Bank officials say it wasn't their fault that sensitive systems were exposed to hackers.
Technicians from the global payment network SWIFT left Bangladesh's Central Bank vulnerable to an attack that saw attackers steal $81 million, according to Bangladeshi police and bank officials speaking to Reuters.

In February, unknown hackers broke into the Bangladesh Bank and almost got away with just shy of $1 billion. In the event, their fraudulent transactions were cancelled after they managed to transfer $81 million when a typo raised concerns about one of the transactions. That money is still unrecovered. In April, we learned that preliminary investigations had revealed the use of cheap networking and a lack of firewalls, both contributing to the attack.

The new report sheds further light on the incident. The SWIFT organization is owned by 3,000 financial companies and operates a network for sending financial transactions between financial institutions. Technicians from the organization worked at the central bank last year when they were connecting the Bangladesh's real-time gross settlement (RTGS) system to the SWIFT network. Mohammad Shah Alam, leading the probe for the Bangladesh police, told Reuters that the technicians doing this work left "a lot of loopholes" that were not subsequently addressed.

Bank officials speaking anonymously said that contrary to SWIFT's own policies, the SWIFT system was connected to the bank's main network, and hence to the Internet at large. Instead of using firewalls and/or VLANs to segment networks and restrict access, the technicians instead used a dumb unmanaged switch that they found unused at the bank, police said. This lack of separation left the SWIFT system much more exposed to hackers than it might otherwise have been.

Reuter's sources further said that the technicians set up a wireless network so that they could access the SWIFT systems without having to be in the same locked room. This wireless network was not removed or disabled when the work was completed, and the network was only protected by a simple password. This setup created still further ways to achieve unauthorized access to the SWIFT system. Nor did the technicians disable the USB ports of computers attached to the SWIFT system, creating the risk of malicious software installation from a USB key.

BAE Systems, investigating the attacks, has published some of its findings, saying that it found malware that was designed to intercept and silently rewrite certain transactions sent via the SWIFT system. How this malware was introduced remains unknown.

Why the technicians left the network vulnerable in this way is also presently unknown, with Alam telling Reuters that the Bangladeshi police are currently trying to find out "whether it is intentional or negligence."