cause the gang he already had in his sights to destroy evidence and go to
ground.
The Abu Dhabi accomplices for the gang have never been identified. Kirby
explained that the assistance he had from overseas forces varied
enormously. He singled out French and Belgian police for particular
praise for expediting his requests. Without this help it would have been
impossible to identify Osselaer and Poelvoorde, neither of whom was known
to British police.
"There were no prints or DNA on record," Kirby told El Reg.
Nothing was overlooked in the investigation - Kirby's team even went
through Sumitomo's wastepaper baskets for the weekend before the botched
transfers in a failed attempt to find fingerprint evidence.
Other strands of the investigation allowed police to identify Hugh
Rodley, 61, of Tewkesbury, Gloucestershire, and Soho sex shop owner David
Nash, 47, of Durrington, West Sussex, as suspects in setting up an
international network of bank accounts used in the scam. Phone records of
the two hacking suspects were key to this along with subsequent police
surveillance.
"Overlapping pieces of evidence was a feature of the case. There was
lots of traditional evidence alongside the electronic and travel
records," Kirby explained. "When questioned, nobody admitted
anything, but the evidence was strong enough for the hackers to confess
and to secure other convictions."
Case closed
The investigation led to guilty pleas by O'Donoghue and the two hackers,
and a trial against the other fraudsters implicated in the scam that led
to two guilty verdicts last week.
Van Osselaer and Poelvoorde were jailed for three and a half years and
four years respectively, while O'Donoghue was ordered to serve four years
and four months behind bars. Rodley, found guilty of conspiracy to
defraud and conspiracy to transfer criminal property, was sent away for
eight years.
Nash was jailed for three years after a jury found him guilty of
conspiring to transfer criminal property. Rodley's alleged business
partner Bernard Davies, 74, killed himself just before the trial was due
to begin. Swedish national was accused of fraud but cleared on all
charges.
The successful conclusion to the case has allowed Kirby to reflect on its
outcome and what lessons might be learnt.
"The bank was very helpful. Their assistance saved months of work.
They had the social responsibility to report the case in the first place,
knowing it would generate adverse publicity," Kirby explained.
"Bank staff were subjected to sometimes robust questioning.
"I was very proud of the team that worked for me. They never lost
sight of the ultimate goal, never wavered in their enthusiasm and were
selfless in pursuit of the crooks. They should be proud."
The case ought to serve as a wake-up call to banks, according to Kirby,
who said it illustrated the need to place security under constant review
and to "minimise exposure to third parties" as well as the
dangers posed by key-logging software. ®
Related stories
Microsoft supplies Interpol with DIY forensics tool (16 April 2009)
http://www.theregister.co.uk/2009/04/16/interpol_coffee_announcement/
IPCC U-turn on Tomlinson CCTV (14 April 2009)
http://www.theregister.co.uk/2009/04/14/ipcc_u_turn/
French adhesive workers stick it to Brit boss (8 April 2009)
http://www.theregister.co.uk/2009/04/08/glue_factory_kidnap/
Westminster forced to switch off digital CCTV cameras (31 March
2009)
http://www.theregister.co.uk/2009/03/31/cctv_westminster_parking/
Serial killer may have been conjured by DNA blunder (27 March
2009)
http://www.theregister.co.uk/2009/03/27/phantom_dna/
Gang jailed over failed Sumitomo cyberheist (6 March 2009)
http://www.theregister.co.uk/2009/03/06/sumitomo_scam_sentencing/
Brit pair convicted for high-tech bank heist gone bad (4 March
2009)
http://www.theregister.co.uk/2009/03/04/botched_international_bank_heist/
£229m Sumitomo spyware trial begins in London (22 January 2009)
http://www.theregister.co.uk/2009/01/22/sumitomo_spyware_trial/
Mission Impossible at the Sumitomo Bank (13 April 2005)
http://www.theregister.co.uk/2005/04/13/sumitomu_bank/
Cyber cops foil £220m Sumitomo bank raid (17 March 2005)
http://www.theregister.co.uk/2005/03/17/sumitomo_cyber-heist_foiled/
---------------------------------------------------------------------------=
-------------------------
James M.
Atkinson &=
nbsp; &nbs=
p;
Phone: (978) 546-3803
Granite Island
Group &nbs=
p;
Fax: (978) 546-9467
127 Eastern Avenue
#291 =
;
Web:
http://www.tscm.com/
Gloucester, MA
01931-8008 =
;
E-mail:
mailto:jm..._at_tscm.com<=
br>
http://www.linkedin.com/in/jamesmatkinson
---------------------------------------------------------------------------=
-------------------------
No enterprise is more likely to succeed than one concealed from the
enemy until it is ripe for execution. - Machiavelli, The Prince,
1521
Received on Sat Mar 02 2024 - 00:57:26 CST