Slashdot Log In
Largest Ever Online Robbery Hits Swedish Bank
Posted by
Zonk
on Fri Jan 19, 2007 02:09 PM
from the put-your-bits-up dept.
from the put-your-bits-up dept.
ukhackster writes "A Swedish bank has fallen victim to what experts believe is the biggest online robbery ever. A Russian gang apparently used keylogging software to steal around one million dollars. It appears that most of the victims weren't running security protection. The bank is refunding everyone who lost money (even if they hadn't taken precautions) — good news for the victims, but not really an incentive to take more care in future. From the article: 'Nordea believes that 250 customers have been affected by the fraud, after falling victim to phishing emails containing the Trojan. According to McAfee, Swedish police believe Russian organised criminals are behind the attacks. Currently, 121 people are suspected of being involved. The attack started by a tailormade Trojan sent in the name of the bank to some of its clients, according to McAfee. The sender encouraged clients to download a "spam fighting" application.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
In other news... (Score:5, Funny)
Re:In other news... (Score:4, Funny)
"Yorn desh born, der ritt de gitt der gue, Orn desh, dee born desh, de umn børk! børk! børk!"
Parent
Options (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
According to whom?! (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
Also, McAfee did provide details on the trojan. Read the third, fourth and fifth paragraph of the article. Read the article next time.
Re: (Score:3, Informative)
I am not surprised... (Score:2, Insightful)
Those who are not into technology have no idea.... Look at my latest journal [slashdot.org]. You can have a PhD and fall for the simplest scam there is. Computers do seem to have this effect on people: their common sense fails because computers are somehow "Magic".
It's tragic if you ask me.
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Crime Doesn't Pay (Score:3, Insightful)
Re: (Score:3, Insightful)
$1,000,000 divided by 121 people = 8264.46 per person. I'm convinced taking people's money through legitimate avenues is easier than through crime.
Whilst this may be true in a country like the USA, it's worth noting that the difference between average incomes between western Europe and Russia make it more profitable than it might seem at first glance. The average yearly salary in Russia is around $4800, whilst the average salary in countries like the US and Sweden is about 8 times that.
Multiplying by 8 gives $66,116, and whilst I suspect such a figure would still not be worth the risk of being caught (and with 121 people involved, there's got to be
LULZ (Score:5, Funny)
the hard part (Score:4, Interesting)
The trick is getting cash transfered from someone's bank once you have their credentials.
Re: (Score:2)
Re: (Score:3, Informative)
Two-factor auth is really not that useful. Indeed, n-factor is not better than single factor. What is required for a transaction to be secure are the following:
Without BOTH of those, no additional factors will help.
Here's a short description of how the basic attack works. Your second factor is a SecurID or CryptoCard token. You key in your pin number and the value currently shown on that to
Re: (Score:3, Insightful)
Or possibly not a DNS lookup. Possibly just delaying ACKs and stuff on the outbound TCP connection to make the connection open more slowly and delay any useful receipt of data... or inserting bogus NAKs or... could be anything. The point is that an attacker would do something to delay the connection.
These sorts of flaws have been talked about for a while now. Man-in-the-middle attacks are hard to protect against, and impossible if one endpoint is the untrusted man in the middle. In this way, it is bas
Re: (Score:3, Informative)
Think it through: I have a keystroke logger on your PC. You type in your username (something you know) and your SecurID code (something you think you have
For these purposes, the SecurID
the ends justify the means? (Score:3, Funny)
the 'spam fighting' app almost did exactly what it was deceptively claiming to do;
bankrupt the people, force them to sell their technological idolatry, bam-- no more spam.
Victims (Score:5, Insightful)
No, that merely changes who the victims are. There is no such thing as "good news for the victims" unless the stolen money is recovered.
FDIC? (Score:5, Informative)
And yes, I think that it is good that the bank is reimbursing the idiots that fell for the scam, however I hope they now include somethign that say "if it was your fault some one else gained your PW, then it sucks to be you", AND they provide much better security (virtual key pads, multiple randomly selected questions) AND make them mandetory!
For those of you who have an ING account you know what their security is like. Nothing much that will hamper a real customer, but things that should stop non-customers.
Re: (Score:2)
I don't think so. The FDIC is more of a surerty for the bank itself. In this case the bank wasn't actually the one robbed, the customers were digitally conned. It's a good business for FDIC itself as your premium as a bank would depend on your fraud record.
[this] bank is being pretty cool about it, probably because the phishing e-mail containing the trojan appeared to come from the bank's domain. Its a semi dangerous public
Human factors (Score:3, Insightful)
We'll never get decent security as long as we set traps for users and call them idiots when they fall in.
The email containing the Trojan came from the bank's domain, apparently. Is it the fault of the users that email isn't authenticated? Are they idiots for not knowing how SMTP sessions can be spoofed?
How many places require software downloads to work? Include Flash and PDF readers in that list. Are people idiots for installing something that any non-expert would think came from their bank?
Do we
Re: (Score:2)
single use keys should make a keyloger pointless. I actualy like that method more so then the other company. If they are generating codes based on a static pin, that must be crackable.
I still preffer ones that have a decent selection of possible questions you will be asked (making a keyloger that much less effective), a VPK for your PIN (AKA your keyboard can NOT enter your pin), and an identifier (Picture+phrase) so you know you ar
Sounds easy enough... (Score:2)
Re: (Score:2)
That's the problem, it's too easy. Robbers spam bank customers with phishing attack. Out of the thousands of customers, 121 dumbasses fall for it. Robbers transfer funds. Robbers go on vacation and buy a car. End of story.
You're missing all of the critical pieces of a Hollywood heist movie. No hostages? No hereos? No fictional wonder tool fabricated out of duct tape a an old microwave oven? There's not even room for a car chase or an explosion.
On another note, there's no
1 Million Dollars? (Score:2)
121 people involved? (Score:2)
Quoted.. (Score:3, Funny)
Incentives for The Bank (Score:3, Insightful)
All that not refunding the customer's money would accomplish is hurt a lot of people and discourage people from using online banking or encourage them to change banks. People are never going to become security gurus just so they can bank online and if you make banking online too risky or hard they will just give it up.
By making sure it is the bank who has to pay for security losses while still making sure people have some incentive (annoyance, possibility they might pay next time or lossing $50) to be safe you end up with the best results. The bank is the entity that can roll out new security solutions and most easily improve security practices so giving them incentives to improve security is the best move.
Re: (Score:3, Insightful)
What bank issued your credit card? I've had to reverse charges multiple times for different reasons. I've been billed twice for the same item, I've been billed incorrect amounts, I even reversed a Paypal charge because the seller never sent the item.
In all cases it was simple (I have Citibank cards). Call up and tell them what charge you are disputing. Immediately you get a conditiona
Re: (Score:3, Interesting)
There's a rather humorous corollary to this, and since I feel loquacious
How about suspending accounts? (Score:2)
I'm hoping that the banks at least suspended and revoked the privilage of online banking from the users in question. If you can't take care not to download trojans/etc online that affect online banking, you shouldn't be allowed to do your banking online.
Re: (Score:2)
Bank: You all suck at online skills, so you can't use our online banking services!
Customers: Bye!
Bank: What?
Ex-Customers:
simple, aint it? Also, actions like that will also have other customers leave.
However, in reimbursing the customers, despite it being their fault, they have created a VERY good image for the bank.
not really an incentive (Score:2)
Largest ever robbery? (Score:3, Interesting)
Anyway, I highly doubt that this was the largest ever online robbery, maybe it was the largest phishing attack.
Re: (Score:2)
Predefined one-time keys are insecure (Score:5, Informative)
I was curious about the security protocol for Nordea bank and although links on the Nordea site are currently broken (an attempt to cover up?), I could find them on Google.
So the scammer just needs the fixed PIN code, plus a few of the one-time codes.
I used to have a bank account in Sweden with a different bank that uses a cryptographic challenge/response key generator, both for logging in and confirming a transaction. The website supplies you with a code number that you enter, as well as a PIN code. The device uses the code together with a secret key and the time from an internal clock and lets you send back the data.
Banks here in the Netherlands use similar systems, often with a generic card reader that uses a chip that is built into the bank cards. Others send a confirmation code by SMS to a mobile phone number that is registered to your account.
I think cryptographic systems are inherently much more secure than predefined one-time keys. The cryptographic keys are only valid for 30 seconds and, more importantly, only for a specific transaction. Keylogging wouldn't help the scammer; instead he would have to take over the entire browser in order to actually display your transaction information together with his transaction challenge code.
Re: (Score:2)
Some banks have gone a step further and made the transaction amount as part of the challenge, meaning that even an attack like this would fail (since you transferring $20 to your landlord wouldn't match his attempt to withdraw all $21.54 in your account)
Re: (Score:2)
Short time keys make the interception slightly more difficult, but essentially the intercept software would just have to immediately use the collected keys in the alternate transaction, rather than save them for later use. Same with SMS, or anything else; as long as the customers PC is compromised, there's no way to guarantee that what the customer sees is what the bank sends, or that what the custo
Disappointed in you /.ers (Score:4, Funny)
In Soviet Russia, key logs you!
Or even better. In Soviet Russia, you gulag.
Perhaps, in Soviet Russia, bank robs you!
One last note, in Soviet Russia, Russian reversal jokes are funny.
It's a Windows trojan (Score:2)
The sender encouraged clients to download a "spam fighting" application.'"
The trojan in question only runs on Windows [symantec.com].
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
I'm not knocking Windows, the users contributed by not running antivirus software and not being terribly bright. But this is why I don't ever access any of my banking or investment accounts with Windows.
Just makes it that much harder to automate installation of a keylogger
incentives are where they belong (Score:3, Insightful)
Consumers are told by people who market computers that they are easy and safe to use. Consumers are told by internet service providers that online services are easy and safe to use. Consumers are told by banks that online banking is secure and convenient.
Aside from the criminals, who appear to have escaped without any consequences to them, the burden is falling where it should be, namely on agents who allow marketing over reality. While the
The customers didn't lose money. (Score:5, Insightful)
Antivirus may not help (Score:3, Insightful)
Often these guys use directed fraud mails written in reasonably good Swedish, so I wouldn't really doubt they have custom made keyloggers too to attempt to escape antivirus tools.
Sure, they could use detection by heuristics like some support, but then the accuracy falls rapidly, as well as the fact that not nearly all popular tools even supporting that.
What's needed here is that users don't become so naive when they sit down in front of a computer. To many, it seems like they then enter a world of safety where they don't have to think much and just click through mails that "look right" even if they ask for logon details that the banks has earlier been very careful to inform they'll never request. (because they already have that info, or can reset it at their whim anyway, duh!) The problem is that on the Internet, the exact opposite mostly holds true.
Re: (Score:2)
The phishing (well, not really phishing in my mind) emails told the people to download and install anti spam software, and they did. No exploting holes in outlook or IE, none of that, just simply tellign poeple "Installer our keylogger. err, I ment to say out "anti-spam" software, yah...". It would have worked for Mac, or *nix, or anything else (It probably DIDN'T work for them, simply b/c the attackers did not see it as worth spending the extra time t
A Digipass make it secure? (Score:3, Insightful)
If your computer has been rooted, it really IS ball game over. Just sitting here thinking how I would exploit a rooted system that someone uses for banking...
1 - establish account offshore that offers SWIFT transfer (or other convenient inter-bank wire), and can deal with bank that requires no ID.
2 - Monitor victims on-line banking activity for a couple of months.
3 - Intercept after online session has next been established.
4a - Inject low level "noise" transfer, if victims balance is medium le