Deutsche Bank hit again by phishing attack
500415
After facing its first-ever phishing attack last week, Deutsche Bank AG said today it was the target of a renewed assault that began late yesterday and continued until this morning.
688678
Targeted phishing attacks aiming to plant malware on corporate networks are going out to companies that have posted job openings on CareerBuilder.com, according to reports from one affected party.
184264
(InfoWorld) - Banks and other companies switching their phone systems to VOIP (voice over Internet Protocol) are making themselves vulnerable to phishing attacks for which there are currently no effective detection or prevention tools, a security researcher warned Wednesday. "People will be able to penetrate bank networks and hijack their phone lines," said an independent security researcher, known by his pseudonym The Grugq, in an interview. VOIP is becoming increasingly common as companies and operators look to the technology to help cut costs, which makes them moreÂ vulnerable to attack, he said. The Groqg, who spoke this week at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia, saidÂ VOIP phishing attacksÂ will emerge by the end of this year. The attacks will allow hackers to steal personal data, including credit card numbers and bank account information, and there is little security managers can do to stop them. "Theoretically, you phone up your bank and the customer service line has been taken over by hackers," The Grugq said. In this scenario, the customer would be asked by the hacker to enter personal banking information before being passed on to an actual bank customer-service representative. "There's no security technology out there that companies can deploy to fix this," The Grugq said, noting that existing intrusion-detection systems are not capable of detecting when a VOIP attack takes place. During his presentation at HITB, The Groqg announced the release of alpha code for SIPhallis, a tool he wrote that allows security managers to manage SIP (Session Initiation Protocol) VOIP packets on their networks. "It gives you an interface to create and send VOIP packets; it also allows monitoring of VOIP packets," he said, adding the application can also be used to inject packets into a VOIP stream. Existing softphone or PBX software is all that is required for hackers to launch a VOIP attack, The Grugq said. HITB runs through Thursday, Sept. 21.
712867
A massive rise in phishing attacks this year may lead on to customised email security attacks targeted specifically at individual or small groups of companies, according to email security firm MessageLabs.
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."
320142
Germany's biggest bank - Deutsche Bank - is being investigated on suspicion that it may have manipulated its balance sheet.
369441
A security breach at TD AMERITRADE creates headaches.
430013
Slashdot has a warning posted about the existence of a phishing scam directed toward Red Hat users. Read more to see the post. rixdaffy writes &quot;I just received an email from the &#39;Redhat Security Team&#39; telling
153353
The tricky business of thwarting online fraud Logistic and technical issues have hampered the rollout of a system designed to thwart phishing scams by UK bank Barclays.â¦
431171
A distributed denial-of-service attack that disrupted Web-based systems at credit card payment processing firm Authorize.NetÂ earlier this week is indicative of a sharp increase in the number of cyberattacks being targeted at specific companies and driven by profit motives on the part of the hackers who launch them.
115072
The FDIC on Friday issued an alert about an increasingly common e-mail scam designed to steal personal information and money from millions of unwary consumers.
443975
Sensitive customer details are lost in an Atlanta burglary - the third such theft in a year. For the third time in a year, criminals have stolen computers that contained names and sensitive financial information of customers of Wells Fargo &amp; Co.
342427
Phishing scams increased by more than 100% in October causing banks, financial services firms and popular consumer websites until grief.
131710
The last 12 months have seen a huge rise in the number of so-called phishing attacks, say security experts.
196253
Consumer group Which? says banks should automatically compensate victims of online phishing frauds.
574598
The number of Web sites used to steal private account information from online consumers surged in October, as banks and other financial institutions continued to struggle against Internet &quot;phishing&quot; schemes.
239208
Security experts are saying that a well-intentioned effort by the New Jersey Office of the Attorney General to combat phishing may backfire.Earlier this week, State Attorney General Anne Milgram called on four banks -- Bank of America, Citibank, Washington Mutual, and New Jersey-based Sun National Bank -- to provide her with details on how they respond to phishing incidents.This is a good move that will probably raise awareness about phishing, observers say. However, Milgram also asked the banks to send e-mail to their online customers, warning them that the bank has been a recent target for phishing scams and offering advice on how to tell fake e-mails form the real thing.That raised a red flag with anti-phishing experts.&quot;The New Jersey Attorney General asking the banks to send out another e-mail to clients is opening up ... those banks to be phished yet again,&quot; said Paul Laudanski, leader of the Phishing Incident Reporting and Termination squad project. &quot;I can see the phishers writing in a new e-mail scam campaign &#39;The New Jersey AG has asked us to inform you that you have been phished, please click this link to secure your account.&#39; Trouble, trouble, trouble! This is a setup for failure,&quot; he wrote in an e-mail message.Dave Jevans, chairman of the Anti-Phishing Working Group said that while he applauded Milgram&#39;s effort to educate consumers by inquiring directly with bank CEOs, he &quot;would have preferred that the Attorney General waited to hear back from these banks before issuing a request to send e-mails out to all their customers. That type of e-mail can set the stage for waves of copy-cat phishing,&quot; he said via e-mail. &quot;If the phishers send out fake e-mails of this type before the banks get to it, there&#39;s a potential problem.&quot;Even Katherine Tassi, Washington State&#39;s assistant attorney general, said she thought there could be problems. &quot;Consumers are already confused enough about whether e-mail from a bank is authentic or not,&quot; she said via e-mail. &quot;A lot of banks do, in fact, communicate by e-mail to their consumers, which is something that makes the problem worse.&quot; That&#39;s because consumers become more trusting of the e-mails, even messages that may be from a malicious source.Milgram&#39;s spokesman, Lee Moore, said that banks should use every means possible to educate their customers about phishing -- including e-mail. &quot;Banks need to compete with the phishers in the customer&#39;s e-mail box with the right message,&quot; he said.The New Jersey AG has been receiving more and more phishing complaints of late and is coming to view the phenomenon as a growing concern, Moore added.As of late Thursday, his office had not heard back from any of the banks.