Slashdot Mirror
How the Eurograbber Attack Stole 36M Euros
Orome1 writes "Check Point has revealed how a sophisticated malware attack was used to steal an estimated €36 million from over 30,000 customers of over 30 banks in Italy, Spain, Germany and Holland over summer this year. The theft used malware to target the PCs and mobile devices of banking customers (PDF). The attack also took advantage of SMS messages used by banks as part of customers' secure login and authentication process. The attack infected both corporate and private banking users, performing automatic transfers that varied from €500 to €250,000 each to accounts spread across Europe."
whoever thought that was a good idea deserves a special hell.
sure, lets rely on the most stolen personal object as a security measure, what could possibly go wrong?
One way that's been recommended to stop crooks hacking the phone part, is to get the cheapest shittiest dumbphone you can find, get a cheap SIM, and use _that_ for two factor authentication.
Here, low end dumbphones are so cheap, they're virtually disposable. When I travel to cities with high petty crime (e.g. many big European cities), I just use the cheap phone and leave the expensive smartphone at home. The worst that can happen, is that your female friends get a few weird phone calls until you cancel the SIM.
Actually, using your mobile phone to authenticate a transaction used to be a good idea -- back when phones (and SMS/texting) provided a separate communication channel from the internet, so even if your computer was compromised, you had the chance notice something was amiss. With today's smartphones, there is no real separation anymore, because an attacker just needs to compromise texting and banking apps (or the web browser) on the phone; or on the desktop and the phone, but that is easy because the phone is managed from the desktop.
Even if they did manage to get the money out, it all had to go somewhere. Why is it not as simple as looking up where the money went and going from there to determine the culprit? Am I missing something obvious?
Sadly the earlier second token system was compromised by some damn carelessness at RSA:
http://www.wired.com/threatlevel/2011/06/rsa-replaces-securid-tokens/
Some 2 months ago Danish Jyskebank had their authentication system breached by means of a Java vulnerability so for a weekend they shut down their system for updates.
When they came back up you only noticed the log-in applet was not showing, it required a call to the bank to be told you needed to update to the latest version of Java.
Then after log in they show links to documents explaining the changes, in Adobe pdf and Flash...
Also noteworthy is that Denmark's largest company's IT security policy prohibits the installation of Java on their systems, so no more Jyskebank for their employees :)
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
When the user visits a banking website, it probably has the username, password, bank url from the key logging. It adds javascript to the web page dished out by the bank asking for the mobile device number. But this javascript phones home dumping the info to the attacker.
Then the attacker sends in a trojan to the mobile device. User installs a trojan in the mobile device. Technically mobile device is not hacked. User is tricked into installing a software. At this point there is no security left. The attacker can do anything.
Now, the attacker can just the trojan to the mobile device directly, but it would be difficult to persuade the user to install it. All the compromised PC is doing is, giving account numbers, and details about last few transactions etc to make it look authentic. But if such info is available from other sources, or if not all that much is needed to persuade the user to install that trojan, it is game over. The key to the whole thing is sneaking the trojan past without arousing suspicion of the user into the mobile device.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I was offered 2 online-banking systems while I still lived in DK.
Both turned out to use known-flawed Java 1.1 (or 1.2?) security routines.
When I asked the banks, I was told "We know nothing about this computer thing, try our provider" (scary)
When I asked one of the provider, I was told that, yes, they know it is flawed, but if they use anything more secure it will be too much work for people to log in (hint: Windows, at the time, came with the flawed version of Java).
Since then I've flat-out refused to use onlline-banking.
Note: I have found some credit-card issuers offer SMS-authentication (alongside regular passcodes) - not found one that actually manages to send the authentication-codes to my cellphone.
I RTFA and while the whole system is quite sophisticated with keylogging trojans etc, in the end it works on the few dumb users who will press an SMS link that says "To install the free cryptographic software on your phone, use this link".
Clicking a link on an unsolicited message and especially one that contains the words "Install" and "Free" means you should not own a smartphone, and probably neither a PC with a browser or email client.
In the end all that hard work from fraudsters gave them access to the money of people who are just a bit smarter than those who respond to the "You won the Spanish Lottery" or "I am the son of the late King of Zembla and have eleventy billion USD to deposit to your account".
I would be interested to find out if this scheme was more or less successful than the more common and much simpler "Click here to log on to your bank website and confirm your details" fake bank login scam. But I doubt the people who have the statistics on click-through rates etc of those methods would be interested in writing a paper...
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
I had some HR idiot in an ecommerce company working with banks send me a password protected zip file with the password included in the email, and apparently he'd been doing that every day in the name of "security" for years.
If it's not obvious, the above is actually no more secure than emailing the unencrypted document (since you effectively get that in a single message only with a bit of time to waste at both ends), and far less so if the person reuses passwords.
Belgium doesn't seem to appear on the list: we're quite a small country but at least our banks seems to take security a bit more seriously.
Here you MUST enter both the amount and the bank account number of the recipient as part of a cryptographic challenge: you need a special device (every customer gets one and they're all identical) into which you put your bank card and enter your PIN a first time.
If you're wiring to a new account (one you never wired any money too) or if you're wiring an important sum (even if it's to one account you already wired amount to), then you MUST enter both the exact amount, press OK and then enter part of the account you're wiring to.
You fail to do that and there's no transfer.
There's no way around that: you have to either steal both the bank card and know the PIN and know the user identification string (e.g. "e0391829") *OR* use social-engineering to manage to steal money.
Now the scary thing: you can wire up to about 125 000 Euros using your online bank account... So for a lot of people should they fall for social-engineering or should they have their card + PIN + user identification number stolen before they can warn the bank, it means they're lifetime savings can be stolen.
Quite scary.
I feel much more confident having a safe at the bank full of physical gold and leaving only what's needed to pay for normal expenses on my account ; )
Besides that gold did quite fine since 2001 ; )
I wish that there were a way to tell your bank that all electronic access is to be essentially read-only. I would like to make my bank login only allow viewing account balances and transferring money among that bank's accounts, and not even allowing seeing a full account number. For anything else, I can go into a physical branch.
Such a scheme would reduce attacks to someone annoying me by emptying my checking account into my savings account, causing overdrafts. A lot better than someone stealing my money.
Using a bank to store your money really ought to be more secure than putting cash under your mattress. It kind of sucks that it's gotten to this.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
How does this 'eurograbber' infect the online customers in the first place?
AccountKiller
...is WTF the bank app would need to install *ANYTHING* on their phone. SMS is supposed to work on my "dumb" Nokia 6015i http://www.cellphones.ca/cell-phones/nokia-6015i/ I can't install stuff on it. The whole point of SMS autentication is that you use a separate device (cellphone) to authenticate a transaction entered on your PC. Of course, the people who do their banking via mobile phone apps have zilch security.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Beats working.
That will only work with very poorly implemented filters. Of course a well implemented filter wouldn't block a legitimate executable file in a zip anyway unless that's the policy of the people at the site. If it is, get it changed instead of fucking about trying to hide stuff from broken mail filtering software.
I really don't understand why some software vendors think they can trust criminals to nicely use standard file extensions, and also why they are locking out one of the most useful formats for transporting a collection of files. The only reason that zop hack works is because the filtering software exhibits a dangerous level of trust and doesn't examine the file format.
The truly depressing thing is that it's some commercial filtering software that is broken and little or none of the free stuff (much of which is on some commercial filtering appliances or hosting solutions that have put work into integrating the free stuff in a useful way). With email filtering you typically pay more for hyped up pieces of shit instead of things that just quietly work.