Security experts have praised Sumitomo bank for admitting it was the target of a failed £220 million hacking attempt.
According to media reports the UK's National High Tech Crime Unit has issued a warning to large banks to guard against keylogging, the method adopted by the would-be thieves in an attack on the Japanese bank's London systems. The intruders tried to transfer money out of the bank via 10 accounts around the world.
Keyloggers record every keystroke made on a computer and are commonly used to steal passwords. Eighteen months ago, US games developer Valve had the source code to its latest version of Half-Life stolen after a virus delivered a keystroke recorder program into Valve's founder's computer.
"Generally big businesses don't like to talk about any security problems they may have," said Graham Cluley, senior technical consultant at security software company Sophos. "Clearly Sumitomo did very well, they din't lose any money and they involved the authorities."
Arthur Barnes at security integrator Diagonal Security agreed: "I think this is very positive, it warns the rest of the community. Someone was always going to have to stand up and say this is going on. It's very brave, they've really done the right thing. Too often this sort of thing is swept under the carpet."
He added, however, that he suspected Sumitomo had to have its arm twisted to admit to the security breach especially as it may have involved an insider.
"I have a horrible feeling that if the attempt had been successful, it would not have been reported," he said.
The bank confirmed a probe was underway and stressed that no money was lost but declined to talk about the details, citing the ongoing investigation.
"We have undertaken various measures in terms of security and we have not suffered any financial damage," a spokesman said.
Barnes, who has worked with the NHTCU, said he felt the publicised arrest of a man in Israel and Sumitomo's confirmation of a plot, appeared to point to the NHTCU trying to flush out the thieves and suggested they knew something about them. "It would also serve as a warning to anyone thinking of doing this kind of thing," he said.
Yeron Bolondi, 32, was seized by Israeli police yesterday after an alleged attempt to transfer some of the cash into his business account. He was reportedly charged with money laundering and deception.
In a statement, Israeli police said there had been an attempt to transfer £13.9 million into the account "by deception in a sophisticated manner".
Cluley and Barnes said keylogging hacks were more common than anyone would like to admit but the £220 million plot was probably the largest corporate case that had been made public.
Both experts said it was not clear what kind of key-logging had been used.
Barnes said keyloggers had become much more sophisticated in recent times, moving away from software forms to include sniffer-type hardware devices. Both he and Cluley speculated that the perpetrators may not have actually hacked in to the bank's systems from outside to plant their keylogger.
"They've now got little hardware loggers that are like a dongle that you place between the keyboard connection and the base unit," Barnes said.
It is a powerful, easy to use anti-spy program that prohibits operation of any keylogger, either currently in use or in development.
Our unique protection algorithm will block operation of any such keystroke monitoring for all spy software, both known and unknown. Once installed, our Advanced Anti Keylogger will protect your privacy immediately and constantly.
No spyware database update now! No scanning time now!
"One of the Best investments I ever made. Advanced Anti Keylogger is great. Thank you."