CMA Small System AB

For February 3, 2017 CMA Small System AB - CMA Group Holding subsidiary company in Stockholm, Sweden. It is focused on providing technologies for the financial industry.

It is organized in the mid-eighties.

Representations in Moscow and Paris work.

History

2020: Leak of source codes softwares

At the beginning of December, 2020 it became known of leak of source codes of the software of CMA company which clients are the central banks of the different countries, including in Russia.

According to the Bank Security edition specializing in covering of events in the field of security in banking sector in open repositories there were codes of the depository solution DEPO/X of CMA which, according to the description on the official site of the company, has "the rich functionality allowing to exclude financial and operational risks and to increase efficiency of infrastructure of the capital markets". More than 20 organizations worldwide, including the central banks, central/national depositories and stock exchanges use the solution.

Leak of the software codes in CMA

In Twitter channel Bank Security it is told, via software solutions of CMA transactions for the total amount more than $100 billion are performed every day. Where codes and as there was a leak were published, it is not specified.

According to experts, behind this date leak there is the same person who posted on the Internet source codes of products of tens of companies, including Microsoft, Adobe, Lenovo, AMD, Qualcomm, Motorola, Mediatek, GE Appliances, Nintendo, Roblox, Disney, etc. earlier.

Softwares of CMA company use many the Central Bank of the world

The case with CMA can become a serious problem as products of the company use the Central Bank of such countries as Morocco, Mauritius, Oman, Serbia, Libya and Cambodia where pay to questions of information security not a lot of attention and resources, as in the developed states. It is possible that the vulnerabilities detected in the products CMA will be used afterwards by malefactors for cyber attacks in the bank industry.

In open repositories codes of the depository solution DEPO/X of CMA appeared

Often swindlers are engaged in social engineering. For example, using substitution of the phone number, call clients, are represented by employees of the bank and say that to the account there is something strange. Swindlers speak, what is your name, call an account number and a remaining balance on the card. Try to gain completely the confidence to obtain from you information lacking them and to withdraw your money.^[1][2]

Notes