Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cyber Gangs Raise Profile of Commercial Online Bank Security

Posted by Soulskill on from the only-you-can-prevent-identity-theft dept.

tsu doh nimh writes "The Washington Post's Security Fix blog has published a rapid-fire succession of investigative stories on the theft of hundreds of thousands of dollars from companies, schools, and public institutions at the hands of organized cyber thieves and 'money mules,' willing or unwitting people recruited via online job scams. Some businesses are starting to challenge the financial industry's position that they are not responsible for online banking losses from things like keystroke logging malware that attacks customer PCs. Last week, a Maine firm sued its bank, saying the institution's lax approach to so-called multi-factor authentication failed after thieves stole $588,000 from the company, sending the money to dozens of money mules. The same group is thought to have taken $447,000 from a California wrecking company, whose bank also is playing hardball. Most recently, the Post's series outlined a sophisticated online system used by criminals to recruit, track and manage money mules."

27 of 140 comments (clear)

  1. I like Bank of America's approach by Iphtashu+Fitz · · Score: 4, Interesting

    I have accounts at a few different financial institutions and have to say that despite all their other problems I think Bank of America has about the best two-factor authentication scheme I've seen so far.

    Cell phones are extremely common these days, and BoA has leveraged that ubiquity. You can set up your account so that any time you attempt to log on the bank will send you an SMS text message with a totally random 6 digit number. You have to enter that number as you're logging into their website (along with your regular password). Since they're using an out-of-band method of sending you the random code the chances of it being intercepted are extremely small. And since it can only be used once then even a keylogger can't defeat it. The only type of attack that I think would work in this situation would be a man-in-the-middle attack, which is very unlikely as well.

    1. Re:I like Bank of America's approach by Anonymous Coward · · Score: 5, Interesting

      I can think of a *lot* of attacks on that. Most of them just as illegal as the intended crime...but...yeah... It's technically trivial to intercept SMS data. As it is, you can already see the fraud shops working around it--the new trojans send an alert to some amazon-turk type person in the middle of nowhere when you login, and just hide a window that gets relayed to them. While you're logged in, they can do very bad things...

      Also, as somebody working in an industry that once depended on SMS. Let me tell you the service is ridiculously unreliable. How'd you like not being able to log into your bank b/c you couldn't get an SMS? In the US I can tell you from experience that any given vendor will have SMS "down" for about four days (total) a year.

      Finally--even if it can only be used once, a keylogger can defeat it, unless only the last message is valid, and/or there's a rapid timeout. All I need to do is make the keylogger a little aggressive, and popup a box prompting you for *two* passwords. Of course, the first one actually goes to the bank--the second one crossposts to evil.com so I can login later today and drain you.

      I realize--it's probably a "small" concern--but when you need your bank info--you often *need* it quickly.

      Looks, there's a lot of *good* technologies out there to help filter this. The credit card companies use some of them. But in the case of banks, what's going on is outright criminal negligence that they refuse to fix.

    2. Re:I like Bank of America's approach by maladroit · · Score: 4, Insightful

      As Bruce Schneier recently pointed out, MITM attacks are now much more common, and likely to become widespread.

      Now, if they used that cell phone message to authenticate the exact transaction you are performing, you'll be much more secure.

      Of course, if it's too easy to update the cell phone number, all bets are off.

    3. Re:I like Bank of America's approach by jasonwc · · Score: 3, Informative

      They do! By default, anytime you add a BillPay account, modify BillPay settings, or make an electronic transfer of funds you're asked to authenticate via SMS for THAT transaction. SMS authentication is not merely used to login. It's used to authenticate any major financial transaction.

    4. Re:I like Bank of America's approach by jasonwc · · Score: 3, Informative

      Not really. By default, SMS is not used to login; only to authenticate transactions. If you know you haven't requested any such transaction, you should immediately reject the authentication attempt, log out, and contact BoA.

      To successfully transfer funds out of your account, they would need you to authenticate via SMS twice - once to login and once to authenticate the transaction. If you know you haven't authorized any transactions, you simply should refuse any further authentication attempts.

      I suppose they could make it appear that the original attempt failed. However, that should raise enough suspicion to cause you to log off. In addition, they would have to correctly guess your SiteKey image to attempt the attack. When you login, Bank of America displays a unique image of your choosing to ensure you're at the authentic site.

    5. Re:I like Bank of America's approach by jasonwc · · Score: 2, Informative

      Oh, and Bank of America uses an EV SSL cert making it particularly easy to verify that you're on the correct site. Any of the above behavior should cause a cautious individual to inspect the validity of the SSL certificate.

    6. Re:I like Bank of America's approach by Rick17JJ · · Score: 4, Informative

      I have a PayPal security key on my key chain, which I use whenever paying for something by PayPal. Most people do not realize that PayPal offers the option of using a security key. That multi-factor identification, which is where I need to know something and I also need to have something, to access the account. The security key generates a different 6-digit number every 30 seconds. So if someone managed to steal my password through a keystroke logger or a phishing email message, they would not have the security key that I keep in my pocket. If someone found my security key laying on the ground, they would not know my password.

      https://www.paypal.com/securitykey

      As for the alternative of getting in my answering the security questions for the account, I have used very hard to guess made up answers for the stupid security questions (I did not use real information).

      An employee at the bank, where I have my checking account, recently suggested that I should do online banking. First I asked him if that would work with my computer which runs Linux, intead of Windows. He said Linux would work just fine. I then mentioned my concerns about security and the fake phishing emails that I get, which claim to be about my online banking account at their bank. I said, you know the ones that want me to click on some long complicated looking URL going to some foreign country, and then probably have me log-in and give them my user name and password. He said, "yes just ignore all of those fake email messages."

      I also mentioned my concerns about keystroke loggers, although I added I have probably managed to secure my Linux computer, better than most average computer users do. However, a keystroke logger might still a slight possibility, even for my Linux computer, so I knew I wanted the additional protection of multi-factor authentication. I pulled my security key out of my pocket, and asked him if they offer two-factor authentication, using something like this. He said the did not offer anything like that. I told him that I would not feel comfortable doing online banking with them, because they do not offer multi-factor authentication.

      Two-factor authentication may not be totally perfect, because most forms might still be vulnerable to a man-in-the-middle attack, but it would still be a major upgrade to their security. The cell phone plus 6-digit number in an SMS text message technique, that you said Bank One is using, also sounds great.

    7. Re:I like Bank of America's approach by Sir_Lewk · · Score: 2, Insightful

      I think as we see an increase in cellphone usage for common internet tasks, the "out of band" benefits of this scheme are going to be lost for many people.

      --
      "linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
    8. Re:I like Bank of America's approach by ArsenneLupin · · Score: 2, Interesting

      they would have to correctly guess your SiteKey image to attempt the attack

      They won't have to guess. If they've placed a MITM or rooted your windows box, they can just ask the bank in your name to supply the correct image.

    9. Re:I like Bank of America's approach by Opportunist · · Score: 2, Interesting

      Since I worked for banks with exactly this problem, I can reassure you that even if they aren't responsible for the losses, they have a very keen interest in making the whole deal secure: Cost.

      You have NO idea how much money banks save by shifting the work of transfers to you, their customer. Banks shut down a lot of branches and laid off a lot of people because they don't need so many brick and mortar outlets and tellers anymore. Now imagine people lost faith in the security of online banking, to the point where they consider it untrustworthy enough to demand their human monkeys again to do their work. The losses due to bank fraud have been laughable in comparison (we're talking 7 and 8 digits savings here, and we're not even close to huge corporations like the BoM).

      Furthermore, banks could not even easily return to brick and mortar transactions if everybody suddenly stopped using online banking, some banks are by now very dependent on online banking, to the point where they would quickly lose customers simply because there are no local branches anymore.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    10. Re:I like Bank of America's approach by MeanMF · · Score: 2, Interesting

      But I think that at the moment their financial interest is in making online banking fast and convenient, not making it secure. Maybe someday people will begin to stop using online banking, but we're nowhere near that point yet. One sure way to drive people away today would be to implement mandatory two-factor authentication or other inconvenient security measures. A lot of people would take their business elsewhere. No bank is going to do that unless ALL of the banks are forced to do it. And that means either regulation or making them responsible for the losses.

  2. Cahoot in the UK by Threni · · Score: 3, Interesting

    I emailed Cahoot about a flaw in their system, about 5 times as it happens, over a period of months, but only ever received stock replies. What happens is: you attempt a login with username/password. Then you get to a screen where you select 2 letters from a second password via drop down boxes. If you get that second page wrong a few times it tells you that your account is locked and you have to contact them. But you don't - your account is not locked. You can simply attempt another login. So if you know someone's username/password (username is visible when someone logs in so you just have to know their first password), then you get as many guesses as you like of their second password, and it doesn't vary the 2 letters it wants from that one. The drop down list gives a-z and 0-9. 36 * 36 isn't very many guesses to have to attempt.

  3. Sweden rocks by Anonymous Coward · · Score: 2, Informative

    Depending on your bank in Sweden, you either got:

    * A user/pass combination that you input on their website. You then get a code that you input on a personal code generator thingy, and you get another code back that you enter on the website. (Downside: You need your code generator with you)

    * A user/pass combination and one-time-use codes that you scratch off a card that you carry with you. (Downside: You gotta order more codes after a while)

    * A digital ID encrypted on file, and a password that decrypts it. (Downside: you need the file on a USB memory stick or something)

    * (New). A digital ID on a card that you carry with you, and a non-personal card reader. This card is like a digital version of your ID.
    You can either enter your card and a 6-digit PIN with the reader connected through USB.
    Or you can enter the card and PIN, and you get a code that you enter on the website. You then get a code back that you enter into the reader, which in turn generates another code that you enter on the website.
    (Downside: You need a card reader when you're away from home. If everyone uses the same bank, this wouldn't be a problem)

    Everything is done over HTTPS, so it seems pretty secure.

    1. Re:Sweden rocks by jonbryce · · Score: 3, Interesting

      In Britain you get

      Username (the most difficult thing to remember), password, and some top secret information like Mother's maiden name or date of birth.

      Or, some banks, mainly in the HBOS group, will send you a code by text message which you have to enter into the website. This is vulnerable to man in the middle attacks

      Some banks (Royal Bank of Scotland Group, Nationwide, Barclays) have a calculator sized device where you insert your debit card, type in your debit card pin number and a number displayed on the website, and get another number off the device which you enter into the website. Again, this is vulnerable to man in the middle attacks and apparently other sorts of attacks as well.

  4. No thanks, nanny bank by religious+freak · · Score: 2, Insightful

    Some businesses are starting to challenge the financial industry's position that they are not responsible for online banking losses from things like keystroke logging malware that attacks customer PCs

    How exactly is this the banks' responsibility? And if is a bank's responsibility, are they going to go into my PC to fix it?

    --
    If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
    1. Re:No thanks, nanny bank by MeanMF · · Score: 3, Insightful

      The point is that as long as banks are not responsible for the losses, they have no incentive to implement strong security measures on their websites. A large number of the current attacks on customer PCs could be eliminated if banks didn't let people do everything with just a username and password. Imagine how bad credit card fraud would be today (or how few people would use credit cards) if you were responsible for fraudulent use and not the bank.

    2. Re:No thanks, nanny bank by Anonymous Coward · · Score: 3, Interesting

      The other problem is that the banks shunt *all* responsibility onto you. My parents were kind enough to begin investing in a mutual fund (for retirement..but not actually a retirement account) for me...when I was a child. That's some foresight. Not a lot of cash--I've already saved more in five years of working--it was mostly about teaching me the values of savings.

      In order to gain access to my account online and be able to manipulate things without a *ton* of paperwork, they require a form absolving them of *ALL* liability in event of account fraud. Furthermore, in the event of fraud--if my computer doesn't have antivirus they approve of (not that they published a list of approved a/v!), I'm liable not only for my losses--but theirs.

      Great--now I've got to do paper banking, and get charged *extra* for the paper statements. Worse, if I take the money out of the account--just to move it to another company or invest it myself (because I now officially hate them)--I'm going to get nailed with a capital gains tax that will hit me like two years of rent. Taxes are the IRS' way of locking you into a bank for life.

      So they've got my money, I really can't touch it, and the agreement is if I want to be able to shift it around online, *I'm* responsible for everything, including their acts of malfeasance (and that sort of agreement isn't just negligence...it's malicious). I'm sure they'll recognize clamAV right?

      Better yet, do you think their fraud team would understand in event of a problem when I said "The system that accessed your account has no AV, because it doesn't need it by definition?"--would you? You think they're going to give a damn and not fight tooth and nail when I say all my banking is done on a readonly checksummed VM image used only for secure banking?

      You've got to learn--security is not ONE PARTIES responsibility. It's a mutli-layer problem. I need to keep my system safe and clean, and they need to authenticate my transactions. As it is--if you gave me your checking account and bank routing number, I could clean your account out. It'd be illegal...but the system is set up to do it. In the face of this sort of problem, the only solution is both parties working to a solution.

      So yes, it should be the bank's problem--and they still shouldn't have to go onto your system to fix it.

    3. Re:No thanks, nanny bank by gordguide · · Score: 3, Informative

      " ... The point is that as long as banks are not responsible for the losses, they have no incentive to implement strong security measures on their websites. ..."

      Actually, it goes beyond that. As long as banks are not responsible for the losses, they have an incentive to weaken security in order to maximize the number of clients in the available pool of clients, who actively online bank.

      This lowers the cost of running the bank and therefore maximizes profits (which cannot be impacted by pesky requirements to provide compensation for breaches and customer losses via weak security).

  5. Go after microsoft by bl8n8r · · Score: 4, Interesting

    I'm concerned of the potential that malware has to disrupt civilian systems from stuff like waste treatment all the way to energy facilities. The same vulnerabilities that allow your bank creds to be pwned are the same one that could be used to disrupt systems we need for heat or clean water. There neds to be stiffer penalties for neglecting to fix security problems.

    --
    boycott slashdot February 10th - 17th check out: altSlashdot.org
    1. Re:Go after microsoft by Anonymous Coward · · Score: 2, Interesting

      I disagree. Software vendors should not be accountable for their bugs, unless they agree to be accountable for them.

      from WinXP EULA:

      Well I was going to put a quote from the EULA here, showing the disclaimer of warranty, but slashdot doesn't like all caps, and wouldn't let me. It says:

      Filter error: Don't use so many caps. It's like YELLING.

      The GPL also has a disclaimer of warranty, but slashdot wouldn't let me include that either.

    2. Re:Go after microsoft by Opportunist · · Score: 2, Insightful

      How is MS or any vendor of computer hard- or software responsible for user stupidity?

      Most of current malware infections are not due to an OS blunder or faulty software. It's social engineering, getting the user to launch a program he better not. From the obvious ones where you get an email from LAWYER telling you to open this attachment immediately and act OR ELSE, to the less obvious ones where you install a "crack" for something that also quietly installs a rootkit.

      How could any OS avoid this? By requiring root access for anything but the most trivial actions? So? The user will grant it. Imagine you promise the user a crack for his OS so it won't activate but is still usable. Will he get suspicious if the crack wants to install ring0 drivers or manipulate system files (assuming he knows at all what I'm now talking about)? No, after all that crack is supposed to change his OS. Not only would he not be alarmed, quite possibly he would do whatever is in his power to help the rootkit install itself. If it doesn't work, oh well, maybe those bastards at MS changed something and the crack doesn't work anymore. Happens all the time with new firmware for those consoles...

      Don't try to shift the blame, people. It's not Ford's fault if you don't check your brake fluids and your car doesn't stop when you slam the brakes. It's not your plumber's fault when you clog the sink and it floods the apartment. It's not Smith&Wesson's fault if you can't handle your gun and shoot yourself in the foot. And it's not MS fault when you can't keep your machine clean.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  6. Re:So close ... and yet ... by Pinky's+Brain · · Score: 2, Informative

    Just for instance ... it can connect to a server, retrieve a transaction from it and validate it with the key you just entered. The server at the same time sends off a couple of SMS to money mules.

    Automation is the key.

  7. Re:Hmm by hedwards · · Score: 3, Insightful

    You know, Kelsey Grammer is only one man. You can't expect him to go out and fix all the worlds English language issues, now can you?

  8. survival of the fittest by shentino · · Score: 2, Insightful

    My two cents

    1) Why should the bank be held responsible for something that is clearly the customer's responsibility? I.e. securing their fucking computer?

    2) Maybe this will encourage folks to keep their computers locked down.

    Mind you, I think that the bank should bend over backwards to help catch the bad guys. However, they cannot and should not be expected to police their client's computers...and likewise expecting them to pony up for something they can't prevent is also unfair.

    The real enemy in this case, as usual, is the crook that did the hacking in the first place.

    1. Re:survival of the fittest by Moridin42 · · Score: 2, Insightful

      1) The security of financial transactions isn't "clearly the customer's responsibility" .. it is a problem that exists because there are two parties. The bank is one. The customer is the other. Both can take steps to reduce losses. Customers can secure their fucking computers. Banks can secure the fucking web page. Neither party will capture all of the gains from improving security. So, to answer your question.. banks should be held responsible (for some, perhaps most, but not all) of this type of security because they are in the best position to improve everybody's position at the least expenditure of effort. Making them responsible makes sure they make such an effort.

      2) It won't. Users are dumb, reckless, careless, negligent, and stubborn. How many hours of a poorly performing machine must they suffer before they're willing to tighten security? Many, many years, apparently. How much data must users lose before they'll tighten security? Couldn't tell you. I can pretty much guarantee you that a tiny fraction of the population of internet banking users getting ripped off won't make the rest of the vast hordes of users give a flip about their own machine's security if years of data loss, identity theft, and performance impact have yet to do the job.

      --
      I don't expect morality, equality, consistency, or justice from the law. I expect only legality.
  9. Yeah it's not like security is the banks' job ... by Nicolas+MONNET · · Score: 2, Interesting

    Say the bank does not implement basic security measures such as monitoring brute force attempts, and someone brute forces your account ... how are YOU gonna prove you didn't just post your password on myspace? You can't! Only the bank can! It's better to put the burden on them, and have them, in turn, enforce security measures on the clients, because the other way around cannot work, and would screw over even the few of us who have a clue about comp.sec.

    Also, I would like to take this opportunity to point out that banks have had a few centuries of experience looking after their clients' cash .. it's their GOD DAMN JOB for fuck's sake.

  10. Re:So close ... and yet ... by Opportunist · · Score: 2, Interesting

    Not at all. Why should it? The trojan will just make YOU do all the work for it.

    Scenario: You want to transfer 40 bucks to Aunt Bessy for that wonderful cake she sent you. You have one of those trojans in your box, though. This trojan got information from its maker that it should send whatever your account can possibly send without setting off alarm clocks at the bank to Mr. Hackme and sits quietly inside your box 'til the next time you log into your account.

    "Fortunately" most banks conveniently display the amount of money you have on the page, so the question how much money can be sent is trivial to answer. What happens now is that the trojan lets you enter all the data, but before sending it to the bank it changes Aunt Bessy's account number with that of Mr. Hackme, and those 40 bucks with whatever it can rip off. The bank will accept that input and return to you the information that you're gonna send your fortune to Mr. Hackme, which the trojan will "translate" to 40 bucks to Aunt Bessy, and ask for the confirmation. You confirm those 40 bucks, but in fact you just confirmed the trojan deal.

    The only way to thwart this is by sending not only a confirmation code but also the amount and account to send it to by SMS, and you verifying that this data is correct before punching in the code.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.