The hackers gained access to Bangladesh Bank's local network, which wasn't too hard since the bank was using secondhand $10 switches. They found that the SWIFT servers were on that network, not separated from it by any kind of firewall. They then ran a program designed to cheat SWIFT's Alliance Access software, which interacts with the Oracle-built database in which transaction data is stored. The malware searched SWIFT messages to extract addresses and transfer references. As the hackers generated and sent money-transfer messages based on that data (exactly how they did that is not clear to BAE Systems based on the available data), they also patched Alliance Access to allow these transactions, so they looked as if they had been properly checked by the system. That's why, at the New York Fed's end, the messages looked perfectly legit. The hackers also knew that all SWIFT messages are automatically sent to be printed, and they used a bit of malware to cheat the printers so they only spewed out evidence of properly approved transactions.

“The tool was custom-made for this job, and shows a significant level of knowledge of SWIFT Alliance Access software, as well as good malware-coding skills,” BAE Systems praised the attackers. Apparently, they knew Bangladesh Bank pretty well, too: The printer-cheating software was specifically written for a particular model of HP printer used at the bank.

They also must have been knowledgeable about international banking regulations and loopholes in countries' financial systems, such as the one that allowed them to launder the loot as gambling proceeds in the Philippines. And they may have subverted a number of bank employees. A Rizal Commercial Banking Corp. branch manager, who withdrew part of the money in cash to move it, is under investigation.

It was a big, sophisticated operation, and it paid off for those who launched it. There will undoubtedly be more like them because people with the technical expertise are not the ones with the money —bankers are.

Far be it from me to praise the perpetrators as Robin Hoods: They robbed one of the poorest nations in the world. Even using purchasing power parity, Bangladesh is, according to the International Monetary Fund, the 139th of 185 nations in terms of per capital economic output. The average disposable monthly wage there is $324, lower than, for example, in Zimbabwe or El Salvador. Its international reserves—$27 billion, part of which the hackers stole—are smaller than tiny Hungary's, though Bangladesh has a bigger population than Russia.

And yet Bangladesh in on the electronic systems that move billions of dollars per second—money that belongs to governments, corporations, and wealthy individuals. As far as that money is concerned, this is one world. Yet it's not in real life. Bangladesh Bank has assets of $29 billion, compared with $2.7 trillion for the New York Fed. It cannot afford to spend as much on cybersecurity as its U.S. counterpart in the fraudulent deals. Nor can many central banks and financial institutions around the world.

Networks such as SWIFT aren't vulnerable because they underspend on security. SWIFT takes it seriously: The latest warning came with a mandatory security update. Yet a global system is only as safe as its most unsafe parts. In a way, the Bangladesh heist is part of the same problem as Europe's refugee crisis: The West would like to be complacent about its relative wealth and security, but it can't be, because in a world made smaller by technological advances, poverty and need are knocking more and more persistently at its doors. To keep the world as conveniently small as it's getting—with fast, affordable travel, instant money transfers, and the other 21st-century perks—it's time to strive for a more uniform distribution of wealth.

From: Bloomberg

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

Copyright 2018 Bloomberg. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.