Category: Financial

Spyware Infection Spyware is usually installed without a user’s knowledge or permission. However, users may intentionally install spyware without understanding the full ramifications of their actions. A user may be required to accept an End User Licensing Agreement (EULA), which often does not clearly inform the user about the extent or manner in which information is collected. In such cases, the software is installed without the user’s “informed consent.”

Spyware can be installed through the following methods:
* Downloaded with other Internet downloads in a practice called “bundling.” In many cases, all the licensing agreements may be included in one pop-up window that, unless read carefully, may leave the user unaware of “bundled” spyware.
* Directly downloaded by users who were persuaded that the technology offers a benefit. Some spyware claims to offer increased productivity, virus scanning capabilities or other benefits.
* Installed through an Internet browsing technique called “drive-by downloads.” In this technique, spyware is installed when a user simply visits a Web site. The user may be prompted to accept the download believing it is necessary in order to view the Web page. Another method is to prompt the user to install the program through pop-up windows that remain open, or download the software regardless of the action taken by the user.
* Automatically downloaded when users open or view unsolicited e-mail messages.

Behaviors Associated With Spyware Spyware can be difficult to detect and remove because it:
* Does not always appear as a running program in the Window’s Task Manager; therefore, the user may be unaware that his or her computer is infected.
* May not include a removal option in the Windows “Add/Remove Programs” function. When such an option is present, the removal process may not eliminate all components, or it may redirect the user to an Internet site to complete the removal. This often results in new or additional infection rather than removal. In addition, some spyware includes a feature to reinstall itself when any portion is deleted.
* May cause a further infestation by installing other spyware programs onto users’ computers.

Risks Associated With Spyware Spyware increases the risk to financial institutions by:
* Exploiting security vulnerabilities or settings, changing the computer configuration to relax security settings, or allowing a channel into the institution’s systems by circumventing the firewall. The result is that attackers can eavesdrop and intercept sensitive communications by monitoring keystrokes, e-mail and Internet communications. This monitoring may lead to the compromise of sensitive information, including user IDs and passwords.
* Providing attackers the ability to control corporate computers to send unsolicited “junk” e-mail (SPAM) or malicious software (Malware), or to perform denial of service (DoS) attacks against other organizations.
* Draining system resources and productivity and consuming system resources, even when the user is not browsing the Internet, such as when adware1 results in voluminous unwanted pop-up advertisements.
* Compromising the bank’s ability to conduct business by disrupting Internet connections as a result of the improper removal of spyware.
* Increasing the incidence of SPAM to corporate e-mail accounts.

Certain types of spyware route all Internet communications through their own servers, often without the user’s knowledge. This allows a third party to read sensitive Internet communications even when Secure Socket Layer (SSL) or other encryption protocols are used.
* Compromising confidentiality. Other forms of spyware install an application on the user’s computer that monitors and records all Internet communications and sends the report back to the originator. Identity thieves may then impersonate the customer using the IDs and passwords collected.
* Phishing seeks to lure a user to a spoofed Web site using an e-mail that appears to come from a legitimate site.

Some of the Recommended Actions
* Ensuring that user settings are set to prompt the user whenever a Web site tries to install a new program or Active X control.2 If possible, configure the browser to reject Active X controls to lessen the likelihood that spyware could be installed on computers through normal Internet browsing. Some spyware installs its own trusted certificates allowing it to intercept secure Internet communications or the execution of malicious code.
* Analyzing firewall logs to determine whether a significant number of customers are connecting to Internet banking Web sites using the same Internet address.
* Investigating the implementation of multi-factor authentication methods, which would limit the ability of identity thieves to compromise customer accounts, even when a thief has a customer’s ID, password and account numbers.
* Adjusting browser settings to prompt the user whenever a Web site tries to install a new program or Active-X control.

http://bankinfosecurity.com/node/2566

Based on responses to its survey, Forrester concludes that an estimated 600,000 from a total of 15m subscribers have ditched online banking as a direct result of security fears.

Measures to restrict the functionality of some accounts (for example controlling how much money can be transferred on any day), stronger internet banking authentication and improved customer profiling are also needed to defend against security threats, it advises.

http://www.securityfocus.com/news/11305

“There are a couple of drivers that are convincing the banks to start rethinking some of their fraud management strategies,” Garcia says.

While some “new” fraud simply relies on technology to commit old types of fraud in different or faster ways – for example, the use of e-mail rather than traditional mail to commit “Nigerian banking fraud” – new technology-enabled scams also are emerging. One method that banks are adopting to battle such fraud is multiple-layer authentication, according to Bill Harris, chairman of PassMark Security in Redwood City, Calif. “The banking industry has spent the past year-and-a-half determining what is the biggest problem – keylogging, phishing, e-mail or something else,” he says. “Traditional authentication methods aren’t enough,” he asserts.

As a result, banks are using a greater array of information and multifactor analysis to lock down systems when fraud schemes are detected, Harris adds. User names and passwords should be supported in Internet banking transactions with new and better ways of authenticating genuine customers and identifying fraud artists trying to take over bank accounts, according to the summer update on identity theft from the Federal Deposit Insurance Corp. The extra security for online accounts often takes the form of multifactor authentication, which is used in addition to traditional passwords. The added security layers often include tokens issued to customers that generate new, random passwords every 60 seconds; software that can identify the computer from which a user is attempting to access an online account; or contacting customers by phone to make sure they legitimately are attempting to access their accounts.

In bust-out schemes, perpetrators wait until the victims have built up a significant credit profile with their banks, then use stolen ID information to “bust out” with an auto loan or some other type of credit and leave town, explains Garcia.

http://www.securitypipeline.com/167100429;jsessionid=U0KPRT5ITUVFWQSNDBCCKHSCJUMEKJVN

“We definitely want to lead the industry by making online banking more secure,” Bank of America e-commerce executive Sanjay Gupta said. “Right now, more than 50 percent of (banking) transactions take place online.”

The Charlotte-based bank already leads the U.S. market with 13.2 million online banking customers and 6.4 million people who pay bills online.

Bank of America launched its new online security system, called SiteKey, last month in Tennessee. It is being rolled out this week in Virginia, Maryland and Washington, D.C., and should be available nationwide by the fall.

Several recent highly publicized security breaches have made fraud prevention a top priority for Bank of America and other U.S. banks. In May, Bank of America and Wachovia Corp. were forced to alert more than 100,000 customers when New Jersey police charged nine people, including seven bank workers, in a plot to steal financial records of thousands of bank customers. In February, Bank of America disclosed that it lost computer data tapes containing personal information on 1.2 million federal employees, including some members of the U.S. Senate. The lost data included social security numbers and account information.

While the new system wouldn’t have prevented those breaches, it’s a sign of how seriously the bank takes the issue of security, said Jim Stickley of TraceSecurity Inc., a Baton Rouge, La.-based computer security company. “I think the reason they are doing it is because of all the bad press they’ve been getting,” he said.

The challenge questions – all things that only the customer would be able to provide, such as the year and model of their first car – are then used along with a customer ID and a passcode to guard access to the account.

Because so many Web sites now require passwords, many Internet users have become careless and create easy-to-remember passwords that tend to be easy to guess.

http://www.informationweek.com/showArticle.jhtml;jsessionid=Q20WOK44VGIHOQSNDBNSKH0CJUMEKJVN?articleID=165702498

The emails, which pretend to be from either the National Australia Bank (NAB) or ANZ, direct customers to fake internet sites.

ANZ spokesman Paul Edwards said the bank had identified the “phishing” scam, which triggers the release of a trojan – a program that installs and runs on the victim’s computer – after they click on the website link. Both banks said they had alerted customers through their websites and were working with the Australian Federal Police to have the fake internet sites taken down. Edwards said the ANZ was still investigating the extent of the hoax while Sabin said the NAB had already received 200 emails from customers alerting it to the scam.

http://www.xatrix.org/article3921.html