The world bank has been hacked repeatedly over the last year according to a report on Dark Reading, which once again brings out the question, where was the information security team on this one?
With the banks in crisis and contributing to a generalized distrust of the banking system, the news of the breech could not come at a worse time. While many in the information security world wondering who is running the servers and managing the security at many of the banking companies as they consolidate and shut down, news of a world bank hack, with five servers that contained sensitive data for a year comes as stunning information.
The data raids are not a matter of stealing inconsequential bits and bytes. The World Bank’s data center is literally a treasure trove of vital financial information from around the globe. As a clearinghouse for financial data from both governments and companies, the bank’s computers could provide intruders with both a financial and intelligence gold mine — from inside information on bids and contracts to the minutes of confidential board meetings. Source: Fox News
You can read the memos here and here, the dark reading article is right here.
In all this is going to end up not just compromising people, but compromising governmental information about money, how money is used, and where it is going around the world. The interesting part is that not just money movements, if you know what the World Bank is going to invest in next that can give a company a competitive advantage, or allow the hackers to follow the money to other banks where the security is much poorer than they were at the World Bank.
They also do not know what was stolen as they are still trying to figure out who got in, or how they compromised the systems. Dark Reading is calling it a spyware hack, but then that means that it would have to come in either via image, USB, or someone was surfing from the computer and did not have it patched, or patches were lacking and there was a hole that was exploited. There are any numbers of ways that the intruder got into the system.
There might just need to be a complete overhaul of the World Bank networks and systems to make sure that any additional back doors or other systems were not compromised. What is more worrisome though is that the key server for the bank was also hacked, meaning they have the keys that were stored on that system. This means that all the keys issued by that server are also going to have to be reissued. Interesting story, with many ideas on whom, what, and how. The cleanup is going to be very hard, and they will need to have a security crew that is capable of cleaning up the mess.
