Hackers outwit online banking identity security systems

Hackers outwit online banking identity security systems

www.bbc.co.uk

Criminal hackers have found a way round the latest generation of online banking security devices given out by banks, the BBC has learned.

After logging in to the bank's real site, account holders are being tricked by the offer of training in a new "upgraded security system".

Money is then moved out of the account but this is hidden from the user.

(visit the link for the full news article)

Well every year it gets worse and worse. Two months into 2012 we are seeing it again. Criminal hacking groups are up to no good again and they are getting greedy. They are targeting peoples bank account with false higher security claims. Prolly informing the customer that their account is not secure enough then have them download somekind of software or click some link, which will give the bug or virus they need to theft the money.

The threat does not strike until the user visits particular websites.

Called a Man in the Browser (MitB) attack, the malware lives in the web browser and can get between the user and the website, altering what is seen and changing details of what is being entered.

Some versions of the MitB will change payment details and amounts and also change on-screen balances to hide its activities.

What really gets me about this whole deal, they are not aware of the theft until it's too late. Kind of scary because it will still show you have the correct balance even when the fund have been taken. Tjis could prove to be very very bad for the coroprate banks, like Wells Fargo or TCF for example. Who have large companies that bank with them.

What do we think about this ATS?

www.bbc.co.uk

Originally posted by SloAnPainful

Hackers outwit online banking identity security systems

www.bbc.co.uk

Criminal hackers have found a way round the latest generation of online banking security devices given out by banks, the BBC has learned.

After logging in to the bank's real site, account holders are being tricked by the offer of training in a new "upgraded security system".

Money is then moved out of the account but this is hidden from the user.

(visit the link for the full news article)

Thanks, SloAnPainful, for the heads-up. It's good to be alerted. I have ID theft protection, etc. and I still have nightmares about this stuff. I hate using online banking -- just for this reason. You know there are hackers who can find a way to hack into anything.

It's gotten to the point where I hate to use my cards for anything. I stopped using my debit card altogether.
Ever since I had my PayPal account hacked into, I hate online shopping.

reply to post by AuranVector


Thanks AuranVector!

Yeah I agree. In America most people do a lot of online shopping. Hackers know where and who to target. People think that these are 13 year old kinds with computer knowledge, which may be true, but they are not dumb kids. They are skilled and they can get your information even if you think you are protected. My advice, having a I.T degree, do not use free anti-virus software, pay for it. It will give you a better piece of mind.

Someone should invet a software just for banks. That is a heavy target for criminal hackers. It is easy for them to get thousands quickly, and before you and the bank is even aware of it. One second you check your balance and it's all good, the next day BOOM gone. Just a heads up, keep yourself secure.

A rule for the internet and scams. If it seems to good to be true it normally is..

-SAP-

reply to post by SloAnPainful


Lol.

Well at least all banks are insured against these problems. So you're ok, they'll refund the money stolen as soon as they can prove it was part of this particular scam.

Just more fuel for them to take away the internet though.

~Tenth

reply to post by tothetenthpower


Yeah its more of a inconvience and a hassel.

However the probelm still is that these criminal hackers are still getting paid and not getting caught. Which basically means they can up their arsenal or tech.

It is still a big headache for the people involved or corporations involved.

-SAP-

im willing to bet money that this was done to further the online censorship and not by some hackers living in their moms basements

Originally posted by SloAnPainful
My advice, having a I.T degree, do not use free anti-virus software, pay for it. It will give you a better piece of mind.

The paid antivirus programs have the same problem, they can't stop a threat until they know about it.

Want good advice? Stop the threat before the antivirus company even knows about it.

Stop letting scripts run in your browser, with rare exceptions on a whitelist of sites that you completely trust. If you do that and you're careful about not opening untrusted e-mail attachments, an anti-virus is superfluous. I know plenty of people who don't even run an anti-virus at all and never get infected, but they are all technically savvy. People who aren't probably still need to run an antivirus but if you think that paying for one means it can stop threats before they know about them, the article attached to the OP correctly indicates otherwise..

one security company did privately concede that, if this threat had come from a source not known to be bad and started communicating with a web address also not on the black-list of "bad" sites - until they had discovered and analysed it - it probably would have beaten their protection.

This is why I configure my own security. This whole idea of having a "blacklist" of "bad" sites is part of the problem.

My security assumes all sites are "bad" unless I specifically whitelist a site, and would not permit such communication. The idea of blacklisting "bad" sites is a security approach that has more holes in it than swiss cheese and this article provides a perfect example of why this is so.

reply to post by Arbitrageur


Very true and good advice. Not everyone is a computer "whizz" though and can format their own security.

-SAP-

Its rather simple people and the solution is far more simpler.


A- Pay only with cash

B- Deposits and Transaction only by a physical person. Problem solved.

It is never totally safe to use online banking I guess.
You could always have a keylogger virus and your harddrive.

Bank under VMWare Workstation with clean OS image.
Use Sandboxie
Use Keyscrambler
Use Comodo Internet Security @ max protection settings
Use WinPatrol

Don't accept any system/browser modification.

If all this is complicated, boot from Linux Live disk [Almost any distro would do, I prefer Mint] and problem solved.

I don't use any antivirus and i've never been infected by any virus. I just run a spyware remover by time to time and nothing else... when you know how to navigate, you don't get infected or get scammed on the internets.
Well, here the ways the thieves try to steal your bank account's money is still phishing and farming, and you need to be really stupid to fall on the traps of the scammers, really.