Banks Urge Businesses To Lock Down Online Banking

tsu doh nimh writes "Organized cyber-gangs in Eastern Europe are increasingly preying on small and mid-size companies in the US, setting off a multimillion-dollar online crime wave that has begun to worry the nation's largest financial institutions, The Washington Post's Security Fix blog reports: '"In the past six months, financial institutions, security companies, the media and law enforcement agencies are all reporting a significant increase in funds transfer fraud involving the exploitation of valid banking credentials belonging to small and medium sized businesses," reads a confidential alert issued by the Financial Services Information Sharing and Analysis Center, an industry group created to share data about critical threats to the financial sector.' The banking group is urging that commercial bank customers 'carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible.' The story includes interviews with several victim businesses, and explains that in each case, the fraudsters — thought to reside in Eastern Europe — are using "'money mules,' unwitting or willing accomplices in the US hired via Internet job boards. The blog has more stories and details about these crimes."

Comments

...and how would you do that?

[sicapo]

'carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible. When almost all online banking is done through Web Sites...

Re:...and how would you do that?

[Anonymous Coward]

live cd

Re:...and how would you do that?

[ScytheBlade1]

By locking down everything *but* that site?

Emphasis web *browsing* - if you're locked to a subset of one site, you can't do a whole lot of browsing. The browser effectively turns into a sandboxed application, which is what the banks here want.

English is a wonderful language.

Re:...and how would you do that?

[thatkid_2002]

Businesses do not use the web browser - they have special programs. These programs allow for multiple authorized people to sign off on a payment before it can be processed and it allows for quick and easy access to statements relating to hundreds of different accounts. One such software is NAB Online.

Unfortunately in the case of NAB online, you have to connect to the bank by using a Dial-up modem. Kaspersky Antivirus (and Norton from what I heard) both refuse to play nice with the dial-up executable for NAB Online.

The hardest part of locking down a business is actually trying to stop the biological mass between the keyboard and the chair from doing stupid things.

I am a Linux server admin, and I spend 90% of my time trying to troubleshoot and lock down all this Windows related junk!

Re:...and how would you do that?

[JWSmythe]

    Ya, I caught that too. Get on a computer that can't browse to web sites, and then browse to http://mybank.example.com/ . Brilliant advice.

    Since 99.99[ad nauseum]% of the users wouldn't know a hardened secure computer (I'm pretty sure Windows is categorically eliminated), I'm not sure who they were suggesting that to. I have the only Linux virus I've ever seen, and it's safely tucked away on a floppy disk, in a concrete vault, underground, at a location that I forgot. :) Dammit, I knew I shouldn't have left the map in the vault. Most "bank customers" wouldn't keep a dedicated machine just to check their bank balance with. Hell, they'll call out on the company PBX and give their credit card information over the phone to any arbitrary business, with coworkers happily writing it down and the phone admin recording the call.

    Users are their own worst enemy. Hmm, wasn't there a story today saying something to that effect? I once found a bank card (w/ Visa logo) on top of an ATM. For some reason, they set it down and forgot it there. Brilliant. Since there was no one around to claim it, I called the bank. It took me an hour to convince them that I found it and that the card should be canceled. They "couldn't release any information on the card holder until...." I told them, "I'm holding the card in my hand. I guess that makes me the card holder." Finally, they told me "Oh, just bring it to a branch on Monday", at which point they finally canceled it. I knew the people at the branch, so they knew I was legitimate, and they confirmed that it hadn't been canceled. The account hadn't even been noted that I called in to report it. What if I wasn't a nice guy? I would have had 2 days or more to charge anything I wanted. If you can't get a person to maintain control over a little physical piece of plastic, why should you they think that they're going to do any better elsewhere?

Re:...and how would you do that?

[ArcherB]

Businesses do not use the web browser

Yes they do. OK, big businesses may have apps that dial into big banks, but small businesses use local banks and local banks can not afford a custom written proprietary app that they give to their business customers. The vast majority of small businesses that use local banks do most of their banking through a web browser. I've seen businesses to payroll, wires, ACH payments, transfers, you name it, all through a common web browser.

However, most of these systems are cookie limited to a single computer per login and Mulit-Factor challenged if the IP changes. The biggest problem we've seen have been phishing scams looking for credentials of non-business accounts. Although these sites are usually shut down within hours of the bank finding out what is up.

Re:...and how would you do that?

[xeoron]

Maybe the banks should release browser extensions that turn on bank lock down mode via the press of a button. Or, people can merely run a locked down VM instance of a OS/browser combo that is solely used for banking; going ever further, someone should package a slim VM just for that purpose and share it with all to use (maybe a version of gOS with Google Chrome or freeBSD with Firefox, or use that Kiosk SuSE linux builder app....). Hrm... think I might have to play with those things this weekend....

Re:...and how would you do that?

[JWSmythe]

    That's an exception, not a rule.

    I know back in the day, there were more interesting methods of security, just as you mentioned. They may need to use a special app, dial up or have a leased line, and then do the transactions directly. I can't say that I've seen that in years with any small or medium size business. I personally hold a business account at a large bank. My choices for interfacing with them are to show up at the teller, go to the web site, or call the CS department who will run me around for 30+ minutes confirming my identity before I get anything resembling an answer that is usually wrong.

    Well, there's another option, the CC POS terminal. But I don't have one. :) That doesn't give your balance or transaction history anyways.

    I'm not terribly concerned about *my* business account. It has $4.68 in it, and that's been like that for 6 months. Good luck if you get my account info, you'll have wasted your time. :)

Re:...and how would you do that?

[maxume]

To be worth much, you have to do all your risky activity inside of a VM. Running a 'safe' VM on top of a compromised system is only going to buy a little bit of protection.

Re:...and how would you do that?

[hedwards]

While it would be both foolhardy and a gross exaggeration to say that it doesn't generally matter a whole lot about the client side, most of the time that kind of operation is just not cost effective. More cost effective is phishing or compromising the server side stuff. Dumpster diving for insecure records is also a convenient way of doing it all too often.

Re:...and how would you do that?

[Runaway1956]

Could we at least start by replacing the freaking pin numbers with something meaningful? A four digit numeric does NOT make a password FFS!!

Maybe next, we could graduate the bank's computers from Windows 2000 up to something remotely sane - like Redhat SEL.

The idea of a biometric ID in conjuntion with a reasonably secure password hash has it's appeal, as well. If my bank would use it, I'd install a fingerprint reader on my HOME computer. Businesses should just jump on that idea - it's a small price to increase security dramatically.

Finally, maybe we can get around to "Linux - the year of the desktop!" Face it, boys and fanbois - no unix-like machine is open to as many exploits as Windows is.

I'm just dreaming, of course. If I manage to live another 20 years, we'll still be having similar discussions, PIN numbers will still be 4 digit numerics, and Windows XP will be the ancient, outdated operating system of choice for banks.

Re:...and how would you do that?

[markdavis]

>Businesses do not use the web browser - they have special programs.

Sorry, but that is just wrong. Our business is not exactly small (400+ employees). We use https web to transfer our direct deposit to the bank, to download statements, to perform money transfers, to do just about everything. And we are not at all atypical.

Of course, it is all done in Firefox under Linux... and THAT part *is* atypical.

Many of us fought for years trying to get the banks to stop using crappy MS-Windows-only proprietary code and stupid IE-only junk. I would hate to see that all slip away because of MS-Windows malware.

Re:...and how would you do that?

[eric31415927]

My dream:

A bank could dole out thumb drives to its customers, which thumb drives could boot up into an O/S [hopefully not within a VM] that only allows Internet access to the bank's website. Passwords could change every minute with use of a RSA key chain (eTrade facilitates minute-by-minute password changing).

It would be nice if the thumb drives were read only; perhaps some sort of dongle might work.

This would make me feel more secure in my online bank transactions.

Re:...and how would you do that?

[Jurily]

The browser effectively turns into a sandboxed application, which is what the banks here want.

Why not just make a separate application? You're trying to force a browser to be essentially different than what it was designed to be, and then you're complaining that it's not really working.

I know cross-platform availability is great, but you can also do that with say Qt. Not to mention you'd have your own nicely designed UI instead of the clunky pile of shit most banks today do, without inheriting the security problems of every fucking browser out there. One would think that because this is an absolutely critical task in terms of security, banks would at least try to minimize the amount of code involved, or at least the amount of code they have no fucking control over whatsoever.

I know Web 2.0 is hyped right now, but stop acting like the browser is the only application capable of establishing a network connection. As a famous cat put it: THIS IS WHY WE CAN'T HAVE NICE THINGS.

Re:...and how would you do that?

[maxume]

Malware doesn't care about the difference between you typing in a password and swiping your thumb on a fingerprint scanner.

And really, we will be stuck with PINs until banks decide that the costs of moving to something more secure are smaller than eating the costs of fraud (if you are talking about U.S. atm transactions, the bank usually eats those losses; I'm not sure how various PIN payment schemes around the globe shake out).

Re:...and how would you do that?

[Falconhell]

Users are their own worst enemy

Quite so. I dont know where I read it but the quote below sums it up nicely.

The average user wouldn't know a security issue if it was parading down the main street naked carrying a large sign saying "I am a security issue"

Re:...and how would you do that?

[berzerke]

Nice ideas, but there are flaws so big you could drive an 18 wheeler through them.

Could we at least start by replacing the freaking pin numbers with something meaningful? A four digit numeric does NOT make a password FFS!!

Remember the user. If we make the password/pin to big, it will be hard to remember for a major segment of the users. What happens then is it gets written down, and from my experience, more than few will just write down on the card itself. This makes everyone less secure, as thieves will realize this rather quickly and start stealing the cards, by force if necessary. And they won't stop to check first if your card has your pin number written on it or not.

Maybe next, we could graduate the bank's computers from Windows 2000 up to something remotely sane - like Redhat SEL.

While I certainly think this is a great idea, it solves very little. The problem is the end user's computer is getting compromised, not the banks' computers, at least as far as the article is concerned. (Yes, I know about Heartland.) Now, the banks could definitely improve transaction security...

The idea of a biometric ID in conjuntion with a reasonably secure password hash has it's appeal, as well. If my bank would use it, I'd install a fingerprint reader on my HOME computer. Businesses should just jump on that idea - it's a small price to increase security dramatically.

Fingerprint readers have been beaten many times already. I won't list all the ways and times, but I will give a link to one such story. But let's say you can magically make a cheap fingerprint reader that is totally unbeatable. Guess what? At some point, the fingerprint reader has to convert the fingerprint into electronic data and transmit that. I doubt it will take the bad guys very long to target this link in the security chain.

...no unix-like machine is open to as many exploits as Windows is...

That should read no properly configured unix-like machine is open to as many exploits as a fully patched, properly configured Windows is. Remember that many, perhaps even a majority, of the exploits take advantage of already patched holes.

Re:...and how would you do that?

[Shakrai]

This would make me feel more secure in my online bank transactions.

Or you could just secure your computer and put the tin-foil hat away. Just an idea. I've been using online banking in one form or another for 12 years from my regular old PC and I've yet to encounter a problem. Of course I don't generally agree to install the "ANTI-VIRUS SOFTWARE UPDATE ACTIVEX APPLICATION V 6.5.19.1.61" that pops up while I'm surfing for porn or warez ;)

Re:...and how would you do that?

[timmarhy]

it's not hard to lock down banking, it's called one time passwords/cc numbers. we pay more then enough in banking fee's that the banks can afford to issue us a FREE token that produces a unquie password that is synced with the bank's systems. it's only good for one use and must be used with a traditional 6 pin access you remmeber.

Re:...and how would you do that?

[Anonymous Coward]

If you only get three tries at guessing the PIN before the card is put on hold, a 4-digit PIN is good enough.

Go look through Schneier's site - he'll tell you the same thing.

Re:...and how would you do that?

[mlts]

To be decently secure, it would require a low level hypervisor that is hardened from compromise so a VM cannot get access to the hypervisor's settings, or affect other VMs on the system. This functionality would have to be on the BIOS level.

Re:...and how would you do that?

[grcumb]

The idea of a biometric ID in conjuntion with a reasonably secure password hash has it's appeal, as well. If my bank would use it, I'd install a fingerprint reader on my HOME computer. Businesses should just jump on that idea - it's a small price to increase security dramatically.

Biometrics are only appealing in environments where human life has value. I can assure you that the day banks in Johannesburg or Manila start requiring fingerprints for authentication, there are going to be a lot more fingerless victims of crime than there were the day before.

Re:...and how would you do that?

[Zontar The Mindless]

Any online banking transaction for me requires:

*My 10-digit personal number ("personnummer" = Swedish equivalent of SSN)

*My 4-digit PIN (assigned by bank when card is issued, not changeable by user)

*6-digit authorisation key from bank's website, good for 4 minutes from time of issue (I have 4 minutes to enter it into the card reader)

*My bank card

*Card reader (fits in a shirt pocket; first one provided gratis by bank, replacement unit is SEK 100 or about US$12.00)

*9-digit response code generated by card reader, good for 4 minutes from time of issue (I have 4 minutes to enter this on the web page and click the Submit button)

All of these are required for login, requesting transaction, and finalising/authorising transaction. Any one of the pieces missing = no transaction.

This combination seems pretty secure, and it is actually quite quick and easy to use.

Re:...and how would you do that?

[noidentity]

I once found a bank card (w/ Visa logo) on top of an ATM. For some reason, they set it down and forgot it there. Brilliant.

Yeah, because people never make mistakes. BTW, I found a VISA card recently at a bus stop. It only took a few minutes to call the toll-free number on the back, enter the card number, and talk to someone to have it invalidated. I did have to figure out to choose an option that asked for the card number, as they didn't have any way to talk to a human to report a found card.

Re:...and how would you do that?

[jonbryce]

Fingerprint readers are much worse than passwords IMO, as you can't change them easily, and they aren't secret. A fingerprint scan from an untrusted location just tells the bank that someone has seen your fingerprints. It doesn't mean that your finger is present at the time.

Also, there are stories of people chopping off fingers to use in applications like these.

Re:...and how would you do that?

[muckracer]

> The browser effectively turns into a sandboxed application, which is what
> the banks here want.

Regardless of the wishes of those greedy fucks, a browser and each site should
be sand-boxed in the first place. Viewing one site should have no relevance to
the tab beside it, even less for your user files and most certainly not your
system files.

Re:...and how would you do that?

[jimicus]

If the computer being used is compromised, it follows you can't trust anything on it. You certainly can't trust that "lock down mode" is as locked down as you'd like.

Re:...and how would you do that?

[jimicus]

Since 99.99[ad nauseum]% of the users wouldn't know a hardened secure computer (I'm pretty sure Windows is categorically eliminated)

Not true, actually. You most certainly can lock down Windows fairly heavily - in fact, Microsoft provide a tool to help you do it.

Though to be perfectly honest I'd still stick the computer in it's own little /29 subnet with a firewall blocking all traffic in both directions except that which is explicitly allowed.

Re:...and how would you do that?

[Dan541]

It is pointless to secure a system that is to be used by idiots.

A Default installation of XP or Vista is the most secure system in the world for an average user any security beyond that is invalidated by their stupidity. What they need are competent employees then these issues wouldn't exist.

Re:...and how would you do that?

[Apollo_11]

'carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible. When almost all online banking is done through Web Sites...

Financial Services Information Sharing and Analysis Center, an industry group created to share data about critical threats to the financial sector. Sent out a confidential alert - hmmmm ? thanks

Re:...and how would you do that?

[Anonymous Coward]

And then you can't get any antivirus or Microsoft updates because they all use Akamai load balancers so the address could be any one of thousands.

Re:...and how would you do that?

[Jedi Alec]

My dream:

A bank could dole out thumb drives to its customers, which thumb drives could boot up into an O/S [hopefully not within a VM] that only allows Internet access to the bank's website. Passwords could change every minute with use of a RSA key chain (eTrade facilitates minute-by-minute password changing).

It would be nice if the thumb drives were read only; perhaps some sort of dongle might work.

This would make me feel more secure in my online bank transactions.

Or they banks give out small card readers that the online shopper sticks their bank pass into, types in his pin and a one time code to yield a one-time key to confirm the transaction.

Wait....we've already got that! In some places anyway.

Re:...and how would you do that?

[networkconsultant]

http://en.wikipedia.org/wiki/Morris_worm It's been exploited enough already :D

Re:...and how would you do that?

[Runaway1956]

Somehow, I miss your point. You're suggesting that because the first malware ever written was targeted at Unix, somehow *nix machines are untrustworthy today? If that is your claim, then you are ignoring overwhelming evidence that *nix is pretty secure, and that MS systems are terribly insecure.

Tell me that I'm misunderstanding you. Tell me that you're not a Microsoft shill.

Re:...and how would you do that?

[lysergic.acid]

So instead of using a perfectly good internet communication protocol (https in this case) and GUI rendering system, you want each bank to develop their own proprietary solutions just so they can have complete control over all of the code involved? What about the OS? Should I be running Wells Fargo OS 3.1 on my banking computer?

I know it's trendy to talk about how the web isn't designed for e-commerce or security (or how hyped Web 2.0 is), but the web today isn't the same as the web of 2 decades ago. DNS wasn't designed with security in mind either, so are you going to start suggesting that everyone memorizes their bank's IP address now?

Also, this idea that if a piece of code is written in-house that it's suddenly more secure than code written by thousands of people and tested by millions is quite ill-founded. If you run a decent browser like Firefox, keep it up to date, and don't install a bunch of random extensions, and follow good security practices, then you really aren't at much risk of falling victim to cyber-crime.

OTOH, if you're running random executables you receive by e-mail, fall for obvious phishing attacks, or otherwise conduct banking on a public computer, then it really doesn't matter what client application you use to connect to your bank's servers. The most secure banking application in the world won't protect you from social engineering or even a simple keylogger. There is a problem with the way internet banking is conducted today, but you're not going to find the solution in some piece of software.

Re:...and how would you do that?

[vertinox]

Regardless of the wishes of those greedy fucks, a browser and each site should
be sand-boxed in the first place.

Hear! Hear!

I surf the internet to look at websites, not to have those websites modify my OS!

Re:...and how would you do that?

[Hurricane78]

Banking trough the browser is just as stupid as e-mailing, watching videos, chatting, etc. (Ok, there are exceptions, like when you're not at home. but you wouldn't do banking there anyway.)
There are specialized protocols that are much much better at it.

For banking, that would be FinTS. I'm using its predecessor HBCI for nearly a decade now. Including the usage of a class 2 card reader with card.

I am really happy with it. There are nice programs for it, like GnuCash or KMyMoney, and all professional programs support it. No need to use the browser for it.

Re:...and how would you do that?

[bloobamator]

+1. 3-factor auth is the only reasonable solution.

Re:...and how would you do that?

[AWittenstein]

Biometric IDs and better PIN numbers wouldn't help here. The malware the banks are warning about is installed on your computer, waits until you've logged into to the banking site, and then makes additional transactions from your browser on your computer.

Re:...and how would you do that?

[Ironica]

As a famous cat put it: THIS IS WHY WE CAN'T HAVE NICE THINGS.

I'm pretty sure it was Satchel's owner who said that...

Re:...and how would you do that?

[Anonymous Coward]

This should be an opportunity for Firefox to create branded browsers that only connect to a bank's website and accept only the bank's certificate (and nothing else).

Re:...and how would you do that?

[RockDoctor]

Or they banks give out small card readers that the online shopper sticks their bank pass into, types in his pin and a one time code to yield a one-time key to confirm the transaction.
Wait....we've already got that! In some places anyway.

Indeed - the card reader from my bank-for-online-things (the UK's CoOperative Bank http://co-operativebank.co.uk/ ) is sitting under the table here.
Had it 3 months now ; still not had a reason to use it.

Re:...and how would you do that?

[dave87656]

Of course, it is all done in Firefox under Linux... and THAT part *is* atypical.

I try to do all of my banking transactions using my linux box. It's just safer. I know the Windows appologists are gonna attack me for that, but it just is. My Vista laptop, which I use alot less, has already been infected by a key logger and I don't do much on it. It just showed up one day.

Re:...and how would you do that?

[markdavis]

Why not put Linux on your laptop then? You should be able to run Vista in VirtualBox, if you really need it. I am shocked at how quickly VirtualBox became mature, how high-quality it is, how many features it has, and how often it is updated.

Getting the money back? WTF?

[dnaumov]

The article talks about the victims actually intending to sue their banks to get their money back. WTF? Since when it the bank responcible for the lax security on the customer's side?

Re:Getting the money back? WTF?

[jumpingfred]

It is also lax security on the banks side. The bank is not properly verifying that the transactions really come from the businesses. It is much like identity theft. The person didn't steal my identity they got around the bank or credit card companies poor security to trick the bank. They took nothing from me they tricked the bank into giving them my money.

Re:Getting the money back? WTF?

[fuzzyfuzzyfungus]

Probably depends on the strength of the bank's verification system. If I leave my front door open, and somebody walks in and steals my ID, I'm guilty of being lax. If the bank accepts my stolen ID, from a guy who looks completely different than I do, they are guilty of being lax, even though my laxness precipitated the incident.

In the online banking case, for instance, any bank that doesn't red-flag an situation where simultaneous online sessions on the same account are going on from an IP near the customer's address and an IP somewhere in Latvia is, arguably, negligently overlooking a likely fraud situation, even if it was malware on my machine that let the Latvian session be established.

Re:Getting the money back? WTF?

[AnyoneEB]

I agree that suing the banks seems like a strange reaction, but this type of attack only works because the banks simply do not care about security. On previous articles I have seen posters mention their banks (somewhere in Europe) have papers which have a list of single-use transaction codes which are used in some sort of challenge-response system. For example, choosing a code based on the transaction date, target, amount, and some randomness would protect against attacks like the one described where a compromised computer is used to drain a bank account.

The client should have better security -- after all, even seeing the bank account info would likely be interesting to some attackers -- but the banks need to be held accountable for their lack of security features as well.

Re:Getting the money back? WTF?

[Anonymous Coward]

It is also lax security on the banks side. The bank is not properly verifying that the transactions really come from the businesses. It is much like identity theft. The person didn't steal my identity they got around the bank or credit card companies poor security to trick the bank. They took nothing from me they tricked the bank into giving them my money.

Wrong. Reread the article. The article clearly states that the attackers are using man in the middle attacks on the customers PC's. From experience, I have worked cases where ACH fraud has occurred on client machines. It is the banks discretion as to whether the client is reimbursed. It has NOTHING to do with patterns or usage of an account if the client and institution fell victim to a race attack when two factor was being used.
 

Re:Getting the money back? WTF?

[Anonymous Coward]

I agree that suing the banks seems like a strange reaction, but this type of attack only works because the banks simply do not care about security. On previous articles I have seen posters mention their banks (somewhere in Europe) have papers which have a list of single-use transaction codes which are used in some sort of challenge-response system. For example, choosing a code based on the transaction date, target, amount, and some randomness would protect against attacks like the one described where a compromised computer is used to drain a bank account.

The client should have better security -- after all, even seeing the bank account info would likely be interesting to some attackers -- but the banks need to be held accountable for their lack of security features as well.

Amazing. Dont you fucking people READ THE ARTICLE?? These attacks ARE CLIENT SIDE. NOT on the BANKS directly.

There is new malware that sends an IM to the bad guy and the malware redirects the web client to a 404 or some other page to distract. While this happens, the bad guy drains the account. Its a race condition. The client logs in, sometimes with two factor. How is that the banks problem?

Re:Getting the money back? WTF?

[Anonymous Coward]

The bank I use requires a single-use code to login and a different code to accept a payment.

Even if the malware redirects the user after logging in, without the correct payment code the attacker cannot drain the account. Assuming the second code is dependent on the target account and the payment amount, the attacker cannot even hijack a single payment - unless they manage to find out enough of the payment codes beforehand.

Re:Getting the money back? WTF?

[Prof.Phreak]

Heh? Ignoring what security you have on your computer, if one day you log into your bank and find the money missing... it's the bank's fault it's gone.

Re:Getting the money back? WTF?

[sjames]

Several actually secure systems have been available since the '80s that would appropriately and irrefutably authenticate transactions. Those systems wouldn't depend on anything so insecure as a windows system. The banking industry has studiously avoided all of them and in some cases gone to great lengths to kill them off, presumably to preserve their excuse to make piles of cash through float.

They also could issue SecureID systems to their customers that would be invulnerable to a hacked windows system (by the time they log the SecureID number, it's already invalid). but they don't. They float every transaction, supposedly so it can be verified, but then they don't verify, they just pocket the interest on the float.

They (supposedly the experts on all things financial) tell their customers the system is perfectly safe but it isn't.

Any reasonable bank would consider a rapid fire series of largish transfers adding up to the customer's entire balance to be a likely problem and CALL the customer before completing them. They didn't even consider it.

Instead, when the customer complains about a problem, they jam their fingers in their ears saying "Not our problem! I can't hear you, LA LA LA LA!".

That would be why the customers intend to sue them.

ubuntu

[wizardforce]

why cripple the machine just because of some malware?

Re:ubuntu

[wizardforce]

to whomever modded my post "flamebait" there is absolutely no reason why these companies can't use ubuntu to avoid malware. I didnt mean anything other than that poor choice of words and all...

USA Stimulus Package Payback Plan

[fibrewire]

And you all thought that Obama was just having the US Mint print more money? That China would buy all of our debt and take over the US without firing a single shot? HA! Just wait until big businesses in China are bankrupted by cyberterrorism. And you thought that new US Air Force division was just for our defense? Tell that to our new Cybertron... er... Cyber Command. And Obama is really MEGATRON. Hail Decepticons!
- WTF?

Re:USA Stimulus Package Payback Plan

[Anonymous Coward]

-1 inaccurate. everyone knows Obama is an autobot.

Re:USA Stimulus Package Payback Plan

[Runaway1956]

"wait until big businesses in China are bankrupted by cyberterrorism"

Maybe they've just thawed you out after a nice cryogenic nap? China is migrating to Linux. Red Flag Linux. They may not be invulnerable to cyberterrorism, but they certainly don't leave their WINDOWS OPEN for terrorists, like US businesses do.

Sounds like they should hand out liveCDs

[fuzzyfuzzyfungus]

It wouldn't be rocket surgery, or especially onerous in cost/seat terms, for major financial institutions to hack together and press a bunch of "Banking liveCDs".

No writable persistent storage, just a browser(configured so that it will only accept pages from the institution's set of domains and only when those pages have appropriate SSL certs. Completely reject all non-SSL pages, and any SSLed pages with certs for other institutions, or from other CAs).

There would probably be some annoying edge cases(some ghastly graphics card that isn't supported by default, and freaks out in VESA mode, say) or network issues(though you could always offer a cheap USB ethernet or wifi adapter, with a known working chipset, at cost to interested customers); but it'd be fairly easy to cover 95% of the boring business boxes and common home machines that you would be concerned about, if suitably generic settings were used.

As hardware gets cheaper and/or for larger accounts, it might even make sense to put together a dedicated banking appliance offering, basically the cheapo embedded ARM embodiment of the above.

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

How about just using SSL for the login page? Most of them don't--it's hidden in an iframe, and without viewing source or checking the form, you've got no reason to be certain your login data will be securely transferred. And don't get me started on *every single bank* I've used having XSS vulnerabilities -- to top it off, most of the the little ones outsource all of their financing/credit card transactions to third party companies--just to pay the damned balance on my visa, I have to allow javascript from four different domains.

Most every bank trying to comply with increased security requirements met the rules for two factor authentication by SAVING A FUCKING COOKIE on my drive (I wish congress would pass an additional law mandating strict liability in event of security breach for any institution that circumvented the intent of that rule in such a manner)

If I purge the cookies, they have me authenticate with MORE "passwords" (two passwords is two-factor, right? So if we ask for three we can claim we have 5-factor authentication) including such tidbits as my first school or grandfather's name. Surely I'd never reveal those in conversation to anyone. How about they spend $20 or give me the option to pay it myself to buy a dongle with a rotating pin?

I think you're going way too far too fast... a lot of the problems is on the customer side (and that's almost every programmers fault for requiring things like javascript/cookies and using them in excess) when a lot of the issues stem from...lax, lazy attitudes--but the banks are just as guilty. I guess you can say it's best to start with the weakest link in the chain--but the whole system is in need of overhaul and a few rolled heads.

Sorry to rant in reply--you're right that livecds would help...but the whole system is so screwed up that shipping them would be like putting a bandaid on a corpse.

Re:Sounds like they should hand out liveCDs

[JWSmythe]

    But, that's the type of technical support headache that they've been trying to get away from, with virtual POS terminals, using the web page instead of their custom app, etc, etc. Even if your live CD worked on every machine ever known to man, when something flakes out, they're calling the bank first. Come on, how many times have you fixed a "my computer can't get on the Internet" because they accidentally unplugged the network cable? Or maybe they didn't even turn it on. Anyone who's worked in any kind of office where the management found out that you really now everything about computers, will bug the shit out of you to fix theirs (and their home machine, and the kids machine, and grand auntie Gertrude's machine too, even though she's legally blind and can't figure out what to do with a mouse).

    I've spent the last month or two touring the country, going from site to site on demand to fix everything. You wouldn't believe how many "best practices" have been completely ignored. Even when you say "there was malware that intercepted everything done online. They have all of your usernames and passwords, credit card numbers, and account numbers. Call the bank and cancel every credit card you've used online, and change every password that you have", they say they'll get around to it sometime and won't actually do it.

    I got a call today. It was a machine that I worked on two months ago, where I removed more viruses than I care to remember. Someone uninstalled the antivirus software that I installed, but they were kind enough to click through every way to get a new virus. 3 hours later it's clean again. I'll be getting the same call in a month.

    Your edge cases aren't edge cases. I'm afraid they'd be pretty damned close to 50%. The first banks that tried to force it would go out of business, because the customers would go to another bank that's "easier to work with".

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

Problem with a Live CD is that it can't be kept up to date. Linux has lots of vulnerabilities too. Just recently there was a big kernel bug exposed and the software you run on Linux (Firefox, etc) always has bugs too. Currently they don't seem to be targeted too often but if banks started handing out these "secure" Live CD's you can bet they would be targeted then. Because it's a Live CD the bugs would probably persist for long periods of time.

As the posted above me makes a good point. I hate that websites in general, especially banks, have non-SSL pages that you use to log into the secure SSL site. That is an extremely poor design because it then becomes super easy for a hacker to create a fake login page.

Re:Sounds like they should hand out liveCDs

[Statecraftsman]

I like this idea but instead of livecd, make it an encrypted bootable usb key. Then it can be updated, encrypted, signed and gnu/linux based. The password at boot? Just another pin.

Re:Sounds like they should hand out liveCDs

[fuzzyfuzzyfungus]

True enough. Particularly brilliant is the concept of "identity theft". Since it's your identity, they stole it from you, figure it out yourself, sorry. If it were bank fraud, than it would be there problem.

Re:Sounds like they should hand out liveCDs

[antic]

In the US, do you have a system where any bank transfers to a new (previously unused) external account must be approved by a time-limited PIN that is sent to you by SMS? Both banks that I use provide this by default.

Re:Sounds like they should hand out liveCDs

[Microlith]

Hot damn!

Want to check your bank balance? Reboot!

Pay your installment loan? Reboot!

Import your information into Gnucash or Quicken? Oh sorry, no can do!

Awesome, total security at the cost of total and complete inconvenience.

Re:Sounds like they should hand out liveCDs

[Spit]

Scammers are getting around that by hijacking your phone number. Probably the best I've seen is using a challenge-response for all transactions, with a frob supplied by the bank.

Re:Sounds like they should hand out liveCDs

[rho]

Sounds to me like a valid reason to run OpenBSD.

Or maybe all those fucking banks can make Web sites that don't recommend (or require) Internet Explorer.

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

Great, you've now made it easier than ever. Criminals just start mailing out their own custom banking CDs, and all your transactions go through them. No worrying about finding vulnerabilities or fighting security patches or anything.

Re:Sounds like they should hand out liveCDs

[palegray.net]

It doesn't matter if these LiveCDs are kept up to date. They won't be hosting any network services, so there's nothing to exploit there. The browser can only go to the bank's website, and will only accept SSL pages. Unless the bank's web servers are compromised and attackers somehow managed to insert code designed to exploit a particular browser vulnerability, there's nothing to exploit there either. Note that that last scenario isn't impossible, but hugely improbable. One could just as easily argue that a hardware keystroke logger could be installed on the local machine. Not likely; if someone cares enough to go that far to get your data, they're gonna get it regardless.

In other words, this is about a million times more secure than using any given general purpose desktop computer to do your banking.

Re:Sounds like they should hand out liveCDs

[fuzzyfuzzyfungus]

I'd hope(he says with a sheeplike look...) that businesses who have been getting things like account statements, new checkbooks, credit/debit cards, cashier's checks, cash, and the like into people's hands for decades now might manage to distribute these things more or less safely, even if it meant requiring that you visit a branch.

Re:Sounds like they should hand out liveCDs

[palegray.net]

Navy Federal Credit Union sends the PIN in the mail to the "sending" account holder's mailbox, and it must be entered within 30 days or the request is nullified.

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

You can hope, but I bet the first time users receive an "updated, more secure" banking cd in the mail, a fair number will start using it. Just like phishers don't intercept and rewrite legitimate emails from paypal, they just send their own that look like paypal emails. Although, the distribution system could also provide some new vulnerabilities...

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

That's extremely naive to think that just because they aren't hosting network services, they are not vulnerable. Trust me, when money is involved they will go that far to get your data.

The article mentions $400k and $100k as some examples of the amount of money taken. Criminals will go to extreme lengths to get that kind of money. They may not bother with hardware keyloggers (at least not commonly) because that actually is a lot of effort for the amount of physical risk, but they could target an ISP or somehow insert themselves on the network so they could sit between the users and the remote network resources they are accessing (thereby allowing them to insert malcious code, insert code to hack your machine, just hack your machine directly, or whatever they need). This would give them easy access to many users at the same time and would be worth the risk because of the payoff.

Re:Sounds like they should hand out liveCDs

[Runaway1956]

Convenience above all else, yes!! /sarcasm

In the case of business, it isn't SUPPOSED to be convenient. It's someone's JOB to take the time to be right.

In the case of private individuals - if you can't take time to be secure, don't whine to me about someone ripping you off.

Besides which, you're exaggerating beyond anything that's reasonable. A business can afford to use a dedicated machine for banking. Plug that LiveCD in, and there's NEVER a reason to reboot. At home? Maybe you don't have an extra machine - but you most likely are able to fire up a VM to run the special operating system from.

Oh, wait - I can run a VM. Nothing says that you or the average Windows computer is able to do so. Half of America can't even spell VM.

Re:Sounds like they should hand out liveCDs

[markdavis]

Some of us don't want to have to reboot our computer just to access a bank "website". And we are to just trust that this live-whatever they make doesn't install something persistent on our computers or read data off the drives?

And each bank or "important" site would have their own pseudo-proprietary bootable image? So I have to reboot again with something else to access my retirement funds site? Reboot again to access Paypal?

Doesn't this sound a little impractical?

For now, I use a carefully administered Linux machine running Firefox... *I* don't want to reboot (besides, it would ruin my wonderful uptime numbers).

Re:Sounds like they should hand out liveCDs

[asticia]

My bank uses one-time PIN sent via SMS; you can pick also either RSA token, or challenge-response "calculator" bound to your card. Then you get static GRID card for interactive response. You get it free if you have internet banking enabled, just select what security means you want to use for logging in and verifying each transaction. Same if you have active phonebanking. (And I am from Eastern Europe.)

The only weakness it has is credit/debit card: all information needed for transactions are directly on that one card! What's worse, for online payments you do not even need that card physically! Still it puzzles me why is this highly insecure way of paying over internet still being used when there are lots of means to make transactions safer. Because "people are used to it" from offline world and something more complicated causes headache? History of credit cards in my region is not that long to get used to it, so I can just shake head and get one-time virtual i-card for online transaction...

Re:Sounds like they should hand out liveCDs

[RickRussellTX]

press a bunch of "Banking liveCDs"

And you'll be setting up a special call center to teach people how to switch their boot drive on BRAND X PC to the CD-ROM?

"Yes ma'am. I know it says LG-DVD. No, not the movie kind of DVDs. Yes, well, I guess it could play movies. No, ma'am, there's no movie on the CD we gave you. I know I said that, but the CD will work in a DVD player. No, ma'am, you have to use it with your computer, I mean the DVD player that's in your computer. Now press F10 and... what? No ma'am, don't select RESET. No, oh crap, now you've totally pooched it. No, ma'am don't cry. Please don't cry."

Re:Sounds like they should hand out liveCDs

[maxume]

I make up single use lies for the security questions and store them in Password Safe (from what I gather, Keepass has better support for more platforms). That solves the Palin problem. Of course, I then can't access my bank account from other computers, but I don't trust all that many other computers, so that doesn't hurt all that much.

Re:Sounds like they should hand out liveCDs

[fuzzyfuzzyfungus]

I would, by no means, have this be obligatory. The bank's website would still be there, accessible from a browser under any OS you'd like.

I merely suspect that, for the vast hordes of the clueless(or the otherwise interested: my dad was cranking out financial simulations in assembly when I was prenatal, and is far from stupid; but that doesn't help him much when it comes to the arcana of whether AV program X can detect infection Y) "Urg[ing] businesses to lock down online banking" will be a more or less futile effort, while telling people "Shove this in your CD drive. Reboot. If 'Fidelity CD-Banking' pops up, you are all set. If not, call somebody who knows computers and tell them 'I need to boot from a CD.'" might just be concrete enough to be effective.

If somebody doesn't know or doesn't care about security, telling them that they need more of it won't do much. Giving them a simple set of steps might, sometimes, actually work. No reason to bother about the people who already know what to do.

Re:Sounds like they should hand out liveCDs

[Falconhell]

That would be "identity copyright breach" wouldn't it?

(-:

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

Or maybe all those fucking banks can make Web sites that don't recommend (or require) Internet Explorer.

I would settle for RSA not requiring IE. Yes, RSA, a company founded by the inventors of public-key cryptography, requires that you use IE to sign up for their security portal:

https://knowledge.rsasecurity.com/registration.asp

They use a lot of weird client-side javascript in their webpage that only works with IE.

Doesn't look good for a company in the security business to require their customers to use the world's most insecure browser.

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

Terrible idea.... All I would have to do is steal your key and dump my own program over it, then I can ask for your login details and have them mailed whereever I want, along with the pin you entered on the fake loggin screen.

The only way to do it is for the bank to distribute a CD-ROM or something else that is read only memory. Even then idiot users won't know how to make sure they are booting from the CD-ROM.

Re:Sounds like they should hand out liveCDs

[Kaboom13]

Sounds like a great idea, and in a sane world it could be implemented fairly easily. In reality though, the banks are looking for a cheap way to limit their own liability (See! We warned you you could be hacked in that configuration!), not put a giant SUE ME PLEASE logo on a cd and mail it out. If whatever executive's nephew, that "knows stuff about computers", and gets a fat consulting contract to develop this cd, fucks it up and it is in fact vulnerable, and it gets exploited, now they are in a position of even more liability.

Re:Sounds like they should hand out liveCDs

[Anonymous Coward]

It wouldn't be rocket surgery, or especially onerous in cost/seat terms, for major financial institutions to hack together and press a bunch of "Banking liveCDs".

No writable persistent storage, just a browser(configured so that it will only accept pages from the institution's set of domains and only when those pages have appropriate SSL certs. Completely reject all non-SSL pages, and any SSLed pages with certs for other institutions, or from other CAs).

There would probably be some annoying edge cases(some ghastly graphics card that isn't supported by default, and freaks out in VESA mode, say) or network issues(though you could always offer a cheap USB ethernet or wifi adapter, with a known working chipset, at cost to interested customers); but it'd be fairly easy to cover 95% of the boring business boxes and common home machines that you would be concerned about, if suitably generic settings were used.

As hardware gets cheaper and/or for larger accounts, it might even make sense to put together a dedicated banking appliance offering, basically the cheapo embedded ARM embodiment of the above.

Bro. I work in the financial industry. Some of us do have a clue. Do you really think banks dont know about VM's and LiveCD's?

1. Average customers are too dumb to run VMware on a usb stick, Linux, Windows, or anything else.

2. Customers won't pay for the inconvenience of using a "stand alone" solution or tokens, especially when token adoption is a measly 3-5% when its even offered.

3. Banks arent going to make it harder to do anything, less they "harm the customer relationship"

4. As has been stated earlier, customers aren't going to reboot into another environment just to do banking.

5. TPM solutions are on the right track when it comes to guaranteeing host integrity. Its the only way to ensure endpoints somewhat without substantially changing what a user has to do today.

Re:Sounds like they should hand out liveCDs

[muckracer]

> How about just using SSL for the login page? Most of them don't--it's hidden
> in an iframe, and without viewing source or checking the form, you've got no
> reason to be certain your login data will be securely transferred.

There's a Firefox Plugin which you might appreciate, that attempts to address
this issue (or at least make you aware of it):

https://addons.mozilla.org/en-US/firefox/addon/11894

Re:Sounds like they should hand out liveCDs

[Vahokif]

Yes but to make it really user-friendly it would have to read say PPPoE connection information from the installed OS, which may be compromised.

Re:Sounds like they should hand out liveCDs

[talcite]

As hardware gets cheaper and/or for larger accounts, it might even make sense to put together a dedicated banking appliance offering, basically the cheapo embedded ARM embodiment of the above.

And for added convenience, you could even have the dedicated appliance dispense cash on the spot! Of course, you'd need to add locks and harden the case with heavier steel.

Wait a sec....

Re:Sounds like they should hand out liveCDs

[Yvanhoe]

I used to think this is a ideal solution. Then I learned here more about BIOS. Having a key-logger installed in the BIOS could overcome this whole procedure. No, the only possible way seems to not get infected in the first place. And that, is only possible when you assume your PC ships clean.

Re:Sounds like they should hand out liveCDs

[dabadab]

How do you exactly hijack a GSM number when you are not the NSA? (Or, even, how do you get to KNOW which phone number should you hijack?)
Yes, USA banks definitely need to implement out-of-channel authentication, be it an SMS code or an RSA-thingie (altough it's not that handy).

In Europe every bank which I have encountered used such measures in their online banking solution. (I should mention that the crappiest webbank I have seen is Citibank's - guess it was American Made ;> )

Re:Sounds like they should hand out liveCDs

[Aceticon]

I've been using such a challenge-response mechanism with my Dutch bank for several years now.

It works together with the smart chip in your bank card:
- At the appropriate points the bank website gives you a number that you enter in a little device where you have your bank card slotted. The device (using the smart chip in your bank card) calculates a response number which you type back in the bank website. If the numbers match you are given-access/have-pending-payments-approved.

No passwords or any other important keywords will ever go through the network or even enter your PC (and thus cannot be sniffed or keylogged). Your PIN code is needed to activate your bank card when first slotted into the device but even if somebody manages to visually see you type it (the only way to do it remotelly is to own your machine, turn on it's webcam and look through it at the right time), physical possession of the card is still needed.

The most significant weakness of this is some form of man-in-the-middle attack within a running session with the bank's website (maybe using a dynamically generated fake bank website front-end talking to the real one in the back-end and injecting payment operations in the appropriate moments).

Funnily enough I've moved to the UK where most banks are still comparativelly in the stone age (multiple-passwords is the most common of tricks). The best one I've used here (for my business account) is similar to the one from my Dutch bank but for initial authorization the smart card in your bank card does not receive a challenge-number, it just generates a number on it's own.

The truth is that most problems of unauthorized access to bank accounts via a bank's website are squarelly to blame on the banks themselves - any system relying on long-lived shared authorization codes (i.e. passwords) which must go through non-hardenned and potentially insecure devices (a user's PC, a browser, a network connection) is exceptionally unsafe and prone to be broken remotelly using automated means.

Even if users have the technical expertise to harden their own system, there are just too many potentially elements outside the user's control (the OS, thousands of network-listening applications, the actual browser, the SSL implementation used, the certification authorities, the bank's website implementation - to name just a couple) and vectors of attack. Using long-lived shared authorization codes which go through all sorts of potentially remotelly compromised systems for securing high-value targets is as dumb as it gets. To top it all up, if you happen to live in certain geographical locations, automated remote takeover of bank accounts is a low-risk-high-reward activity.

Safer systems exist and are deployed by some banks already (i.e. challenge-response systems relying on shared keys running inside hardenned devices - smart chip on the client, SAM on the server - and never coming out) but they cost money and most banks are not willing to spend it.

Until the banks get full financial responsability for this kind of intrusion, most won't do anything to provide an online banking environment which is not prone to them.

Re:Sounds like they should hand out liveCDs

[sjames]

That's a brilliant one! They stupidly accept that anyone knowing a few very basic and public facts about you IS you, and then hand over a big wad of cash. Then they pursue you for the money and make it your problem even though you don't have any influence at all over their stupid (in)security decisions.

Then the various credit agencies freely libel you by accepting a bunch of hearsay from the same idiots that have already proven that they have no idea who they're doing business with and slopping it all together based on shaky associations (same last name, similar first, lived at same address not necessarily at the same time, etc) then repeating it as if it were the word of God.

To top it all off, we the People are then expected to spend our time and money correcting their mistakes for them and performing quality control on their dat abases without any sort of compensation. It's now to the point that every 3rd commercial seems to be about some service to help you do the financial institution's jobs for them.

For some rea$on the courts and legislatures give them a free pass on all of that and furthermore allow those same idiots who have proven that they are constitutionally incapable of behaving responsibly to be the foundation of our entire economy.

Huh...funny...

[Anonymous Coward]

Never once seen such a thing go down with Mac & Linux users. But hey, that's me.

Re:Huh...funny...

[AHuxley]

But the bank workers do not get a nice long lunch with the tall handsome man or curvy lady from MS if they support Linux or Macs.
Win win MS numbers on the back of a napkin after a fine wine every body is happy for another year.

Re:Huh...funny...

[MyLongNickName]

Nope, I am sure no woman has ever gone down on a Mac or Linux user. Oh wait, I think I misunderstood you..

Oh, yeah! Another "Eastern Europe" story...

[LanceUppercut]

Apparently, it is that time of the month again. Despite the well-established fact that 95% of all computer-related fraud originates in the USA, they still keep pushing the mandatoty "Eastern Europe" BS. I wonder how much of the taxpayers money is spent on cooking such propaganda stories?

Re:Oh, yeah! Another "Eastern Europe" story...

[Grishnakh]

Do you have a citation for your claim?

I would certainly believe that most of this crime comes from places like Eastern Europe and Russia, because it makes perfect sense. Those parts of the world are now connected to the West through the internet, and the people there are smarter and better educated than Americans (especially in regards to science and math). There's a good reason so many companies have software development teams in places like Russia, Latvia, and Romania these days. With all the computer expertise in those regions, it makes perfect sense that a lot of fraudulent activity would come from there as well.

Re:Oh, yeah! Another "Eastern Europe" story...

[CastrTroy]

I would say that low wages have a lot more to do with the presence of software development teams in countries like Russia. Sure there's probably a lot of smart people in Russia, but if they were top notch, they would be working for the same wage as American workers (because they would be providing the same value), or they would start their own software firms, and put out their own products, allowing them to earn much more money because they wouldn't be paid by how many hours they spent programming, but rather by how many people they could get to buy the product that takes the same number of hours to program whether you sell 1 or 10000 copies.

Re:Oh, yeah! Another "Eastern Europe" story...

[Scrameustache]

lot of smart people in Russia, but if they were top notch, they would be working for the same wage as American workers (because they would be providing the same value)

Career analyst Dan Pink examines the puzzle of motivation, starting with a fact that social scientists know but most managers don't: Traditional rewards aren't always as effective as we think. Listen for illuminating stories -- http://www.youtube.com/watch?v=rrkrvAUbU9Y

Re:Oh, yeah! Another "Eastern Europe" story...

[Grishnakh]

Right, but if you want dirt-cheap, you'll get cheaper programmers in India and China. The fact that they're using programmers in Russia I think is pretty significant.

Plus, I could be wrong, but in my experience it seems like there's a bit of a shortage of good programmers in the USA, at least in certain specialties.

Re:Oh, yeah! Another "Eastern Europe" story...

[networkconsultant]

Not to forget a history of Corruption, Greed, Blood shed and regligous indignation. Oh wait you mean Russia!, sorry I get my superpowers confused.

Re:Oh, yeah! Another "Eastern Europe" story...

[httptech]

Yeah, that's why most banking fraud trojans that target U.S. banks are compiled on Russian-language PCs and connect back to Russian-developed webserver software. I'm afraid your "well-established" fact doesn't ring true with anyone that actually tracks banking trojans for a living.

Seriously?

[marciot]

Seriously? A *standalone* machine? You mean I shouldn't check my bank accounts from my kids' Windows ME computer?

Just joking, I've already mastered the first skill of safe computer use ... not having kids, or Windows ME.

A worry, but limited in scope

[Trogre]

Of course it's not nearly as big a problem as it could be here, since no tech-savvy person, running a business or otherwise, would ever have internet banking set up with any level of access other than read-only, except perhaps for a small number of pre-approved payees.

Ever.

Re:A worry, but limited in scope

[Anonymous Coward]

Err... you can do that? Seriously, your bank offers that as an option? That sounds like a great idea, but I have never even heard it suggested before.

Re:A worry, but limited in scope

[Trogre]

You certainly can, well in New Zealand anyway. It strikes me as just basic security and I can't believe that some people accept internet banking services with anything less.

Re:A worry, but limited in scope

[sjames]

Assuming they even offer to make it read-only or even allow you to flag your account to never allow internet access. I know that many banks don't even have a way to block "check by phone" where you (in theory) tell someone your account number (or they find it out by reading one of your checks) and they fill out what amounts to a counter check for you.

what about this

[FudRucker]

say for example i own a sporting goods store in St. Louis Missouri and my bank is in the same town, dont you think the bank should reject anyone using my identity with an IP address that is in another country?

i think the banks need to be more careful about who is logging on to their systems

Re:what about this

[Anonymous Coward]

If the banks cared, they would. But who loses money when someone from another country uses your identity? Not the banks.

Re:what about this

[AnyoneEB]

That should definitely raise a red flag at a bank. Credit card companies definitely do that type of check. On the other hand, if your computer is already infected with malware, making the attacker proxy the connection through your computer (and use the same cookies and user agent, too, so it looks like the same user) seems like a minor hoop to jump through.

Re:what about this

[JWSmythe]

    Maybe. Maybe not. You, with your sporting good store, may have suppliers in other countries. You may go to their site. You may go on a trip elsewhere. While you're out, you can trust that the interim manager can handle everything, or you can look in on your bank accounts while you're gone. I know, it's not the best idea in the world, but no one ever said business owners always follow best security practices.

    If you were locked out of the account while you were overseas, you'd probably call and bitch the bank out (at $5/min for the phone charges). Not all businesses have the luxury of being mom & pop shops, and only ever doing business from their office line. Geo-locating the IP isn't exactly fool proof either. Depending on the line I'm on any day, I've been located in several states around the US, China, and Europe. All of those have been within one state, and generally just a handful of cities. It's not a failure on the ISP's part, it's a failure on the folks who are maintaining the geo-locating databases being used. Well, not exactly a failure, since they give a percentage of accuracy in their advertising.

    I just checked the IP I'm on today with MaxMind's site (the providers of GeoIP). The result was close, but still the wrong city. What if I told them to only expect traffic from City X and determine anything from anywhere else was fraud? Now I'm going to be considered an attacker. Wheee. I hope the feds don't come knocking my door down. Well, I am sitting by the pool, sipping some pretty serious rum drinks right now, but that's what happens when you're on vacation. :)

Re:what about this

[SethJohnson]

dont you think the bank should reject anyone using my identity with an IP address that is in another country?

Scenario: Your computer is compromised with a keylogger. It's also got a proxy and other remote control features. The illicit transaction is bounced off your computer, so the bank sees it as coming from your IP address.

Seth

Re:what about this

[CastrTroy]

Would it be too much trouble to give customers an RSA SecurID, so it would be impossible for them to give their password to some third party person, without being ultimately stupid, and handing them a physical device. Real two factor authentication would be great. Something you know (a password), and something you have (RSA SecurID), should be the minimum for logging into any bank account.

Re:what about this

[markdavis]

+1 insightful... mod parent up. That is the best suggestion I have seen on this entire thread.

Re:what about this

[AnyoneEB]

Wonderful idea. But it has very little to do with this attack. RSA keyfobs ensure that if you log on now, an observer cannot log on to your account at some later time, which is a good thing to guarantee. Note that the generated PIN may be unique, but the attacker can get around that by simply sharing a session with you. This requires the attack to be real-time, so it does make it somewhat more difficult.

If the attacker controls your computer, then I cannot see how you could still prevent an attacker from making transactions without having a challenge-response based on the transaction performed by something not directly connected to the computer (a physical page of single-use codes would work and some people on /. have mentioned their bank using such a solution).

Trying to use a possibly rooted computer to do something securely is a hard problem, but unfortunately it is one that has to be dealt with. Optimally, people would be using more secure setups, but that is not realistic, especially when successful exploits can net such large sums of money.

Re:what about this

[asticia]

Ummm ... my bank uses that for quite some time, I use internet banking since 1999.

Re:what about this

[tsu doh nimh]

the malware discussed in the blog posts linked from the summary illustrates how the crooks are defeating securID-like tokens, as well. Zeus, eg., is often seen in an attack rewriting the HTML of the bank's Web site as the victim sees it in his or her browser. In the simplest case, where the code is required at login, the attackers simply serve the victim with a maintenance page (down for maintenance, please try back in 15 min). e.g., Beware of Error Pages at Bank Web Sites Some banks require businesses to provide a SecurID or other token key when they initiate a wire or ACH transfer. This is getting closer to the solution, but a lot of commercial banks don't like to require that because many customers initiate such a high number of transfers each day, that it becomes impractical. The hard-to-attack solution, which really doesn't address the usability issue -- is to require the SecurID number both on login and on transfer.

Re:what about this

[Anonymous Coward]

Hmmm...typical American small company thinking...

I'm in Japan. I bank in Canada. I routinely web bank from Japan through my Canadian bank.
(Using linux, of course, so quite safe and secure...in fact, I'm been doing a lot of web banking for years...from and to various countries...over the years...using linux, of course.
I heartily discourage anyone who is using a windows machine though, and encourage them to use linux, etc. :-))

Re:what about this

[Anonymous Coward]

Most banks here (Europe) do that already.

Re:what about this

[Anonymous Coward]

My account has a 4 digit pin, for which it asks for 3 selected numbers, 3 letters from my code word and an 8 digit number, generated by a box in which I insert my debit card to generate the 8 digit number.
How it works I don't really know, but gives the appearance of security to me.
Admittedly I sweep my machine regularly and use Firefox exclusively, but should I take any further measures?
I've got a USB key w PenguinLinux on it, more for the heck of having it than anything else.. is it really that necessary?
Thanks for the advice..

Re:what about this

[muckracer]

> dont you think the bank should reject anyone using my identity with an IP
> address that is in another country?

No, they shouldn't. I travel often and routinely log in to do banking from
overseas. Especially when somewhere else it'd be extremely irritating to get
locked out just because of where you are. Banks shouldn't care where you are
but who you are. And fortunately all authentication systems so far have been
based on that premise.

Re:what about this

[dunkelfalke]

It can be optional. For example, my bank has an option on limiting withdrawals from ATMs abroad to a certain sum per week. You can as well set it to zero as long as you stay home.

Re:what about this

[sjames]

If it looks suspicious, they could CALL you for verification! They could ask you to call them when you're planning to travel so they know what to expect.

Re:what about this

[JWSmythe]

    They could. They won't though.

    I know someone who had her purse stolen. She wasn't aware it was gone for an hour, and then called the police immediately. One of 6 credit card issuers called because the people made strange high dollar purchases. And yes, they used all the cards in the span of the hour. The bank that did call, called after she started calling all of the banks notifying them that the cards were stolen.

    I've only ever been called once ever. I took my girlfriend and her daughter out shopping, so I had a few hundred dollars of teenager clothing store purchases.

    I've always expected a phonecall for some of my traveling. In one week, I may purchase stuff in New York, Miami, Los Angeles, Canada and Mexico. Ya, I've had some long weeks. :) Still, I've never received the call from those for suspicious activity on my account, even though one purchase was in LA, and the next (in the same day) was in another country for a $1000 computer.

    You have to figure, if a bank has say 500,000 accounts, they can be used anywhere at any time. It would take a huge staff to track the behavior of every client to make sure their activity is legitimate. They do maintain a staff, but look for the glaring red flags before they'll call. In 28 years of having credit cards, I've only been called once, and I would consider some of my purchases suspicious (like the one noted above).

Re:what about this

[sjames]

Then it's on them to provide for better security.

Re:what about this

[JWSmythe]

    Come on. This is an industry that stations an old man with a worn out pistol at the door (where they still do), to provide physical security where they're distributing cash. Why would you think the rest of the industry is any better. They never have to worry, if they lose money, they'll collect it back from the depositor and the fed. Hell, they can't even go out of business, they're covered by the gov't.

   

Re:what about this

[sjames]

I agree, unless and until they get bit HARD by customer lawsuits over their lax behaviour, they will only get LESS secure while maintaining the security theater.

Cost of using Windows

[Grishnakh]

I guess this is what you get when you run your small business on Windows.

Re:Cost of using Windows

[Prof.Phreak]

...or have bank (and brokerage houses) require IE in order to login into their websites.

Re:Cost of using Windows

[Grishnakh]

Does anyone's bank still do this? I've heard of it, but I'm pretty sure it's a relic of the 90s and early 00s at best. Somehow, in this age of Firefox getting 20-50% marketshare (depending on whose stats you look at; my own non-computer-related website has about 45% Firefox for its visitors), I don't think any banks could continue to get away with requiring IE.

That's a great idea

[amRadioHed]

And maybe the banks can even set up some standalone, hardened, and locked-down computers in convenient locations around the city for their customers to use. Maybe they could even get money out of these computers. They could be like bank tellers, but automated.

Re:That's a great idea

[noidentity]

And maybe the banks can even set up some standalone, hardened, and locked-down computers in convenient locations around the city for their customers to use. Maybe they could even get money out of these computers. They could be like bank tellers, but automated.

Yeah, but you know they'd screw it up somehow, like have it run Windows or have a company like Diebold to make them...

Re:That's a great idea

[drinkypoo]

They have Diebold ATMs at the largest local "native american" owned Casino. I guess you get to gamble with your money coming and going.

Whoa, flashback

[HangingChad]

...carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible.

I'm having a flashback to dumb terminal days.

For a second I had hope that companies would be dusting off us old guys again.

People who use Windblows for banking...

[Anonymous Coward]

are inept at computing and don't understand the problem. Even if you could tell them why its a bad idea, they can't get away from the Windows mindset. Give them a liveCD, and they wouldn't know how to login to their bank, cuz it doesn't have IE loaded on the 'start' menu. The solution is to charge them for services that solve the problem for them without work on their part.

Out of work gold farmers rejoice!

[Ben1234]

Well at least there are other career options for all those out of work gold farmers and character levelers...

ATMs here uses Windows

[TheDarkMaster]

The ATMs from Brazilian Bank Itau uses Windows 2000. And I not kidding. On the "blaster" virus year, I found more than one ATM with Blaster virus.

people who won't act civilized...

[Simonetta]

People who won't act civilized should sooner or later find themselves 'de-civilized'. Why are we taking an endless amount of shit from these losers?

    A few hydrogen-to-helium convertors delivered right to their door does wonders to get across the message we are not a people to be fucked with!

    If they can't police themselves and insist on ripping off systematically people in foreign countries, then send 'em some great balls of fire.

    When this shit happened fifty years ago, Khrushchev would have just sent some NKVD to scoop up these parasites, take 'em back behind the outhouse, and beat their brains inside out. And all their friends and family would get ten years in the gulag.

    I miss Nikita and Eisenhauer. (Nike and Ike) Great times. No one took any shit: no one gave anyone chickenshit like this. There were limits and those limits were respected. No one from Eastern Europe was sneaking into your bank account. Fucking peasants. Khrushchev slaughtered almost a million of his own troops to stop the Germans at Stalingrad. One phone call from the US State Department and all these sleazy little cock-sucking hackers would have been mince-meat.

    Nike and Ike had the ability to blow up the world. But, they didn't blow up the world. They came to respect life after taking part in so much slaughter and bloodletting.

    Would you trust a sleezy Ukrainian hacker with a modem to not blow up the world if he had a chance? No way. Or some smug little twisted little shit-for-brains in Estonia to behave himself. Let's face facts here; going to another country and randomly stealing people's money is an act of war! When is Putin gonna knock these guys upside the head so hard that their eyes roll out? We have real enemies now and we need to work together against them. All this cross-border chickenshit financial crime is inexcusable. It's a new world, a new century. Get a real job, stop fucking around with petty rip-offs. Assholes!

    Let's all work together to rid civilization of the shit-people!

    Another great Slashdot rant. Too bad it will get modded down to -1 by toads that don't appreciate this kind of thing.

Re:people who won't act civilized...

[Anonymous Coward]

I have the impression I was just exposed to a hard burst of text-like radiation. Should I be thanking you, or cursing you?

Re:people who won't act civilized...

[Jeremi]

Let's all work together to rid civilization of the shit-people!

Isn't that a quote from Mein Kampf?

Re:people who won't act civilized...

[Anonymous Coward]

I guess it depends on whether you wake up tomorrow with spider powers or cancer.

Re:people who won't act civilized...

[Anonymous Coward]

Yeah, because when Americans (like that Madoff guy) commit fraud that is orders of magnitude bigger than the one here, affecting *many* European customers too, all the Europeans want to do is nuke the US?

Re:people who won't act civilized...

[Max_W]

Your anger is misplaced. We in Ukraine hate crime even more than you do.

Besides an image of "fucking peasants", of "sleezy Ukrainian hacker", etc. really hurts us on a global market place.

If Microsoft included One-Care into its Windows OS, we would not have this conversation at all. But they do not do it to milk customers twice: for insecure OS and for the anti-virus, anti-spy-ware products. It is a billions and billions business. And a cultivated image of an in-existing in reality "sleezy Ukrainian hacker" fits very conveniently in this business.

The man who sent the first human into space, Sergey Korolyov, was from Ukraine. The mathematician who helped him to calculate this flight, Ginsburg, was also from Ukraine.

But instead we are getting a reputation of "fucking peasants" and criminals. Of course there criminals and prisons in Ukraine, the same as in your part of the world. But we are not responsible for the insecure OS and the multi-billion business based on this fear.

Re:people who won't act civilized...

[Anonymous Coward]

This is about one of the most appropriate breaches of godwin I've yet to see, wtf is wrong with GP, and wtf is wrong with morons uprating GP.

Re:people who won't act civilized...

[myxiplx]

Great reply bud, if ever there was a post deserving of +5 pwn3d, this was it :-D

Re:people who won't act civilized...

[knarf]

The man who sent the first human into space, Sergey Korolyov, was from Ukraine. The mathematician who helped him to calculate this flight, Ginsburg, was also from Ukraine.

See it in another way: Ukraine obviously harbors talent and has (had?) an educational system and morale to further those talents. Some use their talent to forward commendable causes (Korolyov, Ginsburg, etc), some use it for nefarious purposes. I'm talking about 'real' talent here, not the type of 'talent' hunted down in American Idol and such.

Re:people who won't act civilized...

[fuzznutz]

The man who sent the first human into space, Sergey Korolyov, was from Ukraine. The mathematician who helped him to calculate this flight, Ginsburg, was also from Ukraine.

Maybe Ukraine should write the next version of Windows. Instead of Chicago or Memphis, we could have Chernobyl...

Re:people who won't act civilized...

[Max_W]

--- Maybe Ukraine should write the next version of Windows. Instead of Chicago or Memphis, we could have Chernobyl... ---

Imagine I was joking lightly about, say, Twin Towers or Pentagon. How would it feel? Insensible?

Re:people who won't act civilized...

[Max_W]

Do you remember as in "Platoon" Charley Sheen says in the end that the war in Nam was in fact a civil war?

This analogy stands in this case too. There is the technology to make Windows secure from the box, on every machine. "One-care" or some Norton could be just a part of an OS. But this technology is being sold separately, in small quantities. It's a multimillion and growing business. Hapless East European "evil talents" are brought in this big picture as a marketing tool.

Real East European people do suffer a bad reputation due to it undeservedly.

Read Much? WTF?

[PhreakOfTime]

Yes, and you can bet your ignorant ass they will win too. They are responsible for it since the client can produce a contract stating exactly what has been violated. If the client honored their side of the contract, HOWEVER SHITTY THE SECURITY REQUIRED WAS, then it is the banks problem.

This article specifically deals with COMMERCIAL banks, and identifies them as such.

You, in your apparently myopic life bubble, specifically deal with RETAIL banks, and therefore think that is all that exists in the world, since its all you have ever seen

There is a difference. Next time you dont understand something, learn about it before speaking about it.

Re:Read Much? WTF?

[russotto]

This article specifically deals with COMMERCIAL banks, and identifies them as such.

In the US, a regular bank which accepts deposits is called a "commercial" bank. The other type is an "investment bank"; I'm not sure if any currently exist which are not also commercial banks.

The article concerns itself with commercial (business) CUSTOMERS, but the banks are mostly the same ones which individuals deal with.

"Next time you dont understand something, learn about it before speaking about it."

Re:Read Much? WTF?

[PhreakOfTime]

Do you have any working knowledge of this other than reading the first line of a wiki page, and being a retail bank customer?

The article and warning deals with commercial banks which in this context means a bank that does business with other banks. The contracts that deal with bank->bank communications are exponentially more complex than your customer->bank transactions. Or does your bank issue you an electronic key-fob that generates your password every minute that you use over a dedicated leased line, as the article describes as a point of attack? I highly doubt it.

The article then goes on to describe examples of how retail customers have been screwed over by these threats. This is not meant for retail customers, and being confused about the difference between the two shows that you are unaware that this separate layer of banking even exists.

* and no, no more 'investment' banks exist since the market meltdown began in earnest last September. Morgan Stanley, and Goldman Sachs were the last two before being converted and regulated by the FDIC. I guess that wiki article needs to be updated so you can pretend to know what you are talking about, right?

Re:Read Much? WTF?

[russotto]

The article and warning deals with commercial banks which in this context means a bank that does business with other banks. The contracts that deal with bank->bank communications are exponentially more complex than your customer->bank transactions.

No, it doesn't. The article deals with ordinary banking customers which are businesses (other than banks). It is not referring to inter-bank communications at all.

In related news...

[InsertWittyNameHere]

Ya, I caught that too. Get on a computer that can't browse to web sites, and then browse to http://mybank.example.com/ . Brilliant advice.

Microsoft is urging it's customers to 'carry out all computing activity from a standalone, hardened, and locked-down computer which is not plugged into any electrical outlet. Such a secure "computer" is known colloquially as the "typewriter"

Re:In related news...

[JWSmythe]

    Dammit, my mom gave away our old mechanical typewriter. I guess I just have to stay away from Microsoft products, and I'll be fine. I'm doing pretty good with that so far. :)

Re:In related news...

[Anonymous Coward]

I don't know about your typewriter, but my ibm wheelwriter requires electricity. I guess I can't use that for banking then.

Re:In related news...

[networkconsultant]

Dude do I have a font wheel for you, it's got wingdings!

Eastern Europe is a euphemism for KOMMIE BASTARDS

[Anonymous Coward]

KOMMIE BASTARDS!!!!!

The dirty russians are at it and always will, the 3rd world example of a toilet overflowing with shit and lots and lots of rotting remains.

lousy security

[speedtux]

Security for online banking in the US is awful. Transactions should require a second physical authentication token in addition to the password; most US banks have nothing.

Re:lousy security

[the eric conspiracy]

Real time keyloggers can breach even this level of security.

Online banking application vendors suck.

[zerofoo]

I was the network services manager for a small community bank a couple of years ago, and all of our online banking fraud was directly related to the insecurity of the online banking application - specifically SQL injection attacks.

The application vendor's solution was to encrypt everything in the database and block known SQL injection "patterns". I told them they needed to harden their application against SQL injection; encryption and pattern matching are not enough.

Sure enough, some Russian guys (I'm guessing by the originating IP addresses) figured out that if they opened an account with a known password, they could use SQL injection to copy the encrypted known password to an account with lots of money.

Our work-around for the crappy vendor's "security" was implementing RSA tokens (outside of the banking app) on business accounts that could electronically move money out of the bank. Non-business accounts could only transfer money inside the bank - a large fraudulent transaction would get caught by a human before the money left the bank.

Before anyone suggests switching vendors, consider two things:

1. Switching banking software vendors is EXTREMELY disruptive to business. In a business where customers complain about 5 minute drive-through times, a large software migration with downtime and training is intolerable.

2. All small to medium bank software vendors suffer from similar code quality problems. Moving to another product does not necessarily guarantee quality code.

-ted

Re:Online banking application vendors suck.

[Anonymous Coward]

How does a Russian open a bank account from overseas?

Re:Online banking application vendors suck.

[Kaenneth]

So are the banks unwilling or unable to spend the money on quality software?

Anyway, one of my peeves is the mysterious change from "Bank Fraud" to "Indentity Theft"... I suspect the Banks deliberatly retitled the offense to try and foist liability onto their customers...

If Person A uses Person B's indentity to take money from a bank, and the bank did not adaquitly verify the credentials and identity... how did that become Person B's problem?

Re:Online banking application vendors suck.

[Anonymous Coward]

I was the network services manager for a small community bank a couple of years ago, and all of our online banking fraud was directly related to the insecurity of the online banking application - specifically SQL injection attacks.

The application vendor's solution was to encrypt everything in the database and block known SQL injection "patterns". I told them they needed to harden their application against SQL injection; encryption and pattern matching are not enough.

Sure enough, some Russian guys (I'm guessing by the originating IP addresses) figured out that if they opened an account with a known password, they could use SQL injection to copy the encrypted known password to an account with lots of money.

Our work-around for the crappy vendor's "security" was implementing RSA tokens (outside of the banking app) on business accounts that could electronically move money out of the bank. Non-business accounts could only transfer money inside the bank - a large fraudulent transaction would get caught by a human before the money left the bank.

Before anyone suggests switching vendors, consider two things:

1. Switching banking software vendors is EXTREMELY disruptive to business. In a business where customers complain about 5 minute drive-through times, a large software migration with downtime and training is intolerable.

2. All small to medium bank software vendors suffer from similar code quality problems. Moving to another product does not necessarily guarantee quality code.

-ted

You should have known this by managing your vendors (Oh, you work in finance and dont do security reviews of all your vendors?) That way you would have known that they didnt have a white or blackbox review of the application done. If they didnt, you should have known to use a Web App firewall like Imperva to complement your defense. Web App Firewalls have been around for at least 5 years.

Its your fault. Learn how to do security before you hurt someone.

Ought/ Ought Naught, Ground/Zer0...

[scorpivs]

Weeee Dogies! Y'all're gonna have ta excuse mah cogitations, Mister Drysdale, but Ah figgers this's one thread just about the perfect Phishin' hole fer them there squattin' folk. Ahmah gonna has ta asks y'al tah not pay no never-mind t'mah sig. Yore Friend, Jed Clampett

How about (dare I say it?) offline?

[John Hasler]

> The banking group is urging that commercial bank customers 'carry out all
> online banking activity from a standalone, hardened, and locked-down computer
> from which e-mail and Web browsing is not possible.

My bank still has actual human tellers.

Re:Bigger than Rob's dick

[Dmxftw]

Maybe Rob has a huge monitor with very low resolution ..... then you wouldn't be laughing............

My bank challenges each overseas wire transfer

[Anonymous Coward]

I run a small business here in San Francisco, and about once a month I send money to foreign businesses.

These are USD$500 to USD$25,000 transfers from my bank account to a business bank account (in China, India, Romania, etc).

Until last year, my bank, Wells Fargo, made the transfers with little more than my signature on a fax.

Now, the transfers won't go through until a security officer calls me and talks to me to confirm that I want to send the funds. Even for little transfers, as small as $600. Last time, they asked me a couple good questions (like "when did you first open this account?" and "Who else is listed on your account")

Naturally, I'm perfectly happy to get these phone calls! Not perfect, but much more secure than a faxed request to transfer money.

Trademarks vs Phishing

[Doc Ruby]

These banks can call for everyone else to do all kinds of drastic things. But even though practically all phishing scams should be stopped by banks enforcing their own trademarks, banks do absolutely nothing like that.

These banks are businesses that get paid $TRILLIONS to lose everyone else's money, all the time. Of course they'll demand everyone else do a lot of hard work to protect them, while they do none but keep all the money.

people from Eastern Europe condemn crime

[Max_W]

I am from Eastern Europe. Such crimes or such articles really hurt. Everybody gets convinced that people from Eastern Europe sooner or later will pull out a trick like that. And that image is really bad in global economy.

Why should a malicious software be possible on a PC at all? People pay for the operating system. And they have to pay for anti-virus, for ant-spy-ware. This is the point.

Why Windows-One-Care cannot be part of the OS? And people all over the world will sigh with a relief. Is it not done to milk billions from customers first for a monopoly insecure OS and then second time for making the OS secure.

Very conveniently fit people from Eastern Europe of criminal persuasion in this picture. Very conveniently. But this image really hurts interests of honest hard working people from Eastern Europe on a global market scene. There are a lot of good people in Eastern Europe who brought good things into this world, say, periodical system of elements, first flight into space, etc.

Include the Windows-One-Care in Windows and stop harassing us.

Re:people from Eastern Europe condemn crime

[sulfur]

Why Windows-One-Care cannot be part of the OS? And people all over the world will sigh with a relief. Is it not done to milk billions from customers first for a monopoly insecure OS and then second time for making the OS secure.

Because they can? Microsoft isn't in the business of making the world a better place; they are in the business of making money.

A reasonably educated user doesn't need to buy antivirus software to keep their computer safe. All they need to do is to regularly apply patches. I've never used AV on my Windows computers, and got hit only once by a 0-day worm. Think of cost of purchasing AV as a convenience fee for not having to learn how to properly use your computer.

Re:people from Eastern Europe condemn crime

[Zontar The Mindless]

I've never used AV on my Windows computers, and got hit only once by a 0-day worm.

Since one time is all it takes to drain your life's savings, that's one time too many, don't you think?

Re:people from Eastern Europe condemn crime

[sulfur]

I don't see how you can protect yourself against some 0-day exploits even with firewall, antivirus, latest patches, etc installed. GP was arguing that MS should supply security software for free with their OS's, so I was talking mostly about home users who use one computer rather than businesses who can afford to have dedicated machines for separate tasks. Of course you can minimize the risk as much as you can, but you can never be 100% sure.

Linux Partition

[Merritt.kr]

This is actually a big selling point for my business: I do computer repairs, and my focus is on selling people on the idea of using Linux. One of my best points is "On Windows, you are almost gauranteed to have malware on your computer tracking you and watching you, stealing your CC, etc.. If nothing else, use Linux to just log off windows, sign on to Linux and do your banking." Not perfect security, but a heck of a lot better than when you have malware trying to get that info every time you buy off Amazon or sign in to online banking to pay a bill.

You are forgetting...

[Anonymous Coward]

Almost all small-small businesses use either Peachtree or Quickbooks and people do their personal banking with Intuit. There are no real alternatives for these on a non-Windows platform, so no-one is going to switch.

wrong

[speedtux]

Even if that were true, it would already eliminate many kinds of attacks.

But it's actually not even true (the NYT article got it wrong--typical). In correctly implemented banking systems, such tokens aren't used for logging in, they are used for authenticating transactions, after the transactions have already been entered and confirmed.

Wifi lack of support kills the LiveCD idea

[WoTG]

I actually had this exact idea a few years back. I went as far as fiddling with customizing Knoppix. But then I got my first laptop - no Wifi support from ANY LiveCD (at the time). Even the laptop that I'm on now won't get wireless support out of the box with Knoppix (I haven't tried any other LiveCD).

Printer drivers (for receipts) would have been a pain too - I figured on PDFs to Flash drives for this. Never mind the huge hassle of rebooting to do a simple transaction.

I'm all for two factor authentication that works -- how come PayPal.com will send me a single-use, time-limited secondary password by SMS for free (in Canada no less)! It'll be 10 years before a Canadian bank does this...

American banks seem to be too lazy

[dunkelfalke]

iTAN/iTANplus is a very safe method to do online banking and it is widely used in Europe. Why can't American banks just implement the same solution?

Whose fault is it?

[Anonymous Coward]

Yeah, blame eastern europe, not the idiots that operate their "secure" online banking.

What kind of security is common in the US?

[zazzel]

I just wondered, do these businesses mostly use PIN/TAN security? Or a simple password? When I lived in the US, Citibank had a simple password protection - whereas my German bank account used (and still uses - no known successful attacks so far!) an HBCI compliant external card reader and home banking software.

I am wondering, because I can still imagine my banking software (StarMoney) being tricked into manipulating the online orders shown to me for verification and signing, but I have heard of no incidents so far .

Re:What kind of security is common in the US?

[Turiko]

I live in belgium, and i've got the same type of card reader. I know it's also used in the Netherlands, so i think it's standard troughout western europe. Since these attacks where done with a man in the middle attack, i guess they use a simple password. Not very smart if it's about money :P.

Blame to be allocated closer to home

[gsslay]

All very well blaming "Eastern Europeans", but the idiots who think transferring cash through their personal bank account makes them a "Regional Sales Representative" must share some of the blame. These companies are being ripped off by fellow Americans who actually believe that foreign companies need their personal help to collect money due to them, and that an honest job can be that easy.

Old Tech.

[mjwx]

'carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible. When almost all online banking is done through Web Sites...

Why bother trying to beef up local security when the best option is to take the transaction off the web. Just dial in to the bank with a good old 56K modem. It's common place with some Australian banks to have a small business's accounts department line up all transactions on a local client and then dial in to the bank and send them. Never even touches the internet.

It scales with dedicated DSL and Fibre lines that never touch the internet (separate routing infrastructure). A little bit costly, but when your transactions begin to max out a 56k line you should be able to afford some overpriced DSL.

Re:Old Tech.

[equivocal]

Take the next step toward internetification...

Use an ssh connection for the serial stream.<br>
<br>
I admire the simplicity of tty-based online banking of the olden days. The client was dirt simple and about as smart. Instead, banks push harder and harder for a big, bloated javascript app running in your browser. The browser doesn't care; it's runs the banks' app just as easily as the one from Eurasian organized crime. And what the browser runs is entirely the user's responsibility even though the "more toys" philosophy of browser development has left the user with little authority over what the browser actually does.
<br>
I propose that if banks insist on using a web browser that they make their site lynx/links-able then users use their favorite tty app to ssh to the bank where lynx runs on the bank's system.<br>

Custom Live cd

[DeBaas]

Bank should put out custom live cd's which will only allow the browser to access their site. They could even, based on Firefox, put a custom browser on the live cd and put build some extra validation in there.

Then everyone with a PC that you can boot and a network with an internet connection has his or hers locked down pc

fixed quote

[ThatsNotPudding]

'carry out all online banking activity from a standalone, hardened, and locked-down computer that is not running Windows from which e-mail and Web browsing is not possible.

Accuracy is important in these issues.

I already do this!

[hesaigo999ca]

I have a small p3 computer, that all it does is connect to my bank, and lets me do what I need to, then it stays off for the rest of the time. The problem is when big companies that put all their trust in their networks being protected, when they really aren't, because all the AV apps out there are crap...and most admins don't know what they are doing....so the company has many holes, to which employees can bust through (either by accident or on purpose) and then cry when they don't understand why they got p0wned.

If you are a financial institution, having banks tell you to harden your protocols should say something. They never really followed the banks guidelines to begin with, thinking, "Oh no...not me, it will never happen to me...we are too _________ for it to happen to us"
(fill in blank with your own excuse).

So now the big wigs think they can cry to mommy about their lacking security and the banks or gov will bail THEM out...?
I really hope I am wrong when I say "I see them coming" with this one.. I would hate to hear in the news tomorrow, that they want a security incentive or bail out, because they need to ensure their own security.

This is not the weakest link

[fulldecent]

In my dealings with TD Ameritrade, and an online brokerage starting with the letter Z (guess which one I signed an (weak) NDA with and am now regretting), and then dealing with the SEC and the FBI to clean up what I found, I can tell you this:

Businesses with insecure workstations are not necessarily the reason why banks are getting broken it to.

Banks are _careless_ with their online security, leaving things like token validation and referrer logging well beyond their vocabulary. After my findings, contact with the agencies shows that they prioritize things like DDOS (which affects businesses) higher than "loss" of information (which affects customers.)

OK i'll feed the troll.

[zerofoo]

All of our vendors were audited by multiple independent auditing firms, had SAS70 compliance, and were also audited by federal regulators (FDIC, and OTS). It is a federal requirement by our regulators that all of our vendors go through multiple security audits multiple times per year.

Further more, our applications WERE behind a managed security service (Perimeter security services) which included a web app firewall and intrusion detection.

How exactly do you audit code that is proprietary and not viewable by the public? Every application vendor in this space, that I know of, will not let anyone outside the company view proprietary code. Federal regulators are the exception - they are allowed by law to audit the code. I am not.

How is a small organization supposed to have the resources and the man-power to audit an entire company (let alone many companies) and their products? We were in the banking business, not the software development and auditing business.

In short - fuck off - you have no idea what you are talking about.

-ted

Local accomplice

[zerofoo]

The FBI says that most Russian criminals have local accomplices. Many freelance between different crime gangs.

-ted

It's not the willingness to spend money

[zerofoo]

There aren't many banking software vendors. They are all roughly the same in terms of quality. There is no software company in the world that will give you an iron-clad security guarantee at any price.

The market has determined that this type of software is "good enough". The software is "good enough" and the cost is tolerable. Unfortunately "good enough" = sucks.

-ted

One word: FinTS (was HBCI)

[Hurricane78]

Recommended to be used with a class 2 card reader and a RSA chip card, to move any possibility of fraud, and even keyloggers, out of the way.

More infors:
http://en.wikipedia.org/wiki/HBCI
http://en.wikipedia.org/wiki/FinTS

There, solved it for you.

You're Assuming The Banks Want Security

[weston]

Would it be too much trouble to give customers an RSA SecurID, so it would be impossible for them to give their password to some third party person, without being ultimately stupid, and handing them a physical device. Real two factor authentication would be great.

You're assuming the banks want actual security or have any particular external motivation.

Actual security is expensive and inconvenient. If the banks can push responsibility off onto their customers or some other party, what motivation do they have to implement actual security?

And, given that the banking lobby is one of the most powerful in the United States -- and we've just seen that they successfully pushed responsibility for one of the most spectacular catastrophic economic failures onto the State -- why would they have any trouble pushing responsibility off onto others?

Perfect is the enemy of the good

[weston]

Maybe. Maybe not. You, with your sporting good store, may have suppliers in other countries. You may go to their site. You may go on a trip elsewhere....If you were locked out of the account while you were overseas, you'd probably call and bitch the bank out (at $5/min for the phone charges). Not all businesses have the luxury of being mom & pop shops, and only ever doing business from their office line. Geo-locating the IP isn't exactly fool proof either.

All of these problems can more or less be managed by opt-out/opt-in of geographically limited logins. Done in person at the bank.

Of course, this doesn't address the larger problem that the bank would have to build support for this, and they don't really have motivation to do it. They're doing what they do best with their announcement: pushing responsibility for problems in a system onto the backs of their customers.

But China's "emerging" market...

[ibsteve2u]

But China's "emerging" market has not yet "evolved" to the point where corporate buying decisions are based primarily upon who wines and dines the C-level suits the most with the best.

Don't worry - Red Flag Linux will be smothered by duck and wine soon enough...and when enough Chinese corporate decision-makers come complete with gravy on their tie, a concubine in every closet, and an executive pay system that allows them to determine each other's compensation with no regard for performance or the longevity of the corporation, China will be a true superpower!

Briefly; about 50 to 75 years, judging by my country's history.

Anonymous Coward

[Anonymous Coward]

Why reinvent the wheel?
Use the IPsec Framework with 2 factor authentication. Enforce static password authentication together with a password generated by a token.

Another alternative is to use 2 factor authentication and SSH.

Just be creative. And don't use Windows.

Business transactions and softwares

[marygonzales0809]

Great! This is really informative and close to what I'm looking for. I'm looking for a business and property inventory software and I came across The Inventory Manager. Ever since using the software, we've had faster turnaround of reports without sacrificing the consistency and quality of reports. I hope that you will feature more business softwares. Thanks a lot!!! Kudos! :)