Banking Malware, Under the Hood 92
rye writes "What is your computer actually DOING when you click on a link in a phishing email? Sherri Davidoff of LMG Security released these charts of an infected computer's behavior
after clicking on a link in a Blackhole Exploit Kit phishing email. You can see the malware 'phone home' to the attacker every 20 minutes on the dot, and download updates to evade antivirus. She then went on to capture screenshots and videos of the hacker executing a man-in-the-browser attack against Bank of America's web site. Quoting: 'My favorite part is when the attacker tried to steal my debit card number, expiration date, security code, Social Security Number, date of birth, driver's license number, and mother's maiden name– all at the same time. Nice try, dude!!'"
Re:Nice try? (Score:4, Informative)
If setup right, you should be shown a picture you choose to confirm that you are on the legit site. Then in addition to your password, you can setup a system where a six digit numeric token is sent to your cell phone which is also needed to authenticate.
Most of the exploits.. (Score:5, Informative)
1) when you get an e-mail: check the actual e-mail address. so, what is it actually made of? xxxx@yyyy.com 2) Nothing is free. When you are tempted to browse a website that you've never been before, at the very least, try and use google and see if there are security warnings, trust ratings or something
3) Don't respond to any e-mails saying you won gazillions amounts of dollars, because many of these requests end up as a confirmation that your e-mail is well and valid which is information that can be further used by the hackers
4) Disable images in your e-mail, so that you avoid some spyware
5) When you download a file, scan it for viruses,spyware,malware, I mean, c'mon, use your head. Avoid self-executables and go for ZIP, RAP, 7Zip, etc.. but even then, don't just open the bloody compress file.
6) Don't make easy passwords.. Instead, my favorite is, think of a phrase you often use, for example, can be a phrase like "Wellness petite treats are for my 2 little puppies". OK, this isn't a phrase I use often, but, it's an example. Now, your password could be Wpta4m2lp! Pass this around and freely add whatever I may have missed out.
Re:Most of the exploits.. (Score:5, Informative)
Install chrome, chrome://plugins/ , block automatic execution of java and flash. Make it so you need to click. Install an adblocker to reduce driveby downloads. Install noscript + ghostery if you are wearing aluminum foil on your head.
Auto install security updates. If something disables it most likely you have a virus. Keep everything up to date.
Don't install toolbars or weather apps from unknown sources.
Re:Most of the exploits.. (Score:3, Informative)
When it comes to passwords, personally I like to made a little 'algorithm' for their construction that involves something about the website I'm visiting and seeded with various other bits n pieces.
For example, I could always use the first three digits of my old phone number, along with the first three characters of the website and then the capitalised predominant colour of the logo. For example the /. password would be 206slaGreen, but for the BBC it would be 206bbcRed. You could use anything, the number of characters in the site name, number of words, the website initials, first 3 vowels, etc. The big upside is once you've got a way of generating your password you'll never forget it, even for that random website you log into once a year.
Obviously you wouldn't do this for you bank password, but it's great for the multitude of websites which you need to log into that don't contain any sensitive info.
Re:Well, you were dumb enough (Score:2, Informative)
Of course, slashdaughters know buying a lottery ticket does not increase your chances of winning.
With no ticket your chance of winning is 0, with at least one ticket it is non-zero. If you can't understand how having a greater than zero chance is greater than having a zero chance, I'm afraid there's no hope for you at all.
I have personal experience with this winning $20 twice never buying a ticket. (Realtors and and other salesfolk give them out in mailings).
You might not have bankrolled the ticket purchase yourself, but the ticket was still purchased. But since you seem to be intent on semantics, the proper phrase would be "having a ticket" not "purchasing a ticket".
Re:Nice try? (Score:3, Informative)
If setup right, you should be shown a picture you choose to confirm that you are on the legit site.
"SiteKey" only marginally improves security compared to regular TLS/https and notably doesn't help against a MITB attack [wikipedia.org] as described in TFA. If this malware is worth anything, that picture will still be there.
Then in addition to your password, you can setup a system where a six digit numeric token is sent to your cell phone which is also needed to authenticate.
Ooh, two-factor authentication. That's been mandatory in Danish banks for years, but hey, good to see some American banks actually providing security beyond "mother's maiden name"... even if the user has to opt-in.
Simple two-factor authentication still doesn't help against MITB attacks, of course. ("VERY good online security", indeed.)
Re:Well, you were dumb enough (Score:5, Informative)
With no ticket your chance of winning is 0, with at least one ticket it is non-zero. If you can't understand how having a greater than zero chance is greater than having a zero chance, I'm afraid there's no hope for you at all.
With no ticket, you have spent $0 and have an expected return of $0. Your expected return from the transaction is $0.
If you buy a ticket then you have spent $X on the ticket and have a probability Y of receiving $Z, and a probability of (1-Y) of receiving $0. No matter what happens you have spent $X, but statistically you can expect a return of $(Y * Z), assuming that there are no other players with a chance of picking the same numbers. Your expected return from the transaction is $( (Y*Z) - X ). Unless the lottery is run by complete morons who are desperate to give away money, X will always be greater than (Y*Z), so you can always expect to lose money.
As an example, let's suppose that you are playing a lottery in which you need to correctly guess six different numbers between one and fourty-nine. Your chance of winning the grand prize is [ (49!) / (6! * (49-6)! ) ] or one in 13,983,816. If a ticket costs $2, then any jackpot of less than twenty-eight million dollars means you are paying more than you can expect to make back. The chance of winning the jackpot is overshadowed by the certainty of losing your initial investment, meaning that you are just giving money away.
If you can't see from this that lotteries are a tax on people who aren't good at math, then I'm afraid there's no hope for you at all. It's just one of many ways to pay for a few minutes of entertainment, really no different from paying for cable TV or giving money to a street magician performing "Three Card Monty".