Slashdot Mirror
How the Eurograbber Attack Stole 36M Euros
Orome1 writes "Check Point has revealed how a sophisticated malware attack was used to steal an estimated €36 million from over 30,000 customers of over 30 banks in Italy, Spain, Germany and Holland over summer this year. The theft used malware to target the PCs and mobile devices of banking customers (PDF). The attack also took advantage of SMS messages used by banks as part of customers' secure login and authentication process. The attack infected both corporate and private banking users, performing automatic transfers that varied from €500 to €250,000 each to accounts spread across Europe."
whoever thought that was a good idea deserves a special hell.
sure, lets rely on the most stolen personal object as a security measure, what could possibly go wrong?
One way that's been recommended to stop crooks hacking the phone part, is to get the cheapest shittiest dumbphone you can find, get a cheap SIM, and use _that_ for two factor authentication.
Here, low end dumbphones are so cheap, they're virtually disposable. When I travel to cities with high petty crime (e.g. many big European cities), I just use the cheap phone and leave the expensive smartphone at home. The worst that can happen, is that your female friends get a few weird phone calls until you cancel the SIM.
Actually, using your mobile phone to authenticate a transaction used to be a good idea -- back when phones (and SMS/texting) provided a separate communication channel from the internet, so even if your computer was compromised, you had the chance notice something was amiss. With today's smartphones, there is no real separation anymore, because an attacker just needs to compromise texting and banking apps (or the web browser) on the phone; or on the desktop and the phone, but that is easy because the phone is managed from the desktop.
What is ironic about this is that my bank in Portugal just recently introduced the SMS token for more security and I had to buy a stupid cell phone just for being able to do online banking.
Even if they did manage to get the money out, it all had to go somewhere. Why is it not as simple as looking up where the money went and going from there to determine the culprit? Am I missing something obvious?
Sadly the earlier second token system was compromised by some damn carelessness at RSA:
http://www.wired.com/threatlevel/2011/06/rsa-replaces-securid-tokens/
When the user visits a banking website, it probably has the username, password, bank url from the key logging. It adds javascript to the web page dished out by the bank asking for the mobile device number. But this javascript phones home dumping the info to the attacker.
Then the attacker sends in a trojan to the mobile device. User installs a trojan in the mobile device. Technically mobile device is not hacked. User is tricked into installing a software. At this point there is no security left. The attacker can do anything.
Now, the attacker can just the trojan to the mobile device directly, but it would be difficult to persuade the user to install it. All the compromised PC is doing is, giving account numbers, and details about last few transactions etc to make it look authentic. But if such info is available from other sources, or if not all that much is needed to persuade the user to install that trojan, it is game over. The key to the whole thing is sneaking the trojan past without arousing suspicion of the user into the mobile device.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I RTFA and while the whole system is quite sophisticated with keylogging trojans etc, in the end it works on the few dumb users who will press an SMS link that says "To install the free cryptographic software on your phone, use this link".
Clicking a link on an unsolicited message and especially one that contains the words "Install" and "Free" means you should not own a smartphone, and probably neither a PC with a browser or email client.
In the end all that hard work from fraudsters gave them access to the money of people who are just a bit smarter than those who respond to the "You won the Spanish Lottery" or "I am the son of the late King of Zembla and have eleventy billion USD to deposit to your account".
I would be interested to find out if this scheme was more or less successful than the more common and much simpler "Click here to log on to your bank website and confirm your details" fake bank login scam. But I doubt the people who have the statistics on click-through rates etc of those methods would be interested in writing a paper...
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
I had some HR idiot in an ecommerce company working with banks send me a password protected zip file with the password included in the email, and apparently he'd been doing that every day in the name of "security" for years.
If it's not obvious, the above is actually no more secure than emailing the unencrypted document (since you effectively get that in a single message only with a bit of time to waste at both ends), and far less so if the person reuses passwords.
Although its nice of Checkpoint to point this grand theft of collossal proportions out, did they catch the bastards? Its irrelavent to point out the details of how increasingly null banking security is and not post the really juicy details of how the governments of citizens who were duped tied these thieves up to a pole and got down and very funky. Where's the rest of the story?
Belgium doesn't seem to appear on the list: we're quite a small country but at least our banks seems to take security a bit more seriously.
Here you MUST enter both the amount and the bank account number of the recipient as part of a cryptographic challenge: you need a special device (every customer gets one and they're all identical) into which you put your bank card and enter your PIN a first time.
If you're wiring to a new account (one you never wired any money too) or if you're wiring an important sum (even if it's to one account you already wired amount to), then you MUST enter both the exact amount, press OK and then enter part of the account you're wiring to.
You fail to do that and there's no transfer.
There's no way around that: you have to either steal both the bank card and know the PIN and know the user identification string (e.g. "e0391829") *OR* use social-engineering to manage to steal money.
Now the scary thing: you can wire up to about 125 000 Euros using your online bank account... So for a lot of people should they fall for social-engineering or should they have their card + PIN + user identification number stolen before they can warn the bank, it means they're lifetime savings can be stolen.
Quite scary.
I feel much more confident having a safe at the bank full of physical gold and leaving only what's needed to pay for normal expenses on my account ; )
Besides that gold did quite fine since 2001 ; )
People still use Holland to refer to the Netherlands (Nederland)? Just asking.
To me, Holland refers to the provinces of North and South Holland (Noord-Holland and Zuid-Holland) in the Netherlands. ok, bye
I wish that there were a way to tell your bank that all electronic access is to be essentially read-only. I would like to make my bank login only allow viewing account balances and transferring money among that bank's accounts, and not even allowing seeing a full account number. For anything else, I can go into a physical branch.
Such a scheme would reduce attacks to someone annoying me by emptying my checking account into my savings account, causing overdrafts. A lot better than someone stealing my money.
Using a bank to store your money really ought to be more secure than putting cash under your mattress. It kind of sucks that it's gotten to this.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
How does this 'eurograbber' infect the online customers in the first place?
AccountKiller
"The multi-staged attack infected the computers and mobile devices of online banking customers and once the Eurograbber Trojans were installed on both devices, the bank customers' online banking sessions were completely monitored and manipulated by the attackers. Even the two-factor authentication mechanism used by the banks to ensure the security of online banking transactions was circumvented in the attack and actually used by the attackers to authenticate their illicit financial transfer. Further, the Trojan used to attack mobile devices was developed for both the Blackberry and Android platforms in order to facilitate a wide "target market" and as such was able to infect both corporate and private banking users and illicitly transfer funds out of customers' accounts in amounts ranging from 500 to 250,00 Euros each.
This case study dissects the attack and provides a step-by-step walkthrough of how the full attack transpired from the initial infection through to the illicit financial transfer. The case study closes with an overview of how individuals can protect themselves against the Eurograbber attack, including specific insight to how Check Point products and Versafe products protect against this attack. link
...is WTF the bank app would need to install *ANYTHING* on their phone. SMS is supposed to work on my "dumb" Nokia 6015i http://www.cellphones.ca/cell-phones/nokia-6015i/ I can't install stuff on it. The whole point of SMS autentication is that you use a separate device (cellphone) to authenticate a transaction entered on your PC. Of course, the people who do their banking via mobile phone apps have zilch security.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Beats working.
That will only work with very poorly implemented filters. Of course a well implemented filter wouldn't block a legitimate executable file in a zip anyway unless that's the policy of the people at the site. If it is, get it changed instead of fucking about trying to hide stuff from broken mail filtering software.
I really don't understand why some software vendors think they can trust criminals to nicely use standard file extensions, and also why they are locking out one of the most useful formats for transporting a collection of files. The only reason that zop hack works is because the filtering software exhibits a dangerous level of trust and doesn't examine the file format.
The truly depressing thing is that it's some commercial filtering software that is broken and little or none of the free stuff (much of which is on some commercial filtering appliances or hosting solutions that have put work into integrating the free stuff in a useful way). With email filtering you typically pay more for hyped up pieces of shit instead of things that just quietly work.