COIT20267 Computer Forensics: Phishing Attack on NAB Report

This report provides a detailed analysis of a 2018 phishing attack on the National Australia Bank (NAB). The study begins with an executive summary highlighting the widespread scams in Australian banks during that year, with a specific focus on phishing attacks. The report then presents the case study, outlining the events, including the compromise of staff email accounts and the use of fake login pages to steal credentials. It identifies the individuals involved, their motivations, and the types of evidence used in the criminal investigation. The report further explores the type of attack (social engineering/phishing), the forensic tools employed (email analysis), and the impact on victims. Finally, it discusses criminal punishments and other relevant aspects of the case, concluding with an overview of the Australian Prudential Regulation Authority (APRA)'s role in managing the risk of data breaches. The report aims to provide a comprehensive understanding of the attack, the investigative process, and the implications for cybersecurity.

Running head: PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Phishing attack on National Australia Bank, 2018
Name of the student:
Name of the university:
Author Note

1PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Executive summary
It is reported by Australian business that above 580 scams has occurred in various banks of
Australia. This exceeded 7.2 million dollars during 2018. This has been 53% rise from 2017 as per
the Targeting reporting scams of ACCC OR Australian Competition and Consumer Commission.
The phishing, on the other hand, is rousingly popular among different cyber criminals across the
world. Through this it is easy to trick any person to click different malicious links. It is within the
legitimate phishing email rather than breaking into computer defenses. Very recently, banks of
Australia has faced its tertiary institution in disclosing a significant data breach. Here, the case of
National Australia Bank (NAB) will be considered as the case study. During 1st May 2019, the event
involved the sensitive information related to staffs to access into from the harmful attackers. Some
systems and different email accounts of the staffs were found to be compromised. There were
various links in the phishing email merging towards the fake login page that allowed the intruders to
intercept in exceeding the staff’s credentials. With the logins, the attackers were able to access
different information for further employees. Nonetheless, it is still not known precisely how much
banks of Australia staffs has been damaged because of the data breach. The bank has been seen to be
contacting every people who were included in that. In this study the case is depicted at first. Then
different individuals related to the case along with the cause and motivating behind with the tasks are
discussed. Moreover, the individuals connected with the case and the cause and motivation of those
tasks are discussed. Besides, the types of pieces of evidence for criminal investigation are assessed
along with finding the attack kind. Next, the forensic tool utilized here and the manner it affects the
victims and the results of the event are investigated here. At last, the report analyzes the criminal
punishments and various aspects of the present case of banks of Australia.
Table of Contents

2PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Introduction:..........................................................................................................................................3
The case study happenings:...................................................................................................................4
Aspects involved in the crime:..............................................................................................................4
Inferring the criminal and motivation reasons:......................................................................................5
Type of evidence used in this current criminal investigation:...............................................................5
Type of attack:.......................................................................................................................................6
Determining the forensic tool used in the present case:........................................................................6
Discussing how it put an impact on the victim and the outcomes of crimes:........................................7
Reporting criminal punishment:............................................................................................................7
Various aspects of the present case:......................................................................................................7
Conclusion:............................................................................................................................................8
References:............................................................................................................................................9

3PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Introduction:
The following study deals with the scams that occurred in various banks at Australia during
2018.The scammers has been hacking their email systems along with impersonating the payment
receipt. Further, they have requested changes to the details of bank accounts such that the business
can make payment to scammer, instead of legitimate business. On the other hand, phishing is
increasingly popular with the cybercriminals. It has been simpler to trick anyone into clicking the
malicious link. This has been under the legitimate phishing email instead of breaking into the
defence of computers. The Australian banks has witnessed the latest tertiary institution in disclosing
a data breach. This included sensitive data about employees to get accessed from the side of
unknown attackers. It was found during 1 May 2019. In this report the case of National Australia
Bank (NAB) is considered (Gawade et al. 2018). Various email accounts of employees and few
systems got compromised. The phishing email consisted of the link towards the fake login page
permitting the attackers in intercepting the access credentials of the staffs. Having the logins at hand,
in this case the attackers could be able to access the various data of further staffs. Though exactly
how many banks of Australian employees have been harmed due to the data breach are not known.
However, the bank is found to contact all the people involved in that. In the following report a
detailed depiction of the case is portrayed. Next, the people linked with the case and the motivation
and cause behind such activity is demonstrated. Further, the kind of shreds of evidence used for the
criminal investigation is analyzed along with determining the type of attack. The forensic tool used
here along with the way that affected the victim and the outcomes of the crime is evaluated. Further,
the study reports about criminal punishment and additional aspects of the case that could be
discussed.

4PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
The case study happenings:
In this case, the credentials of staff login have been retrieved in successful manner. This was
done through phishing email and used for accessing the email accounts, bank account details and
calendars of the staff members affected. The attack occurred some weeks after the large data breach
that took place at Australian National Bank. Here, the nineteen years of worth of staff and the
personal information of manager were stolen (Valli, Johnstone and Fleming 2018). It happened in a
sophisticated cyber-attack. It is due to the constant failures for fix weaknesses in IT systems. Under
phishing attacks, the hackers are found to be masquerading as a genuine and trusted community and
found to be asking the victims to deliver the personal details. It was seen that an email was
pretending to be coming from banks of Australia tricking the users to click the link and open the
attachment and accessing the credential to fake banks of Australia page of login.
Aspects involved in the crime:
For this the criminals, suspects and victims are recognized. The disclosure of banks of
Australia came sometime after disclosure of Australian Competition and Consumer Commission or
ACCC. This became the target for of the data breach impacting the huge amount of resent and prior
visitors, managers and employees. It as reported by the Australian intelligence community
considering the Chinese government to be the primary suspect in this attack that is highly
sophisticated in nature. Here, the staffs and managers are being urged to become aware of the
effective phishing emails and consider the updating of the passwords for their on-bank accounts
(Emami, Smith and Jorna 2019). Additionally, the Auditor General from the New South Wales
published the report on various challenges witnesses by the state universities. This showed that out
of ten major universities, seven of them saw a minimum of one cyber incident during 2018.
Nonetheless, the audit has been found to be uncovering notable deficiencies in the internal IT

5PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
controls of the universities. Apart from this, the sector of education has found itself in the crosshairs
of the cybercriminals identified. The universities are found to be alluring the target for those
criminals provided the sheer quantity of information data records hey have been managing and
storing (Alauthman et al. 2019).
Inferring the criminal and motivation reasons:
Here, the aims of the sinister that the criminals expected to gain are assessed. As one is an
owner of small business, one might believe that there are various stories making headlines relevant
to them. Nevertheless, there are various data breaches taking place in Australia that can be likely
unreported sue to the fact that NDB or Notifiable Data Breaches commonly applicable to business
having the yearly turnover of about three million dollars and more. The intentions were to retrieve
the credentials of staff login and gain access on bank account’s calendars and email accounts of the
staff members affected (Furnell, Millet and Papadaki 2019).
Type of evidence used in this current criminal investigation:
Prior one month, the ACCC disclosed the breach starting late till the final year. There are
evidences that are believed to have unauthorized access to notable quantities of visitor information,
manager and personal employees that were extending back nineteen years before. As per the data
provided to the bank, this has involved, names, addresses, phone numbers, personal email addresses,
dates of births and constant urgent details, passport details, bank account details and payroll
information. It is reported by ACCC that the information has been just copied and never altered
(Sahoo 2018). Last year, in July, ACCC had been investigating with the attack where the bank
revealed that there had been no employees and manager. Furthermore, no research information has
been considered.

6PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Type of attack:
Here a social engineering attack took place. More specifically it has been phishing that is
used for stealing the data of users. This involved the login credentials and different credit card
numbers. This happened as the attackers are found to be masquerading the trusted entity like
Australian banks and found to be duping the victim to open the text message, instant message and
email. Here, the recipient has been tricked into clicking the malicious link. This leads to installation
of malware and freezing the system. This has been as the part of the attack of Ransomware or taking
out the sensitive data. This attack consists of devastating outcomes. This involves the unauthorized
purchases of the individuals, the identifying of thefts and stealing of funds (Tallón-Ballesteros, Fong
and Wong 2018). Apart from this, the phishing is frequently found to achieve the foothold on the
governmental and corporate networks as the part of bigger attack. Example of this involves the APT
or Advanced Persistent Threat event. Nonetheless, in the latter scenario, the staffs are being found to
be compromised in bypassing the security parameters, then distribute the malware within closed
environment and achieve the privileged access to the secured information (Mhaske-Dhamdhere and
Vanjale 2018). Further, Australian banks are found to be succumbing to the attack through typically
sustaining significant economic losses. This is apart from declining the consumer trust, reputation
and market share. As per the scope, the attempt of phishing has been escalating to the security
incident from here the business have a complex time to recover.
Determining the forensic tool used in the present case:
Here, the Email analysis tool is used. For this, Email analytics has been of great help. It
provides analytics for Gmail. This has been pulling information from Gmail account regarding
various emails in different folders and so on. This has been all the information required to determine

7PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
positively how one can spend in time and the way the expenditure of time can be developed in future
(Chen et al. 2018).
Discussing how it put an impact on the victim and the outcomes of crimes:
It has been helpful to tag emails and the segment the statistics through using the tags for
tracking the campaigns. Here, the tags are used for conducting the A/B tests and determine the most
efficient approach of email marketing for the products. This along with the Google analytics and free
analytics, has been helpful to achieve the insights from email tracking. This also helped in assuring
that the email reaches the prospects, make the customers engaged and market the products
effectively (Ilangakoon and Abeywardena 2018).
Reporting criminal punishment:
No such criminal punishment has been reported. However, the prevention has always been
better than the cure and not all the incident has been prevented. The hissing attempt and the proofs
suggest that this has been exponentially or targeted, plausible and sophisticated in nature. This has
led to compromise or harm for banks of Australia.
Various aspects of the present case:
For the current case Australian Prudential Regulation Authority (APRA), is found to be
handling the jurisdiction. They are found to be administering the Authorized Deposit Institutions
Prudential Standards and practising related to managing the risk of data. In terms of acquisition it
goes beyond the basic analytics. Regarding extraction, it validates the email addresses on signing up
that is helpful to develop the rates of delivery (Vilić 2019). Then regarding reconstruction it has
facilities of conversion rates and the change in email lists. For reporting it has the open rates and

8PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
click tracking. This particular tool is useful than other tools in terms of its products, solutions and
use cases. Its products have email solutions, email parsing software, email logs and email analytics.
The solutions consist of email delivery monitoring, free email list management and free email
sending services. The use cases have free transactional email services, transactional email templates
and transactional email API (Harries and Thomson 2018). In the current criminal investigation of
Australian banks the Email analytics is helpful in measuring the open, click-through, unsubscribe,
complaint, conversion, bounce and forward or share rate.
Conclusion:
It is understood from the above study that all the bank staffs and managers of National
Australia Bank must be following various instructions. Firstly, they must be storing the password
protected and never share that to any person. They must avoid open the attachments and links from
the unknown senders through social and email and careful to investigate the attachments from the
alleged senders not known. Moreover, they must be knowing the potential phishing emails and the
telephone calls from the institutions, government departments and business. They must be reviewing
and updating every password on the non-bank email Internet. Further, they must never utilize the
banks of Australia credentials for the accounts that have non- banks of Australia related. This is vital
to remind that the credentials of BANKS OF AUSTRALIA must provide access to various bank
systems such that that is vital to place the login credentials protected. Moreover, they must consider
the responsibilities seriously in controlling the data security and protection of their IT systems.
Ultimately, they must be determining the significance of the awareness of cybersecurity for the staffs
and managers in reviewing the awareness programs of the cybersecurity of banks of Australia.

9PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
References:
Alauthman, M., Almomani, A., Alweshah, M., Omoushd, W. and Alieyane, K., 2019. Machine
Learning for phishing Detection and Mitigation. Machine Learning for Computer and Cyber
Security: Principle, Algorithms, and Practices, p.26.
Butler, D.J., 2018. Phishing holidays: The market for timeshares. Tourism Economics, 24(6),
pp.690-700.
Chen, J., Mishler, S., Hu, B., Li, N. and Proctor, R.W., 2018. The description-experience gap in the
effect of warning reliability on user trust and performance in a phishing-detection context.
International Journal of Human-Computer Studies, 119, pp.35-47.
Cross, C., 2018. A record $340 million lost to fraud in Australia, says latest ACCC report. The
Conversation.
Emami, C., Smith, R.G. and Jorna, P., 2019. Predicting online fraud victimisation in Australia.
Trends and Issues in Crime and Criminal Justice, (577), p.1.
Furnell, S., Millet, K. and Papadaki, M., 2019. Fifteen years of phishing: can technology save us?.
Computer Fraud & Security, 2019(7), pp.11-16.
Gawade, N., Mundekar, S., Vare, N., Gada, R. and Bansod, S., 2018. URL Based Analysis for
Phishing Detection Using Data Mining. Available at SSRN 3267436.
Harries, A. and Thomson, C., 2018. Cyber risk. Agent, The, 51(5), p.9.

10PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Ilangakoon, S.D. and Abeywardena, K.Y., 2018, August. The Use of Subliminal and Supraliminal
Messages in Phishing and Spear Phishing Based Social Engineering Attacks; Feasibility Study. In
2018 13th International Conference on Computer Science & Education (ICCSE) (pp. 1-5). IEEE.
Jiang, J., Wen, S., Liu, B., Yu, S., Xiang, Y. and Zhou, W., 2019. Malicious Attack Propagation and
Source Identification. Springer International Publishing.
Marsh, T. and Phillips, G., 2019. The Hayne report–one giant leap forward for Australia. Law and
Financial Markets Review, pp.1-5.
Mhaske-Dhamdhere, V. and Vanjale, S., 2018. Phishing emails classification and clustering using
data mining algorithm. International Journal of Electrical and Computer Engineering, 8(6), p.5326.
Pham, C., Nguyen, L.A., Tran, N.H., Huh, E.N. and Hong, C.S., 2018. Phishing-Aware: A Neuro-
Fuzzy Approach for Anti-Phishing on Fog Networks. IEEE Transactions on Network and Service
Management, 15(3), pp.1076-1089.
Sahoo, P.K., 2018, March. Data mining a way to solve Phishing Attacks. In 2018 International
Conference on Current Trends towards Converging Technologies (ICCTCT) (pp. 1-5). IEEE.
Steves, M.P., Greene, K.K. and Theofanos, M.F., 2019. A Phish Scale: Rating Human Phishing
Message Detection Difficulty.
Tallón-Ballesteros, A.J., Fong, S.J. and Wong, R.K.K., 2018, September. An Empirical Study on
Performance Server Analysis and URL Phishing Prevention to Improve System Management
Through Machine Learning. In International Conference on the Economics of Grids, Clouds,
Systems, and Services (pp. 199-207). Springer, Cham.

11PHISHING ATTACK ON NATIONAL AUSTRALIA BANK, 2018
Valli, C., Johnstone, M. and Fleming, R., 2018. A Survey of Lawyers’ Cyber Security Practises in
Western Australia.
Vilić, V., 2019. PHISHING AND PHARMING AS FORMS OF IDENTITY THEFT AND
IDENTITY ABUSE. Balkan Social Science Review, 13(13), pp.43-57.
Wong, R.K.K., 2019. An Empirical Study on Performance Server Analysis and URL Phishing
Prevention to Improve System Management Through Machine Learning. In Economics of Grids,
Clouds, Systems, and Services: 15th International Conference, GECON 2018, Pisa, Italy, September
18-20, 2018, Proceedings (Vol. 11113, p. 199). Springer.
Yoon, C., Kim, K., Kim, Y., Shin, S. and Son, S., 2019, May. Doppelgängers on the Dark Web: A
Large-scale Assessment on Phishing Hidden Web Services. In The World Wide Web Conference (pp.
2225-2235). ACM.