Largest Ever Online Robbery Hits Swedish Bank 218
ukhackster writes "A Swedish bank has fallen victim to what experts believe is the biggest online robbery ever. A Russian gang apparently used keylogging software to steal around one million dollars. It appears that most of the victims weren't running security protection. The bank is refunding everyone who lost money (even if they hadn't taken precautions) — good news for the victims, but not really an incentive to take more care in future. From the article: 'Nordea believes that 250 customers have been affected by the fraud, after falling victim to phishing emails containing the Trojan. According to McAfee, Swedish police believe Russian organised criminals are behind the attacks. Currently, 121 people are suspected of being involved. The attack started by a tailormade Trojan sent in the name of the bank to some of its clients, according to McAfee. The sender encouraged clients to download a "spam fighting" application.'"
In other news... (Score:5, Funny)
Re:In other news... (Score:4, Funny)
"Yorn desh born, der ritt de gitt der gue, Orn desh, dee born desh, de umn børk! børk! børk!"
Options (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
According to whom?! (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
Also, McAfee did provide details on the trojan. Read the third, fourth and fifth paragraph of the article. Read the article next time.
Re: (Score:3, Informative)
I am not surprised... (Score:2, Insightful)
Those who are not into technology have no idea.... Look at my latest journal [slashdot.org]. You can have a PhD and fall for the simplest scam there is. Computers do seem to have this effect on people: their common sense fails because computers are somehow "Magic".
It's tragic if you ask me.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
The Finnish branch says this scam won't work in their system, because they require a separate confirmation code to complete any transaction. The Swedish branch does not, so that's why capturing login info is sufficient to steal the loot.
Re: (Score:3, Funny)
Crime Doesn't Pay (Score:3, Insightful)
Re: (Score:3, Insightful)
$1,000,000 divided by 121 people = 8264.46 per person. I'm convinced taking people's money through legitimate avenues is easier than through crime.
Whilst this may be true in a country like the USA, it's worth noting that the difference between average incomes between western Europe and Russia make it more profitable than it might seem at first glance. The average yearly salary in Russia is around $4800, whilst the average salary in countries like the US and Sweden is about 8 times that.
Multiplying by 8 gives $66,116, and whilst I suspect such a figure would still not be worth the risk of being caught (and with 121 people involved, there's got to be
Re: (Score:2)
4800 x 10 == 48,000 66,116 != 8 x 4800
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This is the point in time when the fun begins -- the "smarter" team members start taking out some of the others and increasing their personal stash every few days
LULZ (Score:5, Funny)
Re: (Score:2)
Bigger ones (Score:2)
Security Pacific, 1974, about the same amount from someone who eavesdropped and social engineered his way past te security measures on the wire room.
the hard part (Score:4, Interesting)
The trick is getting cash transfered from someone's bank once you have their credentials.
Re: (Score:2)
Re: (Score:2)
Not quite. SecurID and similar schemes makes it a lot harder, but there's no reason why someone couldn't perform a man in the middle attack while the victim is attempting to log-into the service. Once the victim types in the key, they could simply cancel/kill
Re: (Score:2)
Re: (Score:3, Informative)
Two-factor auth is really not that useful. Indeed, n-factor is not better than single factor. What is required for a transaction to be secure are the following:
Without BOTH of those, no additional factors will help.
Here's a short description of how the basic attack works. Your second factor is a SecurID or CryptoCard token. You key in your pin number and the value currently shown on that to
Re: (Score:3, Insightful)
Or possibly not a DNS lookup. Possibly just delaying ACKs and stuff on the outbound TCP connection to make the connection open more slowly and delay any useful receipt of data... or inserting bogus NAKs or... could be anything. The point is that an attacker would do something to delay the connection.
These sorts of flaws have been talked about for a while now. Man-in-the-middle attacks are hard to protect against, and impossible if one endpoint is the untrusted man in the middle. In this way, it is bas
Re: (Score:3, Informative)
Think it through: I have a keystroke logger on your PC. You type in your username (something you know) and your SecurID code (something you think you have
For these purposes, the SecurID
Re: (Score:2)
Confirm the transaction with the person (Score:2)
My credit card company has called me to confirm heavy activity or big purchases that veer from my normal
Re: (Score:2)
Schtooopidddttt bank. I hope the Swedes do a run on it and put it out of business/misery.
the ends justify the means? (Score:3, Funny)
the 'spam fighting' app almost did exactly what it was deceptively claiming to do;
bankrupt the people, force them to sell their technological idolatry, bam-- no more spam.
Victims (Score:5, Insightful)
No, that merely changes who the victims are. There is no such thing as "good news for the victims" unless the stolen money is recovered.
Re: (Score:2)
FDIC? (Score:5, Informative)
And yes, I think that it is good that the bank is reimbursing the idiots that fell for the scam, however I hope they now include somethign that say "if it was your fault some one else gained your PW, then it sucks to be you", AND they provide much better security (virtual key pads, multiple randomly selected questions) AND make them mandetory!
For those of you who have an ING account you know what their security is like. Nothing much that will hamper a real customer, but things that should stop non-customers.
Re: (Score:2)
I don't think so. The FDIC is more of a surerty for the bank itself. In this case the bank wasn't actually the one robbed, the customers were digitally conned. It's a good business for FDIC itself as your premium as a bank would depend on your fraud record.
[this] bank is being pretty cool about it, probably because the phishing e-mail containing the trojan appeared to come from the bank's domain. Its a semi dangerous public
Re: (Score:2)
Re: (Score:2)
FDIC insures the bank customer against bank failure (as in going out of business).
http://www.fdic.gov/about/learn/symbol/index.html [fdic.gov]
They also enforce the Electronic Fund Transfer Act. That may address this particular problem, if it's an EFT that you (or someone you authorized) did not make.
Re: (Score:2)
And don't forget to ask this other question
If this happened in the US and if the FDIC didn't step up, would the bank be worried enough about losing its online customers and reputation to take the hit themselves?
I suspect a bank might do that if worse came to worse. Online banking holds a lot of promise for a lot of banks. It may be expensive to get going at its core, but online banking holds the promise of scalability and redu
Human factors (Score:3, Insightful)
We'll never get decent security as long as we set traps for users and call them idiots when they fall in.
The email containing the Trojan came from the bank's domain, apparently. Is it the fault of the users that email isn't authenticated? Are they idiots for not knowing how SMTP sessions can be spoofed?
How many places require software downloads to work? Include Flash and PDF readers in that list. Are people idiots for installing something that any non-expert would think came from their bank?
Do we
Re: (Score:2)
If The cost of a class action suit (or lost business in this case) is X, the number of defective products (or victim here) is A and the cost of each recall (or refund here) is B. Then if A*B > X you don't do the recall.
So most banks will probably reckon that refunding these customers (thereby giving their other customers a false sense of security that they will also be refunded if this ever happened to them) is worthwhile. Otherwise they would lose a lot of money i
Re: (Score:2)
single use keys should make a keyloger pointless. I actualy like that method more so then the other company. If they are generating codes based on a static pin, that must be crackable.
I still preffer ones that have a decent selection of possible questions you will be asked (making a keyloger that much less effective), a VPK for your PIN (AKA your keyboard can NOT enter your pin), and an identifier (Picture+phrase) so you know you ar
Re: (Score:2)
AC lies! They were ussing an incredibly insecure method.
Thanks for the info. One time pins are rather nice, the only problem is that they are either cumbersome (having to request them and what not), or a target for gathering (as people will get them in batches, and then store them in
Re: (Score:2)
So this was not a keylogger, it was considerably more.
MY question is how the program worked. If it was simply tossing up dummy pages instead of the actualy bank page then the easy fix is one where you make sure the customer knows they are on their own page (show a customer slected image/phrase/whatnot). The amusing this is that the first place I ever saw this was on NeoPets (It showed you your active pet and their name before taking your PW), and t
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Sounds easy enough... (Score:2)
Re: (Score:2)
That's the problem, it's too easy. Robbers spam bank customers with phishing attack. Out of the thousands of customers, 121 dumbasses fall for it. Robbers transfer funds. Robbers go on vacation and buy a car. End of story.
You're missing all of the critical pieces of a Hollywood heist movie. No hostages? No hereos? No fictional wonder tool fabricated out of duct tape a an old microwave oven? There's not even room for a car chase or an explosion.
On another note, there's no
1 Million Dollars? (Score:2)
121 people involved? (Score:2)
Quoted.. (Score:3, Funny)
Re: (Score:2)
Gersh gurndy morn-dee hack-zee hack-zee!
Translation: They're always after me lucky charms!
Incentives for The Bank (Score:3, Insightful)
All that not refunding the customer's money would accomplish is hurt a lot of people and discourage people from using online banking or encourage them to change banks. People are never going to become security gurus just so they can bank online and if you make banking online too risky or hard they will just give it up.
By making sure it is the bank who has to pay for security losses while still making sure people have some incentive (annoyance, possibility they might pay next time or lossing $50) to be safe you end up with the best results. The bank is the entity that can roll out new security solutions and most easily improve security practices so giving them incentives to improve security is the best move.
Re: (Score:3, Insightful)
What bank issued your credit card? I've had to reverse charges multiple times for different reasons. I've been billed twice for the same item, I've been billed incorrect amounts, I even reversed a Paypal charge because the seller never sent the item.
In all cases it was simple (I have Citibank cards). Call up and tell them what charge you are disputing. Immediately you get a conditiona
Re: (Score:3, Interesting)
There's a rather humorous corollary to this, and since I feel loquacious
How about suspending accounts? (Score:2)
I'm hoping that the banks at least suspended and revoked the privilage of online banking from the users in question. If you can't take care not to download trojans/etc online that affect online banking, you shouldn't be allowed to do your banking online.
Re: (Score:2)
Bank: You all suck at online skills, so you can't use our online banking services!
Customers: Bye!
Bank: What?
Ex-Customers:
simple, aint it? Also, actions like that will also have other customers leave.
However, in reimbursing the customers, despite it being their fault, they have created a VERY good image for the bank.
Re: (Score:2)
I wouldn't leave my bank if it enforced rules against careless customers. I'd want them to. The careless customers are endangering the bank's security and financial health.
Re: (Score:2)
Bank: You all suck at online skills, so you can't use our online banking services!
Customers: Bye!
Bank: What?
Ex-Customers:
Bank: Good riddance
Banks aren't dumb, and they don't make megabucks by holding onto bad investments. In this case, said customers are bad investments. You really think that they bank is going to be overly upset if the a few dozen of the customers that just cost them upwards to a million bucks leave? Do you think that disabling internet accounts of people w
not really an incentive (Score:2)
Re: (Score:2)
Largest ever robbery? (Score:3, Interesting)
Anyway, I highly doubt that this was the largest ever online robbery, maybe it was the largest phishing attack.
Re: (Score:2)
Predefined one-time keys are insecure (Score:5, Informative)
I was curious about the security protocol for Nordea bank and although links on the Nordea site are currently broken (an attempt to cover up?), I could find them on Google.
So the scammer just needs the fixed PIN code, plus a few of the one-time codes.
I used to have a bank account in Sweden with a different bank that uses a cryptographic challenge/response key generator, both for logging in and confirming a transaction. The website supplies you with a code number that you enter, as well as a PIN code. The device uses the code together with a secret key and the time from an internal clock and lets you send back the data.
Banks here in the Netherlands use similar systems, often with a generic card reader that uses a chip that is built into the bank cards. Others send a confirmation code by SMS to a mobile phone number that is registered to your account.
I think cryptographic systems are inherently much more secure than predefined one-time keys. The cryptographic keys are only valid for 30 seconds and, more importantly, only for a specific transaction. Keylogging wouldn't help the scammer; instead he would have to take over the entire browser in order to actually display your transaction information together with his transaction challenge code.
Re: (Score:2)
Some banks have gone a step further and made the transaction amount as part of the challenge, meaning that even an attack like this would fail (since you transferring $20 to your landlord wouldn't match his attempt to withdraw all $21.54 in your account)
Re: (Score:2)
Short time keys make the interception slightly more difficult, but essentially the intercept software would just have to immediately use the collected keys in the alternate transaction, rather than save them for later use. Same with SMS, or anything else; as long as the customers PC is compromised, there's no way to guarantee that what the customer sees is what the bank sends, or that what the custo
Re: (Score:2)
That's of course still an issue; it's the weakest link in the chain that counts. Still, with time-limited cryptographic challenge/response verification, it requires much more effort from the attacker. With user/password or user/password/one-time-key login schemes, the weakest link is even weaker. My Dutch bank actually tells me on the login screen [rabobank.nl]: "Please verify that the URL starts with "https://bankieren.rabob
Re: (Score:2)
Re: (Score:2)
Or, if you have taken control of the user's computer, you can do a man-in-the-middle attack. Since the one-time codes are completely independent of the transaction that is taking place, the cracker can simply wait for the user to transfer money somewhere and substitute the amounts and account numbers.
This is, however, not possible with at least some of the challenge/response systems you mention, because every number then ne
Disappointed in you /.ers (Score:4, Funny)
In Soviet Russia, key logs you!
Or even better. In Soviet Russia, you gulag.
Perhaps, in Soviet Russia, bank robs you!
One last note, in Soviet Russia, Russian reversal jokes are funny.
Re: (Score:2)
Re: (Score:2)
It's a Windows trojan (Score:2)
The sender encouraged clients to download a "spam fighting" application.'"
The trojan in question only runs on Windows [symantec.com].
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
I'm not knocking Windows, the users contributed by not running antivirus software and not being terribly bright. But this is why I don't ever access any of my banking or investment accounts with Windows.
Just makes it that much harder to automate installation of a keylogger
What do you expect, though? (Score:2)
This wasn't an automatically installed keylogged from the sounds of it, but rather one installed by dumb users. Windows has more users, so they email the windows users. PC's being more prevalent (and
I wish that they had not paid the victims. (Score:2)
Re: (Score:2)
The better choice is for the banks to recognize that client systems are highly vulnerable and make their own security more immune from these problems. If I was a bank, I would also strongly consider blackholing IP space outside of their normal service area. More of an irritant to serious criminals that a real deterrent, but it might make i
If the trojan was targeted to a specific list (Score:2)
Brazilian bank - $350m (Score:2)
Numerous attacks against this bank (Score:2, Interesting)
This was really bi
Is this another Windows genuine advantage? (Score:2)
Why doesn't the headline name the real enabler: Microsoft.
Running Windows is like putting your money in a cardboard safe. Wet cardboard.
incentives are where they belong (Score:3, Insightful)
Consumers are told by people who market computers that they are easy and safe to use. Consumers are told by internet service providers that online services are easy and safe to use. Consumers are told by banks that online banking is secure and convenient.
Aside from the criminals, who appear to have escaped without any consequences to them, the burden is falling where it should be, namely on agents who allow marketing over reality. While the
Not this again (Score:2)
The customers didn't lose money. (Score:5, Insightful)
Antivirus may not help (Score:3, Insightful)
Often these guys use directed fraud mails written in reasonably good Swedish, so I wouldn't really doubt they have custom made keyloggers too to attempt to escape antivirus tools.
Sure, they could use detection by heuristics like some support, but then the accuracy falls rapidly, as well as the fact that not nearly all popular tools even supporting that.
What's needed here is that users don't become so naive when they sit down in front of a computer. To many, it seems like they then enter a world of safety where they don't have to think much and just click through mails that "look right" even if they ask for logon details that the banks has earlier been very careful to inform they'll never request. (because they already have that info, or can reset it at their whim anyway, duh!) The problem is that on the Internet, the exact opposite mostly holds true.
Don't expect the generous refund policy everytime (Score:2)
I'm thinking that the refunds are a result of the newness of on-line banking. When the newness wears off - people will lose their life savings with these tricks.
It's no different than meat-space scams that trick people into withdrawing money or allow theives access to their bank accounts (like a stolen ATM card with the PIN number written on it).
The message here should be "if you do on-line banking, your computer is your ATM card. Protect it just as you would your ATM card"
Re:Don't expect the generous refund policy everyti (Score:2)
"spam-fighting" (Score:2)
That's how we fight SPAM.
Site down now + security (Score:2)
The security for their online banking system includes a key file that you must have on your PC so a trojan could be used to gain access if it got found the key file. I am not aware if they have additional optional security options available, like a key card or whatever.
BTW the client side runs Java and works
Re: (Score:2)
The phishing (well, not really phishing in my mind) emails told the people to download and install anti spam software, and they did. No exploting holes in outlook or IE, none of that, just simply tellign poeple "Installer our keylogger. err, I ment to say out "anti-spam" software, yah...". It would have worked for Mac, or *nix, or anything else (It probably DIDN'T work for them, simply b/c the attackers did not see it as worth spending the extra time t
Re: (Score:2)
Are immigrants considered dumb in your country?
Re: (Score:2)
I can see several reasons for that. One is that maybe there's something in the law or banking regulations about it. The second is that if it's mostly small amounts that were stolen, it would be cheaper to pay than to fight it in court.
But I guess the most important reason is that the bank wants to make people confident about doing business online. It's so much cheaper for the bank to do online business rather th
A Digipass make it secure? (Score:3, Insightful)
If your computer has been rooted, it really IS ball game over. Just sitting here thinking how I would exploit a rooted system that someone uses for banking...
1 - establish account offshore that offers SWIFT transfer (or other convenient inter-bank wire), and can deal with bank that requires no ID.
2 - Monitor victims on-line banking activity for a couple of months.
3 - Intercept after online session has next been established.
4a - Inject low level "noise" transfer, if victims balance is medium le
Re: (Score:2)
Re: (Score:2, Funny)
(c) profit!!!!
Oh wait, nevermind.