Security News Hackers strike Australia's largest pension funds in coordinated attacks

[Viking]

Content source

https://cybernews.com/news/hackers-strike-australiasuper-pension-fund/

Hackers targeting Australia's major pension funds in a series of coordinated attacks have stolen savings from some members at the biggest fund.

AustralianSuper, the country's largest fund managing A$365 billion for 3.5 million members, confirmed that up to 600 member passwords had been stolen to access accounts and commit fraud.

"We took immediate action to lock these accounts and let those members know," AustralianSuper's Chief Member Officer Rose Kerlin said, urging all members to check their online balances.

Four AustralianSuper members had a combined A$500,000 drained from their balances and transferred to other accounts that did not belong to them and hackers have compromised more than 20,000 accounts, according to the source, who was not authorized to speak publicly about the matter.

National Cyber Security Coordinator Michelle McGuinness said in a statement she was aware of "cyber criminals" targeting accounts in the country's A$4.2 trillion ($2.63 trillion) retirement savings sector and was organizing a response across the government, regulators, and industry. It was still unclear how many pension funds and members were affected.

Australian Retirement Trust, the second-largest fund managing A$300 billion for 2.4 million members, said it had detected "unusual login activity" affecting "several hundreds" of accounts. It locked impacted accounts as a precaution, though there were no suspicious transactions or changes made.

https://cybernews.com/news/hackers-strike-australiasuper-pension-fund/

 

[Wrecker4923]

Looks like more cases of password reused/leaked and no 2FA.

 

[TairikuOkami]

"We took immediate action to lock these accounts and let those members know," AustralianSuper's Chief Member Officer Rose Kerlin said, urging all members to check their online balances.

 

[bazang]

Looks like more cases of password reused/leaked and no 2FA.

At the very least, secure passwords, passphrases, and MFA should be taught in every school in the world beginning in the earliest grade and repeated every single year.

I am willing to bet a lot of money that this one thing alone would do much to prevent hackings.

Can you imagine a world where users would have to provide fingerprint, OTP from Authenticator app, and complex passphrase? There would be pitchforks and rifles in the streets. Governments would be toppled by the user mob.

I like people fact-to-face, but notionally - given all that I know about people and their proclivities and a deep understanding of human psychology - I just don't like people. People are always the problem. ALWAYS.

 

[simmerskool]

At the very least, secure passwords, passphrases, and MFA should be taught in every school in the world beginning in the earliest grade and repeated every single year.

Agree!
So a sloppy account holder with easy pw and who does not use 2fa, hacker breaks into that user's account and transfers $500k, how does that affect my account with strong pw and 2fa? does that hack somehow also give access to my account, or this Fund has poor security structure? IE, I log into my bank account every day, but so far that has not given me access to other customer's accounts (not that I'm trying... )

 

[Victor M]

how does that affect my account

It depends on how the attacker gained the foothold. The most obvious best way is to get hold of the tech admin account. Then he would have access to all accounts the admin is looking after. Another good way is to break the web code of the pension fund's access server. Once he gets in that way, the attack would again have access to many accounts. Another credential based attack vector would be to get hold of the clerical admin account. If the pension fund has an cell app, the attacker could reverse engineer the app. Or the attacker could monitor or capture the network traffic of a customer and forge his way in. Or it could be supply chain attack ............ There are many different ways to get in, and they all involve a bunch of accounts.

I think you read The Hacker News; I think you posted a link one time if I remember correctly. It is not the number of people affected nor the amount stolen or ransomed for that is interesting. The interesting thing about them is that they always provide a link to the source security researcher. You can read That long article, and gain insights to the TTPs of attackers.

 

[simmerskool]

It depends on how the attacker gained the foothold. The most obvious best way is to get hold of the tech admin account. Then he would have access to all accounts the admin is looking after. Another good way is to break the web code of the pension fund's access server. Once he gets in that way, the attack would again have access to many accounts. Another credential based attack vector would be to get hold of the clerical admin account. If the pension fund has an cell app, the attacker could reverse engineer the app. Or the attacker could monitor or capture the network traffic of a customer and forge his way in. Or it could be supply chain attack ............ There are many different ways to get in, and they all involve a bunch of accounts.

I think you read The Hacker News; I think you posted a link one time if I remember correctly. It is not the number of people affected nor the amount stolen or ransomed for that is interesting. The interesting thing about them is that they always provide a link to the source security researcher. You can read That long article, and gain insights to the TTPs of attackers.

I guess when I skimmed the story, not clear to me that hackers got into a "tech admin account."

 

[Victor M]

No cybernews did not provide a link. I was only postulating how it could affect another account even if the fund uses 2FA.

 

[bazang]

Agree!
So a sloppy account holder with easy pw and who does not use 2fa, hacker breaks into that user's account and transfers $500k, how does that affect my account with strong pw and 2fa? does that hack somehow also give access to my account, or this Fund has poor security structure? IE, I log into my bank account every day, but so far that has not given me access to other customer's accounts (not that I'm trying... )

Hacking a user account is one thing. Hacking the entire backend that supports all the accounts is an entirely different matter.

You probably would not be surprised how many servers out there that have server passwords of "password" or "Admin."

 

[simmerskool]

Hacking a user account is one thing. Hacking the entire backend that supports all the accounts is an entirely different matter.

You probably would not be surprised how many servers out there that have server passwords of "password" or "Admin."

Ok so that Australian fund with ALL that money had poor security on its servers? Or the best hardware and security software is eventually hackable? Scary either way...

 

[Victor M]

Or the best hardware and security software is eventually hackable?

You know the favorite motto of hackers is along the lines of "everything man made is vulnerable somewhere and hackable".