Study: Users ignore bank security features
529186
(InfoWorld) - Users of online banking sites tend to bypass critical clues that the integrity of those sites may have been compromised, according to the working draft of a study released on Sunday by researchers at Harvard University and the Massachusetts Institute of Technology. The study, which will be formally released in May at the IEEE Symposium on Security and Privacy in Oakland, California, underscores how new technologies and warnings can't completely protect Internet users fromÂ scams such as phishing. It also throws doubt on the effectiveness of site-authentication images, which have been implemented by financial institutions such as Bank of America, Vanguard Group, and ING Bank. The images, selected by the customers, are shown when a bank customer logs in from a different computer than is normally used. The study involved 67 users, with more than 90 percent under 30 years old. Because of varying parameters in the study, not all qualified to be included in the results for each of the three tests. Users were ask to conduct common online banking tasks, although precautions were taken to ensure users weren't put at risk. For the first test, HTTPS indicators -- which show that an encrypted connection is enabled -- were removed from the address bar along with the lock that appears in the bottom right corner of Internet Explorer 6. Although the absence of HTTPS indicators should be a warning, all 67 participants continued with their transactions, the study found. The researchers then conducted a test where the site-authentication image was removed along with the HTTPS indicators. The researchers wrote it is the first empirical investigation into site-authentication images. Only two of 60 people chose not to log in when the image was removed, a key sign that a site may have been tampered with or is a phishing site, the study said. Of users who were actually using their own bank account for the study, 23 of 25 continued to enter their passwords. "We find them [site-authentication images] to be ineffective," the study concludes. In the last test, researchers made it more obvious, this time replacing a password-entry page with a warning page from Internet Explorer 7 Beta 3. The page advises of a problem with the security certificate of the chosen Web site. Despite the warning, 30 of 57 users entered their passwords. The study comes as U.S. banks are beefing up their authentication technologies amid new requirements from federal regulators. In October 2005, the Federal Financial Institutions Examination Council (FFIEC) mandated that U.S. banks implement stronger authentication protections by the end of last year, particularly for high-risk transactions such as sending money to a different person's account. Bank of America uses site-authentication image technology called SiteKey. Users pick an image and assign a phrase to it while also setting three "challenge" questions. If a user logs in from a computer that doesn't already have a cookie, they're asked one of the challenge questions and then to verify the image and phrase. If the image doesn't appear or the phrase is wrong, consumers shouldn't proceed. Bank of America said the image system benefits users since it's free and doesn't involve extra hardware or software.
686153
Some Macintosh users have encountered a security program whose function and Web site have the tell-tale signs of a scam.Visitors to the Web site selling the program, called MacSweeper, are offered a free security scan of their computers. The scan, which only works on Macs, highlights supposed security problems with the computers. It offers to remove the problems with the purchase of a $39.99 lifetime subscription.But the awkward English on the program&#39;s Web site, and the way the program operates, have raised doubts over its legitimacy, users and security researchers say.&quot;The imbibed set of features locates all the junk and useless data on your computer and deletes them to reclaim the wasted space,&quot; according to the pitch on MacSweeper&#39;s home page.Security company F-Secure wrote on Tuesday that the program, called MacSweeper, may be the first rogue application for Macs.Windows machines have been more frequently targeted by similar software, sometimes labeled &quot;scareware&quot; since users are warned their computers will be in danger unless they purchase the software. Among the more notorious scareware for PCs is Winfixer, also known by the aliases ErrorSafe, WinAntiVirus, and DriveCleaner.The MacSweeper Web page is hosted on a server in Kiev, Ukraine, said Patrik Runald, security response manager for F-Secure, who is based in Malaysia. Information on the site about MacSweeper&#39;s company, Kiwi Software, has been plagiarized from Symantec&#39;s Web page, Runald said.&quot;They just ripped that information straight off there,&quot; Runald said.The same text is also used on Cleanator.com, which sells a Windows-compatible version of the same kind of program, Runald said. Another security vendor, Sophos, classifies Cleanator as a &quot;potentially unwanted program.&quot;Once MacSweeper is running on a Mac it will often pick odd items, such as language files, and label them as being a privacy risk, Runald said.In at least one instance an F-Secure researcher visited the MacSweeper site and clicked a button labeled &quot;Free scan.&quot; The scan highlighted Mac-related problems, even though the researcher was using a PC.MacSweeper doesn&#39;t use any tricks to get onto a machine other than trying to persuade users to download it, Runald said. Nonetheless, F-Secure typically contacts Finland&#39;s Computer Emergency Response Team when it finds scams such as MacSweeper, Runald said.A user on one of Apple&#39;s discussion boards wrote that their Safari browser kept redirecting to the MacSweeper site, a sign that malicious scripts may be involved.&quot;If I click on anything it&#39;ll try downloading the software,&quot; the person wrote. &quot;How do i get rid of this? It&#39;s really annoying. I don&#39;t want it, and I&#39;d wish it would leave me alone.&quot;
179691
ComputerWorld AU: Respondents to the 2004 Ernst &amp; Young Global Information Security Survey cited lack of security awareness by end users as the top barrier to achieving the required level of security.
605951
Consumers feel passwords no longer enough protection for online transactions.
542349
New exploits could affect customers who never applied patches for known database flaws.
306537
Security researchers have sounded the alarm for wireless Internet users, warning them that their laptop computers are vulnerable to attack by hackers. The flaws could allow thieves to gain access to passwords, bank accounts, and other private information even when the system is not connected to the Internet.
386296
The facts of web servers don't necessarily match the myths when it comes to security.
229842
Researchers find that net users are not as secure as they think. Among surveyed adults who believed they were safe from online threats, most had spyware running on their home computers and few had firewall protection.
153353
The tricky business of thwarting online fraud Logistic and technical issues have hampered the rollout of a system designed to thwart phishing scams by UK bank Barclays.â¦
400232
More than three million customers of global banking giant HSBC have been left vulnerable while banking over the internet for more than two years because of a security flaw, a newspaper reported.
754059
Data breaches contribute less to ID theft and fraud that most people think, according to a recent survey by Javelin Strategy & Research. Losing your checkbook or wallet is more likely to put you at risk.
311572
Consultant reveals how even banks ignore security The conventional wisdom that banking organisations are more diligent with security was skewered in a presentation at the RSA conference this week.â¦
29086
Several security features in the Mac's new OS are incomplete, say researchers.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
328333
A new Trojan program is targeting unwitting users' bank data by intercepting account information before it is encrypted and sending it to a central attacker database.
267647
The Banker-AJ trojan has been coded to lie dormant in the background on infected Windows PCs. When users visit legitimate online banking Web sites of certain UK banks, the malicious code is
598197
Technique lets intruders exploit flaws previously thought to be insignificant, says security researcher.