Schneier on Security

Roger • March 22, 2006 4:50 PM

Goes to show that when large amounts of money are at stake, criminals are perfectly prepared to undertake elaborate schemes to get at it. Such schemes are not “movie plot threats” in the sense of being incredible. They may be movie plot threats if JP Morgan focusses on the specific techniques used by this gang, instead of the fundamental problem: its procedure for authenticating large transactions is too weak. In fact it is too weak even for small transactions!

It is remarkable that banks still accept such weak authentication for such large transactions. Notably Nick Leeson, the embezzler who caused the collapse of 233 year old Barings Bank a decade ago, authorised his fraudulent transactions in much the same way. Leeson didn’t even bother to fake the CLID on the fax and was eventually caught when someone noticed that a fax allegedly from a client had actually come from Leeson’s fax.

Faking fax CLIDs is trivial; it certainly doesn’t require a phone company insider to help. Presumably the phone company insider was required because JP Morgan was using some slightly stronger authentication mechanism, such as checking ANIs. However, the prevalence of VoIP systems means that faking ANIs is now also fairly easy, so the phone company insider is not required even for this.

The number of people allegedly involved is rather curious. Eight people have been charged, but most of them seem to have contributed little to the scheme. In fact if I read it right, only Hufnagl (technical knowledge) and Kurland (financial knowledge) were actually required; everyone else either had bit parts, or were involved in bringing the other players together. Both Hufnagl and Kurland seem to have stuffed-up in that what they did was traceable before they got away with the money.

I’m rather curious about Bourchier’s role. Police are alleging that he provided inside information on JP Morgan’s operations, in the form of documents passed to the “unnamed crime figure” via Petersen. However on the strength of the evidence presented in the SMH article, it seems equally possible that he carelessly lost the documents at Petersen’s club where they were found either by Petersen (who then passed them on treacherously), or by an associate of the “unnamed crime figure” who presumably also frequented the club.

[Oh, one small explanatory comment for readers outside Australia, and indeed outside NSW: the RSL is the Returned Services League, an organisation similar to, say, the American Legion. The clubs are generally places where veterans reminisce with old comrades and wash down cheap, wholesome cooking with a few quiet ales. However due to oddities of local law, within the Australian state of New South Wales most inner city RSL clubs are operated as casinos, and most persons present on any given night are either “associate members” with no connection to the military, or “temporary guests” who got in simply by signing a ticket stating that they live more than 5 km away. Mickey Mouse is a frequent “temporary guest”.]