Forgot your password?
typodupeerror
Crime Security

Online Banking Trojan Stole Money From Belgians 144

Posted by kdawson
from the routing-around dept.
hankwang writes "Belgian authorities uncovered an international network of online banking fraud (Google translation; Dutch original), which has been going on since 2007. The fraud targeted customers of several major banks, which used supposedly secure two-factor systems that require the customer to generate authorization codes from transaction information (random code and amount or recipient's account number) that is manually keyed into a cryptographic device (Flash demo from one of the banks; manufacturer's website). Trojan horses that were planted onto the victims' computers would generate a fake error message and request that the victim re-enter the authorization code. This way, amounts up to €4,000 were transferred to money mules and thence to Eastern Europe. The worrying part is that many cases were never reported to the police, because the bank preferred to refund the money to the victim rather than risking its reputation. The extent of this type of fraud is unknown." The article mentions in passing that similar crimes are occurring in Germany and Sweden.
This discussion has been archived. No new comments can be posted.

Online Banking Trojan Stole Money From Belgians

Comments Filter:
  • sweden??? (Score:5, Informative)

    by lordholm (649770) on Monday July 26, 2010 @04:44AM (#33027128) Homepage

    The article does not even mention the word Sweden or Zweden. It does however mention Denmark, which is not equal to Sweden.

  • People (Score:1, Interesting)

    by Anonymous Coward

    Regardless of the effort or complexity, every security system has one inherent flaw.

  • Pay attention (Score:1, Interesting)

    by Anonymous Coward

    This should still be impossible if The user pays attention. The user could be tricked to re-enter the amount or the recipients account number repeated times. But for the attack to be successful, the victim has to be tricked into entering the attackers account number at some point. Before, the login procedure could be hijacked (since it required challenge of a random number) but these days that should be a recognizable number, for example starting with a specific digit.

    • Re: (Score:2, Informative)

      by MadKeithV (102058)
      I use the system mentioned in the article, and I've never noticed the log-in random challenge to have any recognizable number, nor do I recall any communication from my bank (Dexia) that this is so. If this is actually the case, it wasn't made clear to users.

      Potentially even more worrying is that this system is now also being applied to online payments using my Dexia VISA card, which is more vulnerable still because it originates at the merchant's site, and isn't always so easy to verify.

    • Re: (Score:2, Insightful)

      Entering some extra recognizable info in the 2-way factor authentication is indeed "the way to go".
      Account number is not that user friendly (and which number to enter if you have multiple transfers in one go?)
      My current online bank requires me to type in the amount of money to transfer as an extra fail-safe.
      This should be "good enough" for the near future.
      Sadly, many online banks do not have anything like this. Not implementing proper security and paying to "robbed" customers is apparently still the
      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Each (new) account number should be challenged.

        Like I said earlier, the biggest problem was the login challenge, but using a fixed prefix (not shared with any account numbers) is enough to avoid the login from being used to get the correct response from the attackers account number. I don't think this news is about a technical weakness but rather about customers using a system they haven't quite understood.

        • by emj (15659)

          Each (new) account number should be challenged.

          There are devices that ask you questions like: "Do you want to transfer 100 Crowns to the account of Emj", they just cost a lot more (like $10 more?). Your scheme is already being used on most devices I've seen, but users don't understand that they even miss that they are not using and encrypted connection.

      • by jonbryce (703250)

        An amount of money is not good enough, because the attacker just needs to see what amount you want to transfer and steal that amount for himself.

    • Re: (Score:3, Insightful)

      by ZeroExistenZ (721849)

      This should still be impossible if The user pays attention

      Well, you cannot expect the user to take this responsibility of "checking for a specific digit", they'll go to the competition if the procedure is too "complex". Why is Apple booming? Not because of feature-gallore.

      You cannot imagine how many emails I get of "regular users" who entered their login details on some random webpage resulting in a email to all contacts in a format "follow this link to see [facebook-style test results]" to be prompted to l

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        My bank simply states during the login that the login challenge number always starts with the digit 9.

        Unless I don't pay attention to that I could be on a fake site displayed by a trojan that challenges an attackers account number. There is no peactical way to prevent that. The system is "safe enough" even with ignorant users, and really safe with attentive users. It has worked for 15 years without big problems. To put things in perspective, ATM fraud and card skimming probably steals more money every minut

    • by Sabriel (134364)

      "the victim has to be tricked into entering the attackers account number at some point"

      If a trojan has control of your browser, what it sends to the bank doesn't have to be what you typed into the account field...

      • Re: (Score:2, Informative)

        by Anonymous Coward

        If a trojan has control of your browser, what it sends to the bank doesn't have to be what you typed into the account field...

        No, the user types the recipient's bank account number into his Digipass device in order to generate an authentication code.

        During a legitimate transaction, the website will tell you

        Enter the challenge code 138427, then the amount in euro 5600, then the recipient bank account number 98765432 into your card reader and enter the authorization code in the field below.

        However, a trojan could transform that into:

        The authorization code was incorrect. For extra security, enter the the following three challenge c

        • by SharpFang (651121)

          If the device requires only the last digit of the account number, you need a total of 10 money mules to capture money from all infected people.

      • Re: (Score:2, Interesting)

        by Mattpw (1777544)
        This is the problem with putting complicated user action into the transaction authentication process, if you control the browser you can request the user do just about anything in the name of a test or error as related in the article. My Passwindow method encodes the transaction information (ie destination account) into the challenge from the server so the user must only visually check the information, because this information is cycled alongside the authentication digits they are forced to inspect it and c
  • by arivanov (12034) on Monday July 26, 2010 @04:54AM (#33027180) Homepage

    There is a similar scam doing the rounds in the UK targeting nationwide which uses a rather predictable 2-factor (the amount of money and last digits of destination account are used as a challenge).

    The scam apparently asks you to "resync" your challenge device. If you do you end up sending a sum of money to a money mule.

    • by Mattpw (1777544)
      Do you have a link to any articles?
      • by arivanov (12034) on Monday July 26, 2010 @07:01AM (#33027802) Homepage

        No, but Nationwide has been using nagware banners that tell the customers that they NEVER ask them to resync the device for a few months now. From there on to deduce what the scam is is fairly trivial. Even if the scam was not around when they started the hint contained in the warning is sufficient for anyone clued up enough to design the relevant trojan by now.

    • Around here banks have limited the transactions for such "two factor" signing schemes to near nothing in favor of RSA based digital signing schemes that require you to use a pass-coded certificate on a chip card, that is also your national ID card, or a certificate on your cellphone SIM linked to the ID-card one.
      • Around here banks have limited the transactions for such "two factor" signing schemes to near nothing in favor of RSA based digital signing schemes that require you to use a pass-coded certificate on a chip card, that is also your national ID card, or a certificate on your cellphone SIM linked to the ID-card one.

        So? That doesn't solve the problem. You still have to enter the amount and destination account number onto an external device which then does the signing.. otherwise how can you be sure what you are signing, if your PC is compromised and anything on your screen could come from attackers?

        And, you have to be educated to what the numbers you enter mean, so that you cannot be scammed into sending money to someone else.

        • by Rich0 (548339) on Monday July 26, 2010 @09:57AM (#33029206) Homepage

          Agreed. I'd envision the secure "credit card" of the future having the following mechanism of operation:

          1. You interface the card with a computer (via USB, acoustic modem for phone, one-wire, etc).
          2. The remote party sends the card a packet with who is to be payed (in the form of a bank certificate), and how much, and whether any kind of recurring transaction is authorized (with details on that if applicable).
          3. The card displays the transaction info on a display built into the card.
          4. The user approves the transaction by hitting an approve button and typing in a PIN using a keypad on the card.
          5. The card generates a certificate and sends it back to the remote party.
          6. The remote party confirms successful receipt of the certificate to the card.

          The remote party and the card communicate by SSL (using bank-signed certificates), so no MITM, although the algorithm should be fairly invulnerable to MITM anyway.

          If there is a transmission error the remote party just asks for a retransmission any time until step 6. The card and the bank would both spot likely duplications. You couldn't spoof the merchant name (Gooogle Innc) or anything like that since it comes via a bank certificate. Nothing is trusted outside the card itself, so no risk of trojans/etc.

          All it needs is a credit card with a battery, display, keypad, and small CPU optimized for crypto. I can't imagine that these are more expensive to produce than the cost of bank fraud.

          You could even have cards that function as digital wallets, handling multiple banks, government IDs, etc. All it takes are some standards, and the right CAs for the right data items.

      • And, does it work with Linux? In my country they want to do the same thing, but I'm not going to play along if I require to run Windows or Mac OS X.

        • The cellphone part is system agnostic. Works anywhere, but it costs a small monthly fee. The smart card part is also system agnostic, it sucks everywhere. In theory it works in Linux, windows and Mac OS. In practice, the signing part works in Linux only if you are really lucky and your bank is not an asshat, ID part works quite well however. In windows it only works stably and sanely with IE6. Never got tit to behave with IE 7 or 8. In all fairness there is work twoards updated software that should improve
    • uses a rather predictable 2-factor (the amount of money and last digits of destination account are used as a challenge).

      What's the second factor?

  • How long until..... (Score:3, Interesting)

    by CastrTroy (595695) on Monday July 26, 2010 @04:58AM (#33027210) Homepage
    How long until we move to using dedicated terminals to access our online banking. A device that only did banking could be really cheap [cgi.ebay.ca]. Load a custom, hardened version of Linux on there, that only displayed a web browser, and only went to the bank's website, and you'd probably go a long way to stopping this, and many other kinds of fraud.
    • Re: (Score:3, Insightful)

      by phantomfive (622387)
      Sounds like an excellent plan. One you can implement personally for yourself right now (I personally discourage all my family members from doing online banking from a windows computer). You can have your own personal terminal at your house that you use to connect to the bank. If you think it is an idea people will like, you can start a business setting up similar terminals for other people.

      As for you question, how long: banks will not start sending out terminals to all their clients until the cost of p
    • by Zocalo (252965)
      Why would you need a dedicated device? You could quite easily do the same thing using a bootable, non-writable memory USB stick, and even combine the same device with a one time pin generator if you wanted to have a few extra security bells and whistles. I doubt we'd see such a device for any other platforms apart from those that are x86 compatible though, and even then it's not going to help against MitM attacks, DNS poisoning or any of the other attack vectors that don't target the end user's system, bu
      • Re: (Score:1, Interesting)

        by Anonymous Coward

        You can't prevent DOS type attacks, but you can prevent man-in-the-middle attacks (or at least make them useless) by strong end-to-end encryption. However, the encryption key would not be safe it it was on an USB stick... unless the USB stick in turn is encrypted with a password that the user must enter. Ok, that would work. Unless the attacker patches the BIOS to insert a keylogger or something.

      • Surely an even better idea would be some kind of read-only VMWare Appliance (or similar). User clicks a link on their desktop which launches a program that checks the VMWare image hasn't been tampered with (CRC and md5 or something like) and then boots a basic Linux VM which opens a kiosk-mode browser that goes straight to your online banking. Couple that with a proper two-factor hardware token and that should be good enough for most things. If the VM/Browser had draconian checks on things like SSL certific

        • Surely an even better idea would be some kind of read-only VMWare Appliance (or similar). User clicks a link on their desktop which launches a program that checks the VMWare image hasn't been tampered with (CRC and md5 or something like) and then boots a basic Linux VM which opens a kiosk-mode browser that goes straight to your online banking. Couple that with a proper two-factor hardware token and that should be good enough for most things.

          When you click the link on the desktop, how do you know it is really booting the kiosk-mode image, and not just pretending to? This is not a solution, you would need some kind of trusted boot process, and a reboot. Honestly a little cheap, offline device with a key in it and a little screen and keypad for entering the transaction to sign (or at least a screen to display the transaction) seems simpler and safer.

        • by nten (709128)

          I'm too lazy to think this through, but intuition says running a safe guest inside a compromised host isn't going to protect you. Motherboard firmware is already being tampered with too as another poster pointed out. I really do think a stand alone machine with dedicated hardware, locked down to do that one thing is in order. Final user wouldn't even have root (sounds kinda like an i-anything). I'd not do the read-only thing so that signed security updates can be installed from the creator. Its a weak-

      • by arivanov (12034)

        Rebooting the machine to do just banking? Joe Average User is not going to do that.

        Also, what exactly makes you sure that you have booted your USB stick directly and not in a VM? The technique of loading a hypervisor first before loading the supposedly hardened machine has already been demonstrated a while back. A small hypervisor + control software is the ultimate super-trojan. Works with Windows, works with Linux works with anything. It is not that difficult to implement either. Each drive has reserved sp

    • Re: (Score:3, Insightful)

      by Mattpw (1777544)
      Banks wont run the IT tech support required, and theres also the liability issues. Even if you could guarantee the software had no security bugs the user can just as easily fall victim to phishing type scams and then sue the bank, this is essentially the same problem with the bootable linux LiveCD concept which does guarantee no trojans getting into it but fails to prevent simple phishing. The tech support for all the different drivers and other things a person might use the terminal for would kill the bank
    • Actually what you are more likely to see is more people switching from the web to dedicated smartphone apps published by the banks and officially blessed by the smartphone manufacturer(apple,google,rim etc). Not perfect but closer to a standalone terminal and much more likely to see widespread adoption.
      • by emj (15659)

        dedicated smartphone apps [..] blessed by the smartphone manufacturer(apple,google,rim etc).

        There goes software freedom, there is no room for user created software on a phone that is used to identify you to your bank.

    • Re: (Score:3, Interesting)

      by SharpFang (651121)

      There is a system that is currently (AFAIK) uncrackable. Details of the transaction you sign are sent back to you through SMS with authorization code. So you know the transaction has been hijacked if the SMS contains wrong data. The code is one-use, generated by bank upon submitting the transaction for authorization.

      (of course this may still fall victim to people not reading the SMS beyond the auth code...)

      I guess it could be hackable if the attackers could hijack the owner's phone (make a clone of the SIM

      • by Mattpw (1777544)
        The simple way they get around the SMS without just putting a trojan on the phone like they do with a terminal is to just phone up the telecommunications company and say please transfer all my calls to xxx number, the girl asks what is your birthday (you google it) and the crime is done. The telecommunication companies cant increase the difficulties of authenticating users because of anti competition legislation which some used to lock in customers.
        • by SharpFang (651121)

          Nope, the girl asks what is your phone account management code. This is how it works with all operators in my country. If it's a birthsday in your country, it's completely retarded.

          • by Mattpw (1777544)
            If this is the case in your country I would just ring you up (or get an autodialer like they do with this scam in USA) and say "Hi im from (telecom company) we have some important information about your account but first I need to confirm your phone account management code". Actually I read about another version of the scam where the trojan would detect when the transaction was done and then they would would just ring up the number and say, "hi im from bank and we need to confirm a transaction you just di
            • by SharpFang (651121)

              1) Please send it to my mailing address. I have requested over and again that I do NOT consent to ANY telemarketing.
              2) Well, please do. I just performed it. I can give you the number I just used (it's been used up and it can only confirm that particular transaction anyway). I don't really see them being able to obtain anything of use to them.
              3) So they can DoS the transaction by cancelling the codes I receive. They still don't get me to sign transactions they want to perform.

              The possible scenario for hijack

        • This has happened in a spear phishing case in south africa. A woman went to the cell phone provider's shop pretending to be the man's wife and that he had lost the SIM-card, and managed to convince them to give her a replacement SIM-card, which was then used to receive the authorization code.

          And of course a legal battle started over liability between the bank and phone provider (not sure how or if it ended). Sure, the phone provider should not have given the SIM-card out, but does it follow that they ar
      • by hankwang (413283) *

        There is a system that is currently (AFAIK) uncrackable. Details of the transaction you sign are sent back to you through SMS with authorization code.

        In Netherlands, ING uses this system, but for some reason, the SMS includes only the total amount and not the recipient's identity. A trojan could simply wait until you try to transfer a large sum, and then make you sign for the same amount to the money mule.

        Apart from that, if your phone gives you access to your bank account, then you have to treat it as a credit card: never lend it out, always immediately have the SIM card blocked if you lose the phone.

        • by SharpFang (651121)

          Agreed, the amount alone is nowhere near enough. A hijacker can just replace target account number while retaining the amount. This one gives 4 first and 4 last target account number digits, so it's quite impossible this could be hijacked.

          Using SMS to control the bank account requires a separate PIN, different than anything else.

    • by laron (102608)

      The next best thing would be a dedicated live-CD for online banking. There is Bankix http://www.heise.de/ct/projekte/Sicheres-Online-Banking-mit-Bankix-284099.html [heise.de], but afaik only in German.

    • by knarf (34928)

      A device that only did banking could be really cheap

      Will the bank also charge $54 for 'shipping'?

      Don't fall for these eBay scam prices. They advertise low low prices with exorbitant 'shipping' charges to a) fool you into thinking this is a really good deal and b) pay lower eBay fees (which are based on a percentage of the purchase price, not the 'shipping' fees).

      • The "ebay-low" price is probably a scam(or just a link to something that is early in its bidding lifecycle/not going to hit reserve this round); but the real world cash-and-go price for those horrid little WinCE based 'netbooks' is $80-$100. Not quite as rosy as 24.99; but still fairly cheap and falling.
    • by tlhIngan (30335)

      How long until we move to using dedicated terminals to access our online banking. A device that only did banking could be really cheap. Load a custom, hardened version of Linux on there, that only displayed a web browser, and only went to the bank's website, and you'd probably go a long way to stopping this, and many other kinds of fraud.

      You could do it right now. Netbooks are cheap and easy things to get, just install your favorite Linux and you're done. Nota s cheap as your dedicated banking terminal, but

    • by discord5 (798235)

      How long until we move to using dedicated terminals to access our online banking.

      What? You mean like those things you see at a bank?

  • I'd say if it was Belgium, rather than the Netherlands, then the language in question was Flemish.

    • Re:Dutch original? (Score:5, Informative)

      by mrvan (973822) on Monday July 26, 2010 @05:33AM (#33027366)

      Flemish is a dialect of the Dutch language. I know, dialect is generally a political rather than a linguistic term, but:

      - The official languages of Belgium are Dutch and French (and German...), not Flemish and Walloon
      - The written languages are identical (except for some idiom)
      - People can understand each other without effort (except for heavy local dialects, which is the same in most languages)
      - Anecdotally, I think the within-country dialectal differences (e.g. standard Dutch versus Limburgs, Twents; "standard Flemish" vs. West-vlaams etc) are as great as or greater than the between-country differences.

      you should see Dutch and Flemish the way you see British English and American English, minus the spelling differences.

      • - The official languages of Belgium are Dutch and French (and German...), not Flemish and Walloon

        french - but with differences, well 17 for one.

      • although true of all the low countries, belgium is yet more cold and clammy and humid than the netherlands. this means people generally have a lot of mucus build up in their airways. so in belgium they speak their dutch with a more gutteral, throaty idiom

        thus, they speak "phlegmish"

      • by theNAM666 (179776)

        Actually, no. It's not that simple. American English and British English is a terrible, terribly deceptive comparison. A working class person who grew up in Gent 60 years ago, cannot necessarily understand someone from Antwerp-- and that's just Flemish/Flaams.

        For that matter, at least 20-30 years ago, a Genterner might have some serious difficulties with what was spoken in the surrounding villages. (Hint: hij, zij, jij are not entirely Genterner).

        There are plenty of arguments that Flaams is a se

        • All those are just dialects of Dutch. The official language of Flanders is Dutch (Algemeen Nederlands) and the version that is used in official communication (i.e. law texts) is not sufficiently different from the Dutch spoken in The Netherlands to call it a different language (which is the point the GP was making). The dialects you're talking about are never spoken between people from different cities (i.e. if someone from Ghent tries to communicate with someone from Antwerp, they'll use the Dutch they wer

      • by tpgp (48001)

        Thanks for the clarification - I can't believe quite how wrong I had that.

    • Re: (Score:3, Informative)

      by Anonymous Coward

      No, Belgium has three official languages: Dutch, French, and German (the first two account for the bulk of Belgian people). There are three dialect families of Dutch in the Dutch-speaking part of Belgium: Flemish ('Vlaams'), Brabantic ('Brabants'), and Limburgish ('Limburgs'). Sometimes all of these are lumped together under the nomer of 'Flemish', which is not really accurate.

      Anyhow, Flemish is certainly not a different language, and the language you find in written communication, such as the newspaper art

      • Re: (Score:1, Funny)

        by Anonymous Coward

        <homer>stupid Flanders.</homer>

      • by theNAM666 (179776)

        Bent u Flaaams?

        Belgium is a political entity which may not exist in six months, a fact that has something to do with all of these questions.

        The situation is thus quite more complex, as the cultural and linguistic lines are not quite so easily found-- and because Dutch is a historical imposition and the people whom the Dutch colonized were, after all, speaking their own languages before people showed up and put swords to their throats.

        Equally, the "French speaking majority" (itself a colonized group) wa

  • by Anonymous Coward

    The fraud dates from 2007, but it didn't go unnoticed for 3 years. The investigation took 3 years to complete because in Belgium the police does its job properly.

  • Money-Mules (Score:4, Interesting)

    by gweihir (88907) on Monday July 26, 2010 @05:29AM (#33027348)

    I can at least attest that the search for money-mules is getting more and more aggressive and annoying here. Everybody thinking of making some easy money that way should think again. If the original target goes to the police, the money-mule will have to refund the full amount of money lost and likely will get punished. The reason is that courts typically rule that the fraudulent nature of the job was obvious and hence the money-mule is an accomplice.

    • Brian Krebs [krebsonsecurity.com] is the go-to guy for backstory on the mules. Mules have to look "honest" to a banking system so they are really the tech-savy unemployeed being exploited by mafia.

      In a more depressing story the cost of Online fraud [krebsonsecurity.com] is charting to be almost 1B USD in a few years

      Nobody is reporting that this is not being shown on the balance sheets ... where are the Untouchables [fbi.gov] when we need them.

  • by noidentity (188756) on Monday July 26, 2010 @05:34AM (#33027372)

    (Flash demo from one of the banks; manufacturer's website). Trojan horses that were planted onto the victims' computers would generate a fake error message and request that the victim re-enter the authorization code.

    That's an excellent Flash demo. For some reason it asked for my account number and password. It's on a safe site so I went ahead and entered it, but it gave some kind of error.

  • My Passwindow method could have prevented this and cost practically nothing to implement too, the transaction verification method employed by the electronic tokens which do the transaction signing as explained in the article have the fatal flaw in that it requires user action for the transaction verification part. ie entering the website generated challenge and then their transaction destination account number etc (a very laborious process for the users). With passwindow the transaction information is encod
    • Re: (Score:3, Interesting)

      by hankwang (413283) *

      My Passwindow method could have prevented this and cost practically nothing to implement too,

      I suppose you mean http://www.passwindow.com/index.html [passwindow.com] ?

      As far as I can tell, there are two problems with this:

      • A Trojan could intercept enough data to reconstruct the mask. The whitepaper claims that you need to capture between 30 and 1000 transactions. That doesn't account for the fact that the trojan does not need to be 100% sucessful (probably the user can try 3 times).
      • Unlike an embedded EMV chip, the mask is trivial to copy; the owner will not notice that his passwindow card is missing. With a tele
      • by Mattpw (1777544)
        Yes, when the whitepaper was done and PassWindow was initially featured on Slashdot it was a static challenge with several digits in the static challenge, these were interceptable in say 30 interception so a month or 2 worth of normal use. However since then weve had some major breakthroughs beyond just switching to the purely animated cyclical method, weve been able to easily achieve interception rates of 10K plus with very little usability obfuscation. A side benefit of this new method is the analysis doe
  • Oh. Belgium!

  • by Anonymous Coward

    I'm from Belgium, i rather big websites and i reported fraud a couple of time, they replied to me with this:

    > We can't keep ourself occupied with 'things like this'.

    So the part about it being unreported might just be "undocumented".

  • "The problem with beauty is that it's like being born rich and getting poorer."
  • I'm torn between pity and some sort of vague feeling that justice has been served upon the Belgian public.

    On the one hand, nobody wants to see someone taken advantage of, and on the other, they *do* share a border with the Dutch.

  • From top to bottom the responses are:
    * 4.000 EUR is a lot for some people (Get of my lawn)
    * Link to FOSDEM (Free and Open Source Software Developers European Meeting)
    * Mac is more secure (Standard Mac Fanboy)
    * Banks are thieves (Standard non addressing the issue, just namecalling)
    * Make banking more secure (Blaming the banks, not the people who stole it)

    That looks like /. in only 5 postings.

    • by Mattpw (1777544)
      Dont forget me with my PassWindow :)
      *Works on any device irrespective of OS or software.
      *Doesnt matter if a trojan or malware is present on the device, assumes malware is present.
      *Costs practically nothing to implement.
      *Not vulnerable to phone based extensions of the above attack where users are called and socially engineered out of their authentication keys.
      • by Vegeta99 (219501)

        *Not vulnerable to phone based extensions of the above attack where users are called and socially engineered out of their authentication keys.

        Most cards say "Property of the bank, must be returned on demand" yadda yadda on the back. That given:

        Dear Bank User,

        As per the Terms of Services* in effect on your account on the date you signed up, we must request your bankcard be returned to the following address for security purposes.

        Please fill out the attached form, including PIN numbers and mail it to the addre

        • by Mattpw (1777544)
          Your right, someone could ask for the person to mail their card and they would also need to include their online username and password but for my liking this is getting too close to a rubber hose attack. It would only take one of the billion people who get such a letter to report the physical address to police and the whole scam goes down and also the attacker must start physically injecting himself into the scam which generally isnt the reason they got into online fraud in the first place.

          Still its an in
          • by Vegeta99 (219501)

            Late reply, I know.

            When I was young, a carder conned me in to being a mule for a single shipment.

            He had me find an empty house near myself, and post a note on the door. "UPS, I've moved, but I'm still in town. I forgot to update my address with $computer_company and accidentally had my order shipped here. Please put it on the back deck. -$victim."

            I grabbed a box of about a dozen Lite-ON CD-RW drives and reshipped 11 to random addresses. Never heard from that guy again.

            Thank god I was like 13. Looking back,

  • This is typical banking behavior when it comes to investigating fraud, they can not really prove THE CLIENT's COMPUTER was at fault...
    so once they see the problem being fraud in another country when the person is still here, they just block the card and refund whatever money they lost, and still the banks are showing all time high profit margins....go figure....make's you wonder just how much they really need to up their services charged for transactions all the time....!

  • "Trojan horses that were planted onto the victims' computers..." and no one noticed the horses? Mike
  • This is from the news site of one of the mayor Belgian television/radio groups (VRT), they have a selection of articles in English.

    Belgian investigators expose fraud
    http://www.deredactie.be/cm/vrtnieuws.english/news/100724_bank_fraud [deredactie.be]

  • Good to know that the company that makes these authentication keys are also the same as Blizzards and one more reason to opt out of Real ID.
  • overschrijvingen ondertekenen?
    C'mon, someone please post an un-encrypted version of the flash demo.

"The chain which can be yanked is not the eternal chain." -- G. Fitch

Working...