Slashdot Log In
New Zealand Banks Demand a Peek at User PCs
Posted by
Zonk
on Fri Jun 29, 2007 12:25 PM
from the see-you've-got-some-porn-there-sir-good-job dept.
from the see-you've-got-some-porn-there-sir-good-job dept.
Montgomery Burns III writes with a link to a ComputerWorld article on a ... unique approach to bank security. New Zealand financial institutions are looking for a way to access customer PCs used in online banking transactions. Their goal is to verify the security of the user's terminal. "Under the terms of a new banking Code of Practice, banks may request access in the event of a disputed transaction to see if security protection in is place and up to date. Liability for any loss resulting from unauthorized Internet banking transactions rests with the customer if they have 'used a computer or device that does not have appropriate protective software and operating system installed and up to date, [or] failed to take reasonable steps to ensure that the protective systems, such as virus scanning, firewall, antispyware, operating system and antispam software on [the] computer, are uptodate.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Just what I'd tell the bank (Score:2)
The Death of Online Banking (Score:2, Funny)
Re: (Score:3, Insightful)
Bank: "Yes, at 0325 yesterday your account was logged into and the money transferred"
User: "But I didn't do it!"
Bank: "Well, sir, the proper login and password were used, and our logs indicate it came from the same IP address your previous transactions came from. If you did not personally do it, did soeone else in your household do it?"
User: "I live alone, and I work night shift. No one was at the house last night"
Bank: "We're sorry sir, but it sounds like you have been a
Re:"Rooting around" is probably paranoid ... (Score:5, Insightful)
Well, even that seems objectionable. The only reason they would need to do that is if there has been a loss and they want to pin it on someone other than themselves. So, they aren't even "looking" at the computer, they are there for one and only one reason, document security holes. Whether one of those holes were used doesn't matter. If they document enough, then they will shift the blame to the customer. Why should I go out of my way to help the bank deny me the money I deposited into it?
Parent
Rediculous to require a subpoena ... (Score:2)
Go to a judge, and ask for a subpoena?
That is rediculous, that is equivalent to saying a customer should have to sue the bank to get their money back rather than have some prearranged agreed upon process. If you want to bring the courts in on such transactions consider how the judge is likely to rule when it is discovered that the customer didn't have current anti-virus, etc. There is nothing wrong with having some prearranged agreement, and nothing w
Re:Rediculous to require a subpoena ... (Score:5, Interesting)
Cheers.
Parent
Re: (Score:3, Informative)
For example how many banks were only accessible via IE even when there were warnings about using IE an
Interesting (Score:5, Insightful)
I'll go right back to using the branch if they start holding me liable for using their cost-saving website.
Re:Interesting (Score:4, Insightful)
Parent
The feeling is mutual. (Score:5, Insightful)
Re: (Score:3, Interesting)
That was my first thought too, but if NZ is like the US in this regard, they have government banking regulators auditing the heck out of their systems. So it's probably reasonable to more strongly assume the banks' systems have a known level of security.
OTOH, if the banks' security audit results aren't made public, then your instinctive reaction is probably pretty fair.
Re: (Score:3, Insightful)
Yeah ... right.
The bank once deposited $80,000 into my sisters' account by mistake. She told them about it ....the next week, it was "corrected" - it was then $234,000.00.
When she went in to tell them about it, they were having another problem --- the ATM was spitting out paper and money all over the place.
Audited doesn't mean perfect any more than ISO9001 means low level of defects.
Re:The feeling is mutual. (Score:4, Funny)
Parent
Mod Parent Wrong (Score:3, Informative)
That is possibly the worst explanation of the money multiplier effect [investopedia.com] that i have ever heard.
Therefore..... (Score:5, Insightful)
Just because anti-spyware software does not exist for your software platform is no excuse!
you BeOs users! how dare you not run a Virus scanner app!
gotta love Bank executives asking for things they dont even have the slightest clue about.
Re: (Score:3, Informative)
This exact thing happened at my workplace recently (the 3rd largest bank in the U.S...look it up.) Our new "WebConnect" VPN system will not work with Linux and Mac OS X because their first step upon connecting to it is for it to check for viruses and spyware. As this checker ("WholeSecurity", owned by Symantec) does not work on anything but Microsoft
Great idea (Score:2)
Want to file a criminal report? Let us search your home first, citizen. As long as it's not mandatory, things are perfectly legal since you're consenting to it. You're free to stop using our services at any time.
Re: (Score:2)
Banks having a fraud problem? (Score:4, Insightful)
I think this is pretty extreme measure, as if companies didn't already have enough data about people already. What exactly is the criteria for a 'secure' system? Sounds like a lot of BS to me.
LiveCD (Score:2, Interesting)
Re:LiveCD (Score:5, Funny)
Parent
Gee Wally ... (Score:5, Interesting)
All about Trust. (Score:4, Insightful)
banks find secure connection (Score:2)
Why not...; (Score:2)
About damn time. (Score:2)
sure thing (Score:2)
Catch-22... (Score:2, Insightful)
If I was subject to this... (Score:4, Interesting)
Re:If I was subject to this... (Score:4, Insightful)
Parent
They want to "know if it's secure", huh? Well... (Score:5, Insightful)
uptodate is perfectly cromulent (Score:2)
Oh that's right. It's not. Try 'up-to-date'.
Who Decides what is 'Appropriate Software'? (Score:2)
What is and is not appropriate and who decides that? If it is the banks then you can bet that Linux and FOSS will probably not be on the pre-approved list and will require substantial hassles to be approved by the bank. Perhaps they intend to run Active-X controls on their sites t
The phishing scam (Score:4, Funny)
I am frum the National Bank of Nijeria, after providing your name, social security number, bank acount number, and routin information, pleaze instal the attached file so that we may check your securitee settings. Pleaze disreagard all mispelings an gramer mistakes in this email, we were forced to outsource securty email to another countries to save you money and provide the best service that you are familar with us.
Burden of proof? (Score:2)
Reverse the argument. (Score:5, Interesting)
A quick search on google resulted in a large list of banks that have lost information or had fraud that was the result of a security breach. My personal favorite from the list was this little gem from no other than the Bank of New Zealand. Apparently theives outfitted a few ATMs with skimming devices and harvested the account & pin information from the banks customers cards. The bank is resonsible for the security of those ATM's and should be held accountable for more than just the theft of cash.
http://www.finextra.com/fullstory.asp?id=15177
When banks take fraud seriously enough to protect themselves and their devices then I might take their position a little more seriously.
Use Quicken, no protection (Score:2)
Under the rules they're setting up, the only reasonable thing to do is go back to using tellers.
I understand thier dillema (Score:2)
I can imagine:
- The IT guys at the banks are probably going to define some thin definition of security (as another
- The bank will still have breaches as they find that the security measures for that circumstance may work, but when connected wirelessly or at a hotel room, not to mention advances in virtuli
Central Bank of New Zealand (Score:5, Funny)
(i) Full name, DOB and Address
(ii) Account number
(iii) Internet banking login name and password
(iv) Credit card number, expiry date and security code
(v) IP address and machine user name and password
Thank you for you assistance in this matter and we will report the security status of your machine to you as quickly as possible. If you feel uncomfortable entering this information you can always download our helper program (RapeMyAccountLikeItsaSheep.exe) from our website [pleasetakeallmymoney.com].
Central Bank
New Zealand
SCAM WARNING Re:Central Bank of New Zealand (Score:3, Funny)
suggestions to banks (Score:4, Insightful)
1. 100% first-class support for macs, linux, solaris, firefox, opera, etc. Any environment that is less targetted than windows+IE should be encouraged by the banks as a way to reduce fraud.
2. Start issuing SecurID tokens (or similar) to bank customers. This would take care of the simpler keyloggers and phishing attacks.
3. Pay attention to the IP addresses. Compare them to known bot-infested netblocks. Track the IP's that a particular customer uses and flag it when it's not from their home ISP or employer's http proxy.
4. Don't allow wire-transfers or on-line bill pay of large amounts to arbitrary parties via the web banking interface.
5. Look for *patterns*. Change of address followed by any kind of withdrawal or request for a card or checks. Transactions from different people's accounts sending money to the same or similar destination. Hire some game AI dude or data mining people to proactively look for fraud in real time instead of waiting for customers to report missing funds.
6. Criminally investigate fraud. Don't just push the problem back on the customer or write it off as a business expense, actually go out and prosecute the people committing the fraud. Hire the RIAA's legal staff and put them to good use.
7. Implement an undo. On-line transactions should only be allowed to/from banks and financial institutions that pledge to reverse any disputed transaction (instantly) and assist in investigating those who would have benefited from it.
Just my thoughts.
My bank is incompetent (Score:5, Interesting)
Now here is a for instance to illustrate the outright incompetence of my bank's tech support people:
One of their servers was misconfigured and reported a file not found error. Of course - they sent it to me. The message contained the IP address and the apache version number. Sooo... I know what internal addresses they are using and what version of the webserver daemon. No big deal.
But why do they send their error messages to the client? Am I suppose to debug it for them? A guess the short answer might be "yes" because I - along with a number of other programmers - might be working in the apache source code so potentially we do debug their systems. But this was just a misconfiguration.
So I was nice enough to call their tech support and advise them of the problem. The tech support person insisted I re-boot my computer! Not only this she would NOT pass on my error report to the department which handles their servers. When I demanded to speak with her supervisor I found the supervisor also stonewalled me. So I flatly told her that she is incompetent and as such should not be making decisions about things she knows nothing about. Since she would not pass the error report to the people responsible for dealing with it - she made the decision that it isn't necessary for them to know one of their servers was misconfigured.
So this is what you get. Banks are large beauracratic organisations filled with incompetent people who like to sweep things under the rug and are too stupid to both think outside of the box or pass even a trouble report over to someone who might be responsible for dealing with it.
Why would we want people like this to run code in our computers? Why would we want to be held resonsible for their errors - which will happen under the New Zealand system?
This reminds me when I wanted to set up an e-commerce system. The bank at the time was in bed with a company out of India. They wanted the root password for my servers. I said No.
Why should I had over the root password to a group of unknown people in India? If something happens have I any recourse against them? Of course not. Sue in an Indian Court? Bullshit! We all know that would go nowhere and be bloody awful expensive and even if we did win India has laws which prevent money leaving their country. You can pay money to Indian citizens after you go to great trouble - but just forget the idea of taking money out of the country.
So its triple-ly a poor idea to hand over a root password to a company in a foreign country! Of course I advised the bank that their e-commerce terms were totally unacceptable.
Guess what? The company they dealt with in India was bankrupt within a year. It truely was fly by night.
This is what you get from large beauracratic organisations filled with incompetent people: You get really dumb ideas hatched.
Richard Feynman writes in one of his books about the incompetence of the military with regard to the Manhattan project at Los Almos. Back then they had a hole in the fence. They had guards stationed at the main entrance and made everyone sign in and out. But they didn't fix the hole in the fence and didn't station guards there either. So Feynman too great joy for a while by entering through the main gate and signing in - then exiting via the hole and signing in again. This did not trigger a red light in the guard's mind. Neither did me telling the tech support person at my bank that one or more of their servers was misconfigured and was bitching about it.
The short of it is that the banks really do have a problem and the way they handle things they are probably some of the worst people to address their problems. In part - this is why the banks have a serious problem.
Banks don't give a f**k about security (Score:3, Insightful)
My reply: certainly, but they must prove who they are first.
Oh, no - that is not the way that they do things, I must prove who I am first -- by answering exactly the same security questions that someone phishing would want to know. Needless to say: I refused.
I then took this as a complaint to the bank chairman - and have received platitudes as to how they take security seriously, burble, burble, ...
I'm not going to let this go: I shall chase them. I should be OK since I won't give the information out, but many people will do so.
Banks are crap.
Oh wonderful. I can imagine the phone call now. (Score:3, Insightful)
[Rings up to complain of fraud]
Bank: Hello, this is ${BANK}, how can I help you?
Customer: Yes, I appear to have a transaction for £3000 leaving my account which I don't know anything about.
Bank: OK, I see you use our Internet banking service. Do you have antispyware software on your computer?
Customer: No, I use a....
Bank: Do you have antivirus software on your computer?
Customer: No, I use a Mac....
Bank: No antispyware, no antivirus. Not our problem. Goodbye.
Banks != technically competent (Score:3, Insightful)
I emailed then to let them know. Their response? "Clear your cache and cookies".
I thanked them and explained that the problem wasn't on my end, that Verisign actually documented their problem and provided them with the URL. Their response? "Maybe the date on your computer is wrong, our certificates expire in 2011".
I again explained that it wasn't a certificate expiration issue, and in fact the certificate in question expired in 2009. Their response? "No one else is reporting the problem". I stopped reporting the issue, and we started moving money elsewhere.
The problem isn't so much that they didn't have a properly configured certificate, the problem was their response to a security issue. The ticket went back and forth several times (to multiple representatives), and there was no automatic escalation or intercept. The ticket was reporting a security matter, but again, there was no intercept. I can understand not having tier 1 customer support be security experts, but the exchange exposed a complete lack of proper security practices and procedures.
I am not now, nor have I ever been impressed with the security practices at any bank. Some are just not as bad as at others. They will never be permitted to lay hands on a computer of mine.
Re: (Score:2)
Also, since theyre claiming liability based on the security of your PC, you should have the right to investigate the security of their server.
Re: (Score:3, Funny)
He who has the gold, makes the rules.
Re: (Score:2)
I dunno. Maybe because they are the ones offering the damn service. If they can't provide it in a secure manner, why is that my problem? Now if I begged them to please offer the service ...
In any case, prudent users probably will not use these services. You don't have to be Nostradomus to project that even if the banks gain access to the user PCs,.they are unlikely to be able to act intelligently on what they find there. You also d
Re: (Score:2)
Are they going to hire a team of $100,000.00 a year plus It experts? no. they are going to hire MSCE flunkies that dont know what a Live Cd is or what any other OS is even like.
Apple users will be liable because they don't run virus scan or spy ware scan ignoring the fact that those platforms are typically unaffected by the mess that Microsoft OS's have.
are the flunkies going to have the skills t
Re: (Score:2)
I agree - however, to mandate that an end user must be "inspected" and "certified" to transact with them is absurd. It's not like the bank comes to your house to ensure that your locks are up to their code, and they will keep people from entering and trying to steal your checks, or account information.
The bottom line is that the bank can't or won't spend the money to provide a reasonable level of security for their online bankers. It's not