Slashdot Mirror
Tinba Trojan Targets Major US Banks
An anonymous reader writes Tinba, the tiny (20 KB) banking malware with man-in-the-browser and network traffic sniffing capabilities, is back. After initially being made to target users of a small number of banks, that list has been amplified and now includes 26 financial institutions mostly in the US and Canada, but some in Australia and Europe as well. Tinba has been modified over the years, in an attempt to bypass new security protections set up by banks, and its source code has been leaked on underground forums a few months ago. In this new campaign, the Trojan gets delivered to users via the Rig exploit kit, which uses Flash and Silverlight exploits. The victims get saddled with the malware when they unknowingly visit a website hosting the exploit kit."
Tinba Trojan Targets Top Tender Traders?
Flash and Silverlight, Adobe and Microsoft, again -- and again and again. Is it the year of the Linux Desktop yet?
Everything in the Universe sucks: It's the law!
Say it isn't so! Flash and Silverlight got used as a security hole? Well, I'm truly shoc ... oh, fuck it ... this is exactly why I don't install this shit in my browsers, and why I don't let strange websites run scripts.
Flash has been a gaping security hole about as long as it has existed.
I can only assume Silverlight is little better, but the only browser I have it in is IE on a work machine because we need it to run some in-house software.
But I don't let that browser touch the real internet. Because I don't let IE access the internet unless every other browser has failed.
I'm afraid I no longer have any sympathy when I hear people got hacked via Flash. Because at this point, it's hardly surprising.
Lost at C:>. Found at C.
Your damn electronic contraptions still aren't ready for prime time. And you know what? The lines at the 7-11 don't move any faster either. Where's all this extra time these machines were supposed to give us? You people buy cheap shit, and this is what you get! HA!
It targets buggy so-called 'WINDOWS' product by microsoft corporation.
Attacks are possible only because of windows and its buggy design.
Will this 'banking malware' run on any other Operating System except Microsoft Windows? ref
Bank of America
Associated Bank
America’s Credit Unions
Etrade Financial Corporation
US bank
Banco de Sabadell
Farmers & Merchants Bank
HSBC
TD Bank
For anyone wondering....
BancorpSouth
Chase
Fifth third bank
Wells Fargo
StateFarm
Regions
ING Direct
M&T Bank
PNC
UBS
RBC Royal Bank
RBS
CityBank
Bank BGZ
Westpack
Scotiabank
United Services Automobile Association
Source: http://blog.avast.com/2014/09/...
Does EMET stop Tinba?
...if you're the bank. The people will bail them out again curtousy the US government and our trustworthy politicians.
Did anyone not see these local MITM attacks coming from a mile away? We already have existing options which do not allow these attacks ... why do so many banks persist in doing it wrong?
https://www.ebankingabersicher...
mTan and Mobile ID are mostly immune (phones can still be owned of course, but if you don't use a single phone for both banking and verification the odds of pulling off an attack are very slim). Flicker/Photo TAN are almost completely immune (unless the attacker can find a buffer overflow in the TAN devices). Everything else on there is antiquated crap which made sense when criminals were less sophisticated and when making TANs with larger LCDs and smart-phones was expensive ... those days are not today.
1. Don't use the same browser you do other surfing with... if you can. How safe is FireFox portable?
2. Educate yourself and never be too prideful to assume you know how to avoid being scammed.
No Java? DAMN! How are we going to rant at Oracle and rage about the Ask toolbar?!
1) Jobs was right about Flash. Adobe ought to b class-actioned for the pains Flash causes.
2) Silverlight is junkware anyhow.
3) Friends don't let friends use either.
4) Standards, people. Sheesh.
5) HTML 5.1 and beyond. Please no more company proprietary stuff masked as "de facto" standard!
It's getting to the point where I just want to do my banking in brick-and-mortar buildings.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Dear bank:
Please send me a bootable CD or other read-only media (i.e not a USB memory stick) that I can boot my computer with when I want to bank and a "password of the month" needed to log in in addition to my account name and password. To authenticate the CD, please create a signed hash for the CD and publish it in every major print newspaper in markets that you operate and publish the algorithm used to create the hash and the public key needed to verify the hash.
If I need to access my account remotely from a device that is not booted with that CD or from a machine that is not in a secure location such as one of your branches or a cooperating bank's branch or an ATM operated by an ATM operator that you trust, I will either visit a branch or log in to a secure terminal and retrieve a set of temporary one-time-use passwords that are valid only for a short period of time, only for transactions which I pre-designate, only for devices of specific types that I pre-designate (or "any" if I don't know ahead of time), and only for devices believed to be in certain geographic areas (i.e. where I will be traveling over the next few weeks). Thank you.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Is it time for banks to start issuing "limited use" credit cards?
Personally, I would love to have:
* A general use credit card # good for transactions up to $SMALL_AMOUNT_I_SET per transaction and $SMALL_AMOUNT_PER_DAY limit unless I specify otherwise in advance. This would be of limited value to a data thief.
* A travel credit card # that is good only at $CERTAIN_TYPES_OF_BUSINESSES like airlines, hotels, gas stations, etc. and only for dollar amounts typical for the particular merchant unless I specify otherwise in advance. This would also be of limited value to a data thief.
* An internet credit card # that is only good for goods delivered to pre-designated addresses and with a pre-set daily and weekly limit unless I specify otherwise in advance. Likewise, this would be of limited value to a data thief.
* For merchants that have recurring charges, like my phone bill, a unique credit card # just for them, one that would be worthless to a data thief.
* A relatively easy but secure (yeah yeah, it's a trade-off) way to pre-authorize short-term exceptions like buying a refrigerator or a large Christmas-shopping trip. Preferably this authorization would require two independent communications channels, such as me calling the bank and talking to a live human and/or entering a code number printed on my monthly statement prior to going online and making the authorization.
* Alerts for any activity that is over any limit I set or otherwise meets any fraud-related parameter that I pre-set (some banks allow this today).
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.