Slashdot Mirror
Online Banking Trojan Stole Money From Belgians
hankwang writes "Belgian authorities uncovered an international network of online banking fraud (Google translation; Dutch original), which has been going on since 2007. The fraud targeted customers of several major banks, which used supposedly secure two-factor systems that require the customer to generate authorization codes from transaction information (random code and amount or recipient's account number) that is manually keyed into a cryptographic device (Flash demo from one of the banks; manufacturer's website). Trojan horses that were planted onto the victims' computers would generate a fake error message and request that the victim re-enter the authorization code. This way, amounts up to €4,000 were transferred to money mules and thence to Eastern Europe. The worrying part is that many cases were never reported to the police, because the bank preferred to refund the money to the victim rather than risking its reputation. The extent of this type of fraud is unknown." The article mentions in passing that similar crimes are occurring in Germany and Sweden.
The article does not even mention the word Sweden or Zweden. It does however mention Denmark, which is not equal to Sweden.
"Civis Europaeus sum!"
There is a similar scam doing the rounds in the UK targeting nationwide which uses a rather predictable 2-factor (the amount of money and last digits of destination account are used as a challenge).
The scam apparently asks you to "resync" your challenge device. If you do you end up sending a sum of money to a money mule.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
How long until we move to using dedicated terminals to access our online banking. A device that only did banking could be really cheap. Load a custom, hardened version of Linux on there, that only displayed a web browser, and only went to the bank's website, and you'd probably go a long way to stopping this, and many other kinds of fraud.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Potentially even more worrying is that this system is now also being applied to online payments using my Dexia VISA card, which is more vulnerable still because it originates at the merchant's site, and isn't always so easy to verify.
Entering some extra recognizable info in the 2-way factor authentication is indeed "the way to go".
Account number is not that user friendly (and which number to enter if you have multiple transfers in one go?)
My current online bank requires me to type in the amount of money to transfer as an extra fail-safe.
This should be "good enough" for the near future.
Sadly, many online banks do not have anything like this. Not implementing proper security and paying to "robbed" customers is apparently still the cheapest option.
Well, you cannot expect the user to take this responsibility of "checking for a specific digit", they'll go to the competition if the procedure is too "complex". Why is Apple booming? Not because of feature-gallore.
You cannot imagine how many emails I get of "regular users" who entered their login details on some random webpage resulting in a email to all contacts in a format "follow this link to see [facebook-style test results]" to be prompted to login with your credentials and continue the chain.
(I've given up on educating and sending a reply explaining how their credentials have been comprimised").
And why wouldn't those people?
It is simular as Microsofts' passport or the facebook implementation on webpages which is pushed everywhere as a "ease of use" and "seemlessly integration everywhere". (which, if with malicious intent, could hijack your accounts as well and get to your emails, banking details or get creative and infect someone)
I think we can keep recursing like this until someone returns 1
The fraud dates from 2007, but it didn't go unnoticed for 3 years. The investigation took 3 years to complete because in Belgium the police does its job properly.
I can at least attest that the search for money-mules is getting more and more aggressive and annoying here. Everybody thinking of making some easy money that way should think again. If the original target goes to the police, the money-mule will have to refund the full amount of money lost and likely will get punished. The reason is that courts typically rule that the fraudulent nature of the job was obvious and hence the money-mule is an accomplice.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Flemish is a dialect of the Dutch language. I know, dialect is generally a political rather than a linguistic term, but:
- The official languages of Belgium are Dutch and French (and German...), not Flemish and Walloon
- The written languages are identical (except for some idiom)
- People can understand each other without effort (except for heavy local dialects, which is the same in most languages)
- Anecdotally, I think the within-country dialectal differences (e.g. standard Dutch versus Limburgs, Twents; "standard Flemish" vs. West-vlaams etc) are as great as or greater than the between-country differences.
you should see Dutch and Flemish the way you see British English and American English, minus the spelling differences.
That's an excellent Flash demo. For some reason it asked for my account number and password. It's on a safe site so I went ahead and entered it, but it gave some kind of error.
No, Belgium has three official languages: Dutch, French, and German (the first two account for the bulk of Belgian people). There are three dialect families of Dutch in the Dutch-speaking part of Belgium: Flemish ('Vlaams'), Brabantic ('Brabants'), and Limburgish ('Limburgs'). Sometimes all of these are lumped together under the nomer of 'Flemish', which is not really accurate.
Anyhow, Flemish is certainly not a different language, and the language you find in written communication, such as the newspaper article in question, is Dutch, not Flemish. There does exist some variation in e.g. vocabulary between the 'Belgian' and the 'Netherlandic' variants, but the original article would be perfectly readable to any Dutchman.
If a trojan has control of your browser, what it sends to the bank doesn't have to be what you typed into the account field...
No, the user types the recipient's bank account number into his Digipass device in order to generate an authentication code.
During a legitimate transaction, the website will tell you
Enter the challenge code 138427, then the amount in euro 5600, then the recipient bank account number 98765432 into your card reader and enter the authorization code in the field below.
However, a trojan could transform that into:
The authorization code was incorrect. For extra security, enter the the following three challenge codes 138427, 5600, and 98765432 into your card reader and enter the authorization code in the field below.
My bank only asks a single challenge code for small transactions; only for larger transactions (1000 euro and up), the extra codes show up. A victim may not have encountered the triple challenge codes often enough to realize that they must indicate the amount and the account number.
This is the problem with putting complicated user action into the transaction authentication process, if you control the browser you can request the user do just about anything in the name of a test or error as related in the article. My Passwindow method encodes the transaction information (ie destination account) into the challenge from the server so the user must only visually check the information, because this information is cycled alongside the authentication digits they are forced to inspect it and cannot simply ignore it and blindly authorize the transaction.
The article doesn't say that the trojan was written for Windows either. Are you under the mistaken belief that there are no trojans out there for OSX or Linux?
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
My Passwindow method could have prevented this and cost practically nothing to implement too,
I suppose you mean http://www.passwindow.com/index.html ?
As far as I can tell, there are two problems with this:
Avantslash: low-bandwidth mobile slashdot.
There is no simulation, it is a real airgap, the PassWindow is just printed onto an ordinary piece of plastic card just like any barcode. There is no electronics, or software or hardware. The challenge is just an animated gif it works on any device regardless of the situation. The transaction information is encoded into the gif so the trojan only has one avenue of attack which is a long term statistical analysis but we assume every terminal is already compromised like this so we do our own analysis at key generation and determine exactly how many interceptions would be required by the theoretical trojan. With some simple tweaks we can get 10K+ interception rates so it would take decades of normal user interceptions to get enough data to analyse. Of course the server issues a new card to a user if their use rate goes anywhere near the interception rate. In short you end up with semi passive transaction verification so the user cant be tricked into entering in the mule account details because its all done serverside, its also much easier to use, the devices from the article are a major pain and take forever to use.
Unix has the same architecture and pretty much the same vulnerable technologies as NT based Windows.
WTF? sure, they both run on computers (usually x86) but there's fundamental differences in everything from the kernel to the drivers!