BAE Systems Applied Intelligence Blog
baesystemsai.blogspot.com · Company blog · on HN since 2015
BAE Systems Applied Intelligence's security researchers analyze malware and cyber attacks, such as the Bangladesh SWIFT heist, WannaCry and APT10.
What HN saysHN commenters link it for technical detail on the SWIFT attack, including the two-byte patch, and for the WannaCry ransomworm analysis.
15HN people shared it
5linked it in comments
10stories submitted
412story points
9 years agolast shared
2015people per year2026
Most-shared posts
- 1Two Bytes to $951M6 people · 293 points · first shared 2016 · 77 comments on HN
- 2WanaCrypt0r Ransomworm1 people · 108 points · first shared 2017 · 65 comments on HN
- 3New OS X malware exploits MacKeeper1 people · 6 points · first shared 2015 · 1 comments on HN
- 4APT10 – OPERATION CLOUD HOPPER1 people · 2 points · first shared 2017 · discussion on HN
- 5Two Bytes to $951M1 people · 2 points · first shared 2016 · discussion on HN
- 6Lazarus’ False Flag Malware1 people · 1 points · first shared 2017 · discussion on HN
- 7Two bytes to 951m1 people · first shared 2016
- 8Two bytes to 951m1 people · first shared 2016
- 9Two bytes to 951m1 people · first shared 2016
- 10Wanacrypt0r ransomworm1 people · first shared 2017
What HN people wrote when they linked it
tjoff · 2017-05-18
Info screens, ATMs etc. are easily reimaged though - no data loss.
Anyway: http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomworm.html
The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (unrelated) ransomware campaign, called Jaff.
There is also a working theory that initial compromise may have come from SMB shares exposed to the public internet. Results from Shodan show over 1.5 million devices with port 445 open – the attacker could have infected those shares directly.
Surprisingly large amount of SMB shares exposed directly to internet, that would of course be a great starting point.
ComodoHacker · 2016-09-28
>So: you "hacked" a "bank". You're on their internal network. Talk me through "stealing the money directly".
The attack on SWIFT in Bangladesh [1] earlier this year gives one example.
1. http://baesystemsai.blogspot.com/2016/04/two-bytes-to-951m.html
rodgerd · 2016-05-27
> Not necessarily a hack of the Swift Software, right?
It was absolutely a hack of the software. The Swift/Alliance software was modified to, for example, rewrite the PCL output of print jobs so as to make sure paper-based reconciliations would match the electronic fraud.
See the informative http://baesystemsai.blogspot.co.nz/2016/04/two-bytes-to-951m.html for details.
tiplus · 2016-04-30
pieter1976 · 2016-04-25
The malware looks for processes with with a specific DLL loaded in it and then will replace two specific bytes with other instructions, which essentially trick the process into thinking an important check has been done.
It replaced a JNZ with NOP NOP. The BAE Systems blog post has lots of techincal detail: http://baesystemsai.blogspot.co.uk/2016/04/two-bytes-to-951m.html