Here's How Hackers Stole $15 Million From Mexican Banks

Ocean's Once

In April 2018, hackers stole the equivalent of $15 million from Mexican banks — and now we know how they probably did it.

Penetration tester and security advisor Josu Loza was one of the experts called in to respond to the April heist, and on March 8 he presented his findings at the RSA Security conference in San Francisco.

Based on his analysis, Mexico's central bank wasn't doing nearly enough to protect its clients' money — but other financial institutions could avoid the same fate if they're willing to work together.

Easy Money

On Friday, Wired published a story detailing the information Loza shared with the audience at RSA's conference. Based on his assessment, the success of the heist was due to a combination of expert bank hackers willing to spend months planning their crime and a banking network rife with security holes.

During the presentation, Loza made the case that the hackers might have accessed the Banco de México's internal servers from the public internet, or perhaps launched phishing attacks on bank executives or employees to gain access.

Regardless of how they first got access, Loza said, the main problem was putting too many eggs in one security basket. Because many of the networks lacked adequate segmentation and access controls, he argued, a single breach could provide the bank hackers with extensive access.

That enabled them to lay the groundwork to eventually make numerous money transfers in smaller amounts, perhaps $5,000 or so, to accounts under their control. They'd then pay hundreds of "cash mules" each a small sum — Loza estimated that $260 might be enough — to withdraw the money for them.

Cyber Insecurity

The bank hackers are still at large, but the heist appears to have served as a wake-up call for the Banco de México.

"From last year to today the focus has been implementing controls. Control, control, control," Lazo said during his presentation, according to Wired. "And I think the attacks aren't happening today because of it."

He also noted the need for companies to collaborate to defend against cyberattacks.

"Mexican people need to start to work together. All the institutions need to cooperate more," Loza said. "The main problem on cybersecurity is that we don’t share knowledge and information or talk about attacks enough. People don't want to make details about incidents public."

READ MORE: HOW HACKERS PULLED OFF A $20 MILLION MEXICAN BANK HEIST [Wired]

More on hacking: Hacker Figures out How to Drain $1 Million in Cash From ATM