📸

found gateways to other banks and financial institutions in the New York area such as Dai-Ichi Kangyo Bank New York and Chase Manhattan.

They ignored the other banks. What had particularly intrigued them were references in the computer systems to an EFT operation run by their target: in files and in the electronic mail they kept turning up allusions to EFT, which pointed, they were convinced, to a terminal that did nothing but transfer funds. They began sifting through their lists of addresses, looking for one among hundreds that could denote the EFT computer, and by a laborious process of elimination they whittled the lists down to five machines whose function they couldn’t divine. Of those, one seemed particularly interesting. It could be entered by a debug port (a computer access port used for maintenance) that had been left in default mode — in other words, it could be accessed with the standard manufacturer-supplied password, because yet again no one had ever bothered to change it.

The system they entered contained menus that guided them through the computer. One path took them directly into an admin area used by system operators. After an hour of exploration they found a directory that held a tools package, allowing them to create their own programs. With it, they wrote a procedure to copy all incoming and outgoing transmissions on the terminal into their own file. They named the file ‘.trans’ and placed it in a directory they called ‘.. ’ (dot, dot, space, space), effectively hiding it from view. What they had created was a ‘capture’ file; from the transmissions they would be able to divine the functions of the computer terminal.

The capture file was created late on a Sunday night. At about 9 p.m. on the Monday night they logged on to the system again, and from the day’s transmissions they could tell that the targeted machine was indeed an EFT terminal. They discovered that this computer began a transaction by connecting with a similar computer at another bank, waited for a particular control sequence to be sent, and then transferred a long sequence of numbers and letters. They captured about 170 different transactions on the first day and several hundred more in the following week. At the end of the week they removed the ‘.trans’ file and its directory, killed the capture routine, and went through the system removing any trace that they had ever been there.

📸