Slashdot Mirror
Hacked Chinese Bank Server Phishes for US Banks
1sockchuck writes "A Chinese bank's servers are being used in phishing attacks against U.S. institutions, apparently the first time one bank's infrastructure has been used in attacks on other banks. A hacked server from China Construction Bank Shanghai Branch is hosting pages spoofing Chase and eBay. The scam is one of numerous sites using a social engineering hook promising a $20 reward for recipients who complete a survey about the bank's online services. It then asks for your account login and password - so it can deposit the $20 in the correct account, of course. Plus your Social Security number, mother's maiden name etc."
So this is how they make all that money.
We need to bomb their Internet Center ASAP before they build another tank rush.
120 characters for a sig? That's bloody useless.
I have been hit with that Chase $20 email about 40 times this weekend. I have to wonder how stupid they think we really are....quite a bit apparently....
Dave
I find it odd, though not surprising really, that the Chinese gov't would have The Great Firewall of China in place, and have bank servers vulnerable to attack.
And, the way TFA reads, the bank server (owned by the Chinese government) is currently hosting phishing pages. Can anyone confirm whether the affected server has been taken offline, or are they just letting it go on phishing?
Web 2.0 == Giant Blogspam Circle Jerk
If Dubya needed a reason to nukify China, he has one now.
(Sorry. Couldn't resist it.)
Don't you just hate it when people reply to your signature?
China Construction is a huge bank. It's the Chinese eqivilent of Chase or something similar in size. Not the People's Bank of China (Chinese Central Bank) but still huge. I'm amazed that their security is so lax. That level of incompetence is just amazing.
Hoist Number One and Number Six.
The number of "computer literate" people on the Internet vs. "mom and pop" Interweb users who don't know any better, is actually very small. There is a good chance that a fair number in the small single digit percentages (or even smaller) respond to this type of stuff. Remember, it's like with penis pills, when you spam millions and millions, you only need a small percentage.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
When you allow only legal information, most people will not even know what is possible aside of what is permitted.
And if those people are responsible for security... think Demolition Man, just on an IT-scale.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
...to netblock APNIC space at your firewall. I'm not happy I need to do it, and I wish it wasn't necessary. This continuing saga is only going to accelerate the growing trend to have the great wall not being an internal firewall, but an external one built over time by individual admins tired of these problems.
I have to wonder whether there is a deliberate strategy by the chinese government to encourage the world to cut off access to western sites. Allow every kind of malware, be entirely unresponsive to abuse requests, and wait for the west to defensively wall China off so the chinese government won't have to do it themselves. Pretty stupid strategy long-term, though, so I can't believe it's deliberate.
is the great (fire)wall of China?
They called me mad, and I called them mad, and damn them, they outvoted me. -Nathaniel Lee
What do you mean "how stupid they think we really are"? It should be how stupid they _KNOW_ we are. You forget the average American, the target audience here, is a bunch of mouth breathing, knuckle-dragging morons. Really. Where do you think they get the people who work the crap shifts at McD's from? Think there are more of them then there are of you?
:)
Now, if you have net access, you are in the top 1/3 or so of the US intelligencia. Went to college? More like the top 10%. Active and aware of the political and technical aspects of issues like this? Lop off a few more points.
What gets me is how they phishing/spam/whatnot fails so often, not why they think we will fall for it.
The overarching point is that you surround yourself with people of like intelligence, and everyone posting here is WAY above average. You forget how rock stupid average is. Go get a refresher course, go into a bar in a rural area and discuss anything you would with your social circle.
Better yet, go watch a NASCAR race, and don't skip the commercials.
-Charlie
I worked for a non-consumer bank as a consultant a few years back, and I was rather concerned with what I saw there.
The IS Coordination was rabidly anti-Microsoft. The network was mostly windows 98/NT machines on Banyon Vines 3.0 (this was in 2001, right about the time Novel released Banyon 6 I believe) with a handful of Unix based servers.
To prevent possible security breaches, none of the machines had access to the internet except for a few special machines. Those machiens where not suppose to have access to the internet and the intranet at the same time. What actually happened was that those employees with "one or the other" access figured out they could just leave both cables plugged in and no one would know.
Towards the end of my contract, relations where breaking down. The IS Coordination was accusing me of purposely introducing bugs to inflate my hours, and I was accusing her of blatant incompetence. The bug that she had been accusing me of creating happened only on the normal staff's PC. My laptop, and her brand new PC worked fine. Turns out that not only were they using an out dated version of Vines (v3 -> v6) they had also not patched it on any of the worker machines (They were on v3.0, and at that time v3 was patched to v3.3). Her machine and my laptop had been fully patched. The problem wound up being one of the dated libraries included in Vines 3.0.
Unregulated internet access + outdated and compromised network system + a high volume of multi-million dollar transactions = receipt for disaster.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
With the potential for the Chinese (or whoever's puppeting that server) to gain a lot of money from dumb people this way..
What is the limit before the government does something about it? I mean we could do it any number of ways. Covertly..overtly..fast..slow..with a side of fries..whatever you want.
Whats it going to take to make us drop a server like an armed drunk charging an officer?
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
And we know this is hacked..how? Maybe they did it on purpose? When did the chinese government and upper management decide to be nice to other people? Everything else they do is to profit themselves, like sucking in free R&D and cash investments into their economy. Where have they ever respected any sort of foreigners property rights, intellectual or otherwise? Where have they ever told the truth on anything important upfront? When did they stop being a one party dictatorship? When did the PLA stop being the true owner for most of their so called "civilian corporations"?