Bank Security Software EULA Allows Spying On Users 135
An anonymous reader writes Trusteer Rapport, a software package whose installation is promoted by several major banks as an anti-fraud tool, has recently been acquired by IBM and has an updated EULA. Among other things, the new EULA includes this gem: "In addition, You authorize personnel of IBM, as Your Sponsoring Enterprise's data processor, to use the Program remotely to collect any files or other information from your computer that IBM security experts suspect may be related to malware or other malicious activity, or that may be associated with general Program malfunction." Welcome to the future...
Bank Security Guy here (Score:5, Informative)
Just letting you guys know that some of us do give a shit. Can't say which bank though.
Re: Bank Security Guy here (Score:2)
Good for you. But will it change how the software works in any way?
Re: Bank Security Guy here (Score:4, Insightful)
It certainly won't change the fact that we can't run it on Linux and it is a pain in the ass under any platform.
Trusteer Rapport is a HORRIBLE idea and many businesses are being FORCED to deal with it because it is essentially mandatory for many banks (looking at YOU, Suntrust).
It is a totally unacceptable "solution" from an I.T. department perspective. And it is also unnecessary for many situations, if they just allow us some additional common-sense controls (like limiting access to just certain IP addresses, or using hardware token devices).
Re: (Score:1)
We're working with our internal legal folks to force this clause out of the EULA for all of our customers. Just letting you guys know that some of us do give a shit. Can't say which bank though.
Very cool! Good on you guys. I'm glad that not everyone is just taking this new clause lying down.
Re: (Score:2)
This software (peddled by my bank for years) claims to protect against keyboard intercepts - on Windows.
Snake oil of the first order.
Re: (Score:2)
I feel for you. That claim would be hilarious if it wasn't so serious.
Have you send them this page or something similar [keelog.com] and the question whether their sw also protect against those?
Re: (Score:2)
I think that's wise, since I can't imagine it holding up in court.
Re: (Score:2)
For individuals, probably not, at least not if you're somewhere like Europe where consumer protection and data protection laws tend to be taken reasonably seriously. I'm not sure how I'd rate my chances in most US jurisdictions without real legal advice, though.
For businesses, it could be a completely different story. For example, here in the UK, there are blanket consumer protection rules that make unfair contract terms unenforceable, but those rules do not extend to business-to-business contracts. Arguing
Re: (Score:2)
Shop elsewhere (Score:5, Insightful)
If a bank/CD/whatever other crazy thing requires you to install software to use it, take your business elsewhere.
Re: (Score:2)
?
That's what I'm saying; you don't need to read the EULA.
If you have to install software for something that has no business requiring you to install software, game over.
Re: (Score:2)
>"If a bank/CD/whatever other crazy thing requires you to install software to use it, take your business elsewhere."
You try telling that to your Finance Department or Board. We did- and it fell on completely deaf ears.
Re: (Score:2)
"requires"
not in BOA online banking (Score:2)
I just read through the Bank of America Online Banking Service Agreement, and I don't see anything like this, nor is there any mention of IBM. Reading the Wikipedia page, it seems this is software used -inside- a bank.
Re: (Score:2)
I was wondering that. When used with a website, it would have to be a browser extension.
In any case, this isn't too hard to defeat, just run it in a VM or a sandbox, and call it done.
Re: (Score:2)
I already do all of my banking from a VM that *only* does my banking.
Re: (Score:2, Informative)
Yes BOA pushes this:
https://www.bankofamerica.com/privacy/online-mobile-banking-privacy/trusteer-rapport.go
Re: (Score:2)
Let's be clear: This is an Opt-In "feature". It is neither mandated nor included by default.
(That doesn't make it less objectionable, but it does clarify how it could get onto your computer.)
Re: (Score:2)
>"Let's be clear: This is an Opt-In "feature". It is neither mandated nor included by default."
That completely depends on the bank and the type of account. It was not optional with Suntrust business accounts. We are forced to use that s**t.
Re: (Score:2)
Well, the original thread was on BOA. Sounds to me like your business needs to change its bank.
Re: (Score:2)
I wish we would. My pleas to Finance and Admin have been pretty much ignored. They don't think it is a big deal.
Not required - yes (Score:4, Interesting)
Re:Not required - yes (Score:4, Interesting)
Re: (Score:3)
I've noticed some mobile banking apps try to report back to the bank that your device is rooted, presumably so they can refuse to pay out in the event of fraud. For example, the Lloyds Banking app does it. Fortunately I firewalled it before opening it so I was able to see the report going out (and being blocked) moments before the "sorry, your device is rooted, can't run this app, use the web site" message appeared.
Heh, I wondered what that was (Score:2)
you remove stuff you don't know without Googling? (Score:2)
> I've been uninstalling the crap out of that program every single time a customer walks in with it installed because I didn't know what it was
So all of these customers chose to install something, and without knowing what it was, you just took it upon yourself yo remove it. All this time you've been "uninstalling the crap out of it every single time", you didn't take 10 seconds to check Google and find out what it is?
You might be very, very bad at your job.
Re: (Score:3)
You s
okay, so not because you didn't know what it was (Score:2)
Okay, so the reason you removed it wasn't "because I didn't know what it was", you had far better reason than that. Cool.
I'd expect no less (Score:3)
from the company that provided the data processing automation for the Holocaust.
IBM - tracking your Jews and other undesirables since 1933 (R)
Re: (Score:1)
Re: (Score:2)
Clearly, pens are immoral.
Re: (Score:2)
wrong, certainly holds up to close examination.
You only serve to point out the amoral greed of those in New York. You are saying the Nazi party platform was not well known in 1933 when Hitler became Chancellor and IBM made its first factory in Germany for long-term relationship with Hitler's government?
Trusteer is KRAP! (Score:5, Informative)
Don't get confused about the problem here. (Score:1)
To the guy suggesting we all run a virtual machine specifically to use online bank software. People shouldn't have to learn networking visualization because a clause buried in a EULA.
Check out this documentary: Terms and Conditions May Apply: http://www.imdb.com/title/tt20... [imdb.com]
Questions about this. (Score:1)
Illegal under US-Canada US-EU Data Treaties (Score:1)
Such automatic shrink wrap electronic contracts are illegal if used by dual citizens of the EU and/or Canada resident in the US, under the terms of the Data Treaties the US Senate signed.
Just saying.
Failure in EULA (Score:4, Interesting)
Usually, the software developer requires that you accept the EULA in order to get the right to use the software. Does that mean that you accepted the EULA if you use the software? It doesn't.
It means that if you use the software, you _either_ accepted the EULA _or_ you committed an act of copyright infringement. However, IBM cannot know which one. Therefore, they cannot do things that would be illegal if you didn't accept the EULA, like accessing your files.
(Many EULAs contain terms that allow you only limited amount of copying. That's completely legal, because either you accept the EULA and accept that you cannot make unlimited copies, or you don't accept the EULA and cannot legally make any copies at all. This EULA is different).
Re: (Score:2)
Might keep 17 U.S. Code  117 in mind.
Copying for purposes of backing up your software is legal. Period.
Re: (Score:2)
It means that if you use the software, you _either_ accepted the EULA _or_ you committed an act of copyright infringement.
It would be interesting to see what specialist lawyers in various jurisdictions would make of that argument.
If when you use the software you also rely on any permission granted by the EULA that you wouldn't otherwise have, this could be instant game-over if it was considered to imply that you had agreed to the EULA as a contract for that reason instead. And if you explicit agreed to the EULA to download the software in the first place, that's probably instant game-over as well. But if you were relying on th
Re: (Score:2)
The EULA is usually just a text file. You can edit it freely before installing the software, and then agree to whatever edits you made. In my experience they never bother to see if you made any changes, they just accept them blindly.
Re: (Score:2)
Why is any use without accepting the EULA illegal? Just because somebody says I have to sign a paper to use something I just bought doesn't mean I have to. (Doubtless some software is set up so getting around the EULA would fall afoul of the DMCA, but I'd be interested in knowing what I could do with a legitimately acquired copy of the software if I managed to legally bypass the EULA acceptance.)
Bank Security Software? (Score:1)
Quoting Kael'thas, eh? (Score:1)
"Welcometo the future. A pity you are too late to stop it. No one can stop me now!"
Avoid online banking (Score:1)
Not everyone has this luxury, I understand, but surely 99% of the population can do without it?
How much convenience are most customers really getting over using in-bank kiosks and ATM machines in order to configure automated payments and the like.
Maybe it's just me, but I think banks being exposed to the Internet for what appears to be a small amount of convenience is just insane.
Thank good it works with XP (Score:2)
It _has_ to be secure.
Re: (Score:3)
Of course it works with XP! XP has by some margin the highest level of compatibility with malware.
Why are banks pushing this crap? (Score:2)
Why are banks pushing this crap in the first place? I can't see entities like Bank of America spending their own money on security stuff unless its going to cost them more money not to.
Re: (Score:2)
Why are banks pushing this crap in the first place? I can't see entities like Bank of America spending their own money on security stuff unless its going to cost them more money not to.
You are absolutely correct with your assessment. And your conclusion.
Re: (Score:2)
Why are banks pushing this crap in the first place?
For one, because they believe it allows them to shift liability for fraud onto the consumer. "Oh, your online banking credentials were compromised and your life savings was irrecoverably transferred to Outer Elbonia? And you didn't have our Trusteer software installed, as required by our terms of service? Very sorry to hear that, I guess you're shit out of luck, maybe you can ask the federal government to bail you out (insert raucous laughter here)."
No Linux Version (Score:2)
Strangely, I'm not that concerned. I would download and use if I used Windows though, even with the new EULA.
Re: (Score:2)
Me too. But then again, I do my online banking in a VM, so...
Ok, this is NOT how it is done! (Score:3)
I wonder who was the genius who consulted the banks on this one, but my recommendation is to fire him.
Out of a cannon.
From the top of your HQ building.
I do consultant work in the banking area. And the VERY LAST thing you need in this time and age is your customer to lose trust in you. It's the ONLY friggin' thing you still have, for crying out loud! And it's not like you're swimming in it in the first place, do your research (we did), the average customer places little trust in you. The only group of people that beats you in terms of untrustworthiness is politicians and other criminals.
The other end of the spectrum is God. Yes, people place more faith in their imaginary friend these days. THAT's how far we got.
Now, I know that you're not after their personal photos and their game cracks. Because you don't care about that shit. And yes, I have had that discussion with various banks and various security companies myself. But, and this is the critical part here, you HAVE TO keep your customer in the illusion that HE is in control. That HE gets to say if and whether you get any kind of data from him. That is CRITICAL!
This will create a huge stink now. When all you had to do it is add a simple dialogue saying "Oh, there's something fishy here, we found this file and it looks like malware. Your security and that of your money is our primary concern, and we have this partner here who is our security expert, they'd look at it FOR FREE, we foot the bill, since our business has always been to make banking a safe and secure biz. You ok with sending us that file?"
9 out of 10 people click yes on this anyway (run the phrase through your PR goons a few times, add a little fear mongering and it's 99 out of 100). Screw the 1% error margin, you get what you want and instead of now being seen as yet another power hungry, data grabbing leech you'd be the saint.
Fuck, how did you drop the ball on marketing? That's the ONLY thing you're still good at!
Re: (Score:2)
This is impossible for all practical purposes. Online banking suffers from one fatal flaw that can hardly be remedied: You are required to trust a machine that is, as you put it so eloquently, inherently untrustworthy.
Telling people this is no option. Because then people would stop doing online banking and return to going to their bank for all their banking businesses. And in case you didn't notice, there are BY FAR fewer tellers in banks today than there were 20 years ago. The banks could by NO means deal
This is normal and typical of IR tools (Score:1)
To clarify what Trusteer is and isn't (Score:1)
Lots of apparent confusion here as to what Trusteer is and isn't.
Trusteer is sold as a "holistic" solution. I don't have much experience with what they do in the browser, but it's also built into mobile banking apps. It's an anti-fraud measure (which isn't inherently bad, we all like to keep our money), and as such it's always used in a customer-facing way, not inside a bank. Most customers using mobile banking apps will probably never see a Trusteer EULA, as this would be covered by the bank's own legal bo
Re:How crazy (Score:5, Informative)
Security scanning software that looks at all of my files? How will I be violated next? /sarcasm
Seriously, these privacy alarmists are kooks. They have no idea how IT works.
There's a big difference between scanning files and collecting them.
Re: How crazy (Score:3)
Then buy a work PC for home use.
Next problem?
Re: (Score:2)
Then buy a work PC for home use.
Next problem?
That's not the right answer, the right answer is "Tell your employer to buy you a computer for work use at home." I don't mind using my home computer to do work, but not if my employer is going to mandate what software I run on it. If they are worried enough about my computer being a risk unless I run their security software, then they ought to be worried enough about my computer to want to manage the entire computer - both hardware and software... not just the security software.
Re: (Score:3)
That's not the right answer, the right answer is "Tell your employer to buy you a computer for work use at home."
That's an improvement, but in many cases a better answer will be "Don't work from home at all, and if your employer doesn't like it, find a better employer".
The way it's just taken for granted that a lot of staff will continue to work outside office hours is a damning indictment of employment culture in some places today. This is just like the debate over BYOD vs. employers providing a separate company phone, where it is often taken as axiomatic that everyone needs company stuff on a phone somewhere so thei
Re: How crazy (Score:4, Insightful)
I work with teams in the U.S. and Canada, Mexico, Britain, Australia, India, and the Philippines. I have no normal working hours any more.
But my employer does not require me to do 8-5 and will other hours. An 11pm call either leaves me staying the next day at 10am, or
taking the 2nd day off.
Re: How crazy (Score:2)
No, until they find a Filipino who can remember how things worked before the current issue was raised. That's somehow become very difficult. Then I move over to the Dark Side and get more pay for interfacing with them. But not until.
Trust me, if the kill off our team and let the Filipinos do it. The ticket count will triple. They will still need someone to consolidate, properly categorize, and track. They were never able to do so with the US team for 14 years. I'm not yet quaking in my boots that they
Re: (Score:2)
I remote in when I work from home. Unfortunately, this isn't officially supported from a Fedora computer, but nobody at work cares what sort of files I've got on my home computers. (Downloading company files to my computer to work on them is strongly discouraged, as the company likes to keep tight control of their stuff.)
Re: (Score:1)
Perhaps they might ask me "Hey, our security scan detected this suspicious looking file on your machine; do you mind of we take a copy of it so our engineers can examine it?"
With that level of information, I can decide whether to let them have "stuxnet.exe" or "specialwifepics.zip".
Re: (Score:3)
No, it appears that YOU know nothing about IT.
Or more, likely, the shill is strong in this one.
It is a pretty normal and well understood process these days of requesting user permission for a specific upload of information to a vendor (for exmaple 'this program has crashed, can we please send the crash report back for analysis'
Them being allowed to scrape anything they damn well feel from your computer without any direct permission is, as anyone with a functioning brain knows, a HUGE step beyond that.
Re: (Score:2)
that they try to find infection on their own computers/honey pot or whatever? ..how do you propose that they decide if the suspicious file hasn't gone and encrypted itself inside your family photos without them downloading them just for kicks? or into your big businesses yearly finance report, that the random tech guy over at rapport can take a glance at without oversight?
Re: (Score:3)
There exists the possibility that someone knows how IT works and yet still does not approve.
Re:How crazy (Score:5, Insightful)
Yeah I trust IBM to only use the software to remotely collect *malicious* files from my system, I am sure IBM never receives confidential requests from the NSA or anything like that. *rolls eyes*
Re: (Score:1)
> shemale porn
And if he's really scared, he can just Bailey out of the agreement.
Re: (Score:1)
Re:How crazy (Score:4, Interesting)
Yeah, don't use your general-purpose computer for multiple purposes, that's just crazy!
It is crazy. Stop doing that. Just stop.
I do all my banking (and brokerage etc) from an encrypted VM used only for that. Never cross the streams.
I figure my gaming box is infested with rootkits constantly at war with one another from game DRM. That's fine - only games go there.
I treat my general-purpose VM as suspicious, and if anything ever looks off I'll just re-clone it from the base image, but there's lots of malware these days that's damned hard to spot.
Other VMs are for short use for special purposes - banking, ripping, etc, and can be reverted to snapshots regularly.
Of course, all that's useless if you don't keep your VM software patched. VM escape exploits are quite rare, but there have been more than 0 of them!
Re: (Score:2)
Something like what you describe should be the norm, and modern operating systems should enforce strict scoping rules for different applications and data. It shouldn't even be possible for a lot of these DRM or anti-cheat systems to work, because they fundamentally rely on doing shady things that no application should ever be allowed to do by the host OS.
Sadly, no mainstream desktop OS defaults to working this way, which makes your perfectly logical response also an unrealistic one for the vast majority of
Re: (Score:3)
Oh cute. You think a VM is going to protect you from the host.
I think he runs everything in a VM -- different VM's for different tasks, the only thing the host does is run the VM's.
If this is the case, this does give him good protection from malware - even if the VM used for downloading pirated software gets infected by malware, it's going to be hard (but not impossible) for it to infect the host then then jump to his online banking VM.
Re: (Score:1)
He is talking about his gaming PC, you can't really run modern games inside a VM and be happy about it.
Re: (Score:2)
The host does nothing. I'm sure the NSA could hack it remotely, but none of the normal consumer attack vectors apply.
Re: (Score:2)
So, assuming those VMs run Windows, you're fine with buying a new copy of the OS for each of them just to increase security.
You're cute - I like you.
Re: (Score:3)
Yeah I trust IBM to only use the software to remotely collect *malicious* files from my system
Hey everyone! I've found somebody that trusts IBM!
Congratulations, Sir. You have joined a very elite club whose number (for some unfathomable reason) continue to shrink every day.
Re:How crazy (Score:5, Informative)
It wasn't alarmist when Rapport compromised the integrity of the computer I use to earn my living with a bad update. Boot from recovery disk, uninstall Rapport, revert to previous known good configuration, and the problem goes away. Let Rapport back on, computer immediately fails to boot again.
I told the bank in question that the software they asked me to install wasn't working, and now every time I log in to their business banking site, and I decline to use Rapport selecting the option that says it didn't work for me, they tell me that Rapport has been tested by them. So not only do they want me to install malware, but my bank is also incompetent at security. Great, now I'm really thrilled to be trusting them with my company's money!
Re: (Score:3)
That is not the only way that (some) banks are incompetent at security. Their 'secure' internet banking sites only support SSL3 & TLS1.0, they prefer RC4 ciphers and do not offer any ciphersuites using PFS.
Re:How crazy (Score:4, Interesting)
Luckily, those of us running businesses don't need to worry about this, because the regulators probably won't let banks assign liability for fraudulent use of our accounts to us if it was their own negligence or incompetence that resulted in any losses.
Oh, no, wait. That was for personal bank accounts used by private individuals. As a business, the situation is unlikely to be a happy one if anyone does compromise your accounts because of these kinds of obvious security problems and you lose money because of it.
I've actually met small business owners who refuse to use on-line banking to this day because of this one issue. Personally, my businesses treat on-line banking as a business risk, keep careful records as we do with anything, but refuse to use Rapport since it has been found to destabilise our systems.
Re: (Score:2)
There's a financial website I have to use (for reasons I won't discuss here) that requires passwords to be 6-8 characters, alphanumerics only, and beginning with a letter. Talk about security...;.
Re: (Score:2)
And we're currently exploring our options for a move, due in no small part to the poor on-line banking at the current place. Sadly, it turns out that many of the alternatives are also bad one way or another, and in almost every case it takes a crazy amount of effort even to arrange a sensible discussion about possibly moving new business to a bank. Since we're talking about small businesses here, so the same people who need to deal with the banks also need to do real work that brings in revenues and pays ev
Re: (Score:2)
Given the precautions I take and the checks I made at the time, including scanning the machine in question for malware using an independent, known good boot disc, that seems unlikely. It would require a firmware-level infection or a stealthy infection that could hide from multiple malware scanners, either way exhibiting no apparent symptoms before or since, to cause the clash you're suggesting.
Re: (Score:2)
You will always have the choice whether to install this software.
A bank account is quickly opened. And closed.
Re: (Score:2)
Perhaps companies should make all employees undergo psychological testing to root out these pathological personality types and make sure their actions are monitored.
I have this suspicion that the do, and depending on your pathological level you might be selected for marketing or even management.
Re: (Score:2)
Problem is, if the recent years are any indicator we'd get to foot that bill again.
Banks are too big to touch now.
Re: (Score:2)
Legally? Who gives a shit?
You think any copyright troll would dare going after a BANK?