More on the Foiled Sumitomo Mitsui Bank Heist

The Sumitomo case is starting to get interesting. Two news articles shed new light on this attempted cyber heist. The first from Computing, a UK based IT journal reveals that hardware keystroke logging devices were used. This means that someone had to install devices on computers within the Bank. Not a hard operation but significantly harder than just emailing a software keystroke logger to the target and asking them to install it. The article claims cleaning staff were involved but this is something any insider or visiter can do. IT support staff are very well positioned to install hardware monitoring devices for instance. The case took on Mission-Impossible traits when it was revealed that the bank’s video tapes that would have recorded the placement of the hardware devices were blank.

This article has a hilarious quote:

Due to the panic caused by the discovery of the keyloggers many banks are now super-gluing keyboards and other devices into their computers.

Hey, whatever works.

Questions we are still waiting on answers for: How was the attempt foiled? Was it as simple as a paper step in the wire transfer process that the thieves did not know about? Did some manager end up with 20 transfer requests on his/her desk waiting for a signature?