Bangladesh Bank website back after three days, Janata Bank site still down after cyber attack traces found

The Bangladesh Bank website has been restored after being kept closed for three days to check for possible cyber attack risks. The central bank's website has been accessible again since 8am on Sunday (25 October). The website of state-owned Janata Bank, however, could not be reopened the same day — traces of a cyber attack have been detected in at least two places on it.

The Bangladesh Bank website had been shut down on Thursday over security concerns. After the holidays, it was reopened to the public on Sunday morning.

Bangladesh Bank spokesperson Arif Hossain Khan told the media that the website had been examined to see whether it contained any flaw. The site was kept closed as a precautionary step amid fears of cyber attacks around the world. With the risk now passed, it has been reopened.

Janata Bank's website, too, had been kept closed in advance to avoid risk amid the global alert. Even so, it fell victim to a cyber attack. After signs of spam or cyber attack were detected in at least two places, staff of the bank's information technology department are working to fix them.

Although banking activities resumed on Sunday after the holidays, Janata Bank's website could not be brought back by 11:30am. A senior official of the bank's IT department told the media that signs of a cyber attack had been found in two places on the website. Work is under way to identify the flaws and restore the website's security. They hope it will be possible to make the website fully safe and operational within the day.

As the post of Janata Bank's managing director is vacant, no formal statement was available on the matter. On 19 October the government cancelled the remaining tenure of the bank's then managing director, Mojibur Rahman. From the next day, a five-day stretch of holidays began in the banking sector, combining Durga Puja and the weekly holidays.

Behind the whole situation lie two serious security flaws detected in PHP, a programming language widely used around the world. After the flaws were identified, the European Union's cyber security agency ENISA and related international bodies issued a joint alert on 21 October amid fears of global cyber attacks.

The alert said hackers could exploit the flaws to run harmful code remotely on affected servers. Where a rapid security patch or update was not possible, it advised temporarily disconnecting risky applications from the internet.

As part of that alert, and for extra protection, the websites of both Bangladesh Bank and Janata Bank had been temporarily closed to the public from Thursday. After the holidays, while the central bank's portal reopened as usual on Sunday, Janata Bank's website could not be reopened because of the malware infection.

International media reports said that after the PHP security flaws were identified, governments in various countries took emergency steps. After the flaws came to light, government and commercial websites were kept closed in different countries from Wednesday night onward. Despite precautionary measures, millions of hacking attempts were made around the world, according to various media reports.

The relief is that, although the websites were closed, transactions through internet banking and mobile banking remained normal during this period. As a result, customers' financial transactions were not disrupted.

At present, government services, banking activities, e-commerce, news media and many other online platforms depend heavily on websites and software. A large share of those websites are built using the PHP programming language. A security flaw in a single language can therefore put many institutions at risk at once — as this episode has shown again.

All eyes are now on Janata Bank. Its IT department is working to repair the two flaws and restore the website's security. Although there is hope of making the site safe and operational within the day, customers will have to wait until it is finally reopened.