HSBC's anti-phishing dept takes 44-year holiday
259208
'I will be out of the office starting...' Ta very much to the anonymous reader who reported a suspicious email to HSBC's anti-phishing department and then forwarded us the result. Although he or she got a fairly comprehensive rundown on what to keep an eye out for in those dodgy "HSBC security alert" emails, the automated reply makes it clear that any personal feedback is unlikely for the next 44 years or so:â¦
31310
(InfoWorld) - Italy has become the latest country to clamp down on phishing, with authorities there arresting 26 people for an alleged scam to swindle bank customers. According to a statement by one of those arrested, the scam involved sending fraudulent e-mails that appeared to come from Poste Italiane, the country's postal operator, which also offers bank accounts, insurance and loans, according to a news release (in Italian) from the Guardia di Finanza, which handles financial crimes. The e-mails urged victims to hand over sensitive financial information, which was then used to draw money from their accounts, the finance authority said. Eighteen of those arrested are Italian citizens, with the remainder from Eastern European countries. Phishing scamsÂ are generally difficult to trace, since the fraudulent e-mails are often sent from computers that have been hacked. Those computers may also be in different countries than the hackers and the victims. But fraud management officials from Poste Italiane and the finance authority monitored transaction papers used to empty the accounts, initially in the Milan area and then throughout the country, they said. Countries around the world have been trying to clamp down on phishing as the number of Web sites used to entrap victims continues to increase. Police in Japan made theirÂ first arrest for phishingÂ early last year. The person was accused of illegally obtaining IDs and passwords for Yahoo Auctions and using them to resell goods worth tens of thousands of dollars. At around the same time,Â authorities in Bulgaria arrestedÂ eight people for phishing scam that targeted users of Microsoft's MSN service. Phishing-related arrests have also been made in the United States. Â
484208
The mutual fund touted on the Web site sounded familiar, but a guaranteed annual return of 657 percent raised eyebrows at a watchdog group. Within days the bogus site had been yanked by federal authorities, who launched their first investigation of a "phishing" scam targeting a mutual fund complex.
727431
InfoWorld - Online phishing schemes increased significantly in October as financial institutions struggled to combat attempts to steal private account information from online consumers, according to the Anti-Phishing Working Group (APWG).
287780
The Anti-Phishing Working Group (APWG) reported today that the number of brands hijacked by phishers leapt to a record high of 154, up 20 percent from the previous month and more than 12 percent from the previous high.
58130
A pharming attack that targeted online banking customers in the U.S., Europe and Asia-Pacific has been shut down.
224580
(InfoWorld) - IT systems integrator Unisys Corp. is under fire for allegedly failing to detect the hacking of U.S. Department of Homeland Security computers, an incident that resulted in data being sent to a Chinese-language Web site. Unisys is now under investigation by the U.S. Federal Bureau of Investigation, according to an aide for the House of Representatives' Committee on Homeland Security, which started investigating the DHS and Unisys in April. The committee sent a letter to the DHS on Friday asking for its inspector general to open an investigation, the aide said. The letter said DHS had 844 "cybersecurity incidents" during fiscal 2005 and 2006, which the committee called "high and unacceptable." The data breach adds to the growing chorus of complaints from countries such as France, Germany and the U.K. thatÂ hackers in China have stepped up their game, hunting for sensitive information on government computer systems. In 2002, Unisys won a US$1 billion contract to manage computer systems belonging to the DHS and the Transportation Security Administration, which were created after the Sept. 11, 2001, terrorist attacks to shore up the nation's defense. Unisys received a $750 million contract in early 2006 to continue the work. Under the contracts, Unisys installed six intrusion-protection devices, said Lisa Meyer, Unisys spokeswoman. Those devices, which can detect unauthorized activity on a network, were not installed properly, alleges the committee. Three months passed before clues emerged that malicious software capable of copying and transferring files had been installed on 150 DHS computers. The data, although unclassified, was transferred late at night or early in the morning to a Chinese-language Web site, according to committee evidence and testimony. Two U.S. representatives also accused the DHS and Unisys of ignoring warning signs of the hacking. In a statement , Unisys denied the intrusion protection devices were improperly installed and that the company reported security incidents. Meyer said Unisys has not been notified by either the FBI or the committee of an investigation. She said she could not comment further on specific security incidents. The FBI referred questions to DHS officials, who could not immediately be reached. Â
349845
From a sharp increase in phishing scams to high-profile arrests, here's what made news this year.
109205
'We've written some letters' British banks have responded to European privacy watchdogs, who claim they broke the law by letting US anti-terror investigators have access to the details of their customers' international financial transactions.â¦
646772
Authentication and education efforts may lessen the lure of typical phishing targets, security firm says.
294185
Things are pretty informal at this organization, and network security isn't exactly tight. So when the head finance guy needs a little work done on his network account, IT admin simply asks what his password is.
500415
After facing its first-ever phishing attack last week, Deutsche Bank AG said today it was the target of a renewed assault that began late yesterday and continued until this morning.
549845
(InfoWorld) - Rich Baich knows about data theft. Back in 2005, Baich was where he is now: at the RSA Security Conference in San Francisco, a published author and star in the tight-knit community of information security experts. Then the roof fell in as Baich's employer, data broker ChoicePoint, revealed that it had unwittingly allowed identity thieves posing as legitimate customers to make off with the financial records of more than 163,000 consumers. For months afterward, Baich, now a Principal at consulting firm Deloitte, was forced to explain how the security lapse had happened and to defend his performance as the CISO in light of the breach. His company was ultimately forced to pay $15 million in penalties and compensation as a result of the breach in a deal with the FTC. Two years later, ChoicePoint is just one in a string of major data breaches that now includes companies like Massachusetts retailer TJX, and Baich is back at RSA with a new book, a new job, and a new perspective on the problems of companies like ChoicePoint, CardSystems, or TJX, which he sees as symptoms of a broader, societal failure to recognize the value of personal data. Chatting with InfoWorld in a hotel across from San Francisco's Moscone Center, where the RSA Conference is in full swing, Baich said that the U.S. needs a grassroots campaign to educate ordinary citizens about the need to protect their personal information. Baich, who was accompanied by an attentive press officer from Deloitte, was circumspect when asked to comment on the recent breach at TJX but said that companies need to do a better job of understanding the "lifecycle" of information within their organizations and need to develop strategies to combat data loss that are based on risk, not merely on compliance demands or technology. Asked to comment on TJX's decision to wait more than a month after disclosing the theft of credit card data from its network, Baich said that companies are often under orders from law enforcement to keep news of a breach secret while an investigation is ongoing. However, companies need to do a better job about protecting their interests -- asking law enforcement to put their request to suppress information about a breach in writing, then being honest in saying that the company held off on notifying the public at the request of law enforcement, for example. Baich, who faced stern criticism from many former supporters for suggesting that the failure of ChoicePoint to vet its customers wasn't the purview of the CISO, said he now has a more holistic view of enterprise security after working on behalf of companies for Price Waterhouse Coopers and now Deloitte. "It's allowed me to experience things differently. You can't talk about security or privacy and compliance without talking about people, policies, and processes," he said. Among other things, companies need to plan in advance for incidents like the TJX or ChoicePoint breach and create cross-disciplinary teams, including human resources, legal, information security, physical security, and law enforcement personnel, to respond to them when they occur, Baich said. "More than ever, companies are evaluated on their response by the press and by their shareholders," he said. "There's an opportunity to consolidate those into an effective, functioning team that takes a mature, holistic approach, but it requires organizational change." However, even the best-intentioned companies will continue to wrestle with breaches if the public's awareness of the threat of identity theft and data loss isn't improved. As an example, Baich cites a promotion currently going on in San Francisco by radio station KFRC 99.7 where users are asked to fax the station something with the numbers 997 in it -- including possible social security or driver's license numbers -- in order to win a prize. Baich shakes his head. "As an employer, what can you really do to prevent your employees from doing something like that?" he asks. "As a society, we have to mature from an ethical standpoint in the way we protect information," he said. But companies and public sector organizations are equally in need of schooling. As a counterpoint to the KFRC story, Baich recalls a recent hotel stay in New York City where he was asked to provide a driver's license so the hotel could make a photocopy for its records and noted a recent column in the San Francisco Chronicle about thousands of Visa applications from the Indian Consulate in San Francisco, which were sent whole to a recycling center and sat, in the open, for months before Consulate officials were notified of the problems. The documents contained detailed personal information that would be useful to identity thieves and included applications submitted by Byron Pollitt, CFO of San Francisco's The Gap, and Anne Gust, wife of California Attorney General Jerry Brown. "These are more cultural issues than technology issues," he said. "We need a grassroots campaign to raise awareness about this," he said.
395933
Gone Spear phishin' A provider of online security services has uncovered a highly sophisticated phishing scheme that has already duped at least 1,400 US executives. They were fooled into sending sensitive information in response to an email purporting to come from officials at the Better Business Bureau.â¦
645535
The attorney general's request that banks send spam to warn of phishing has some befuddled.
43473
HSBC Holdings, Europe&#39;s biggest bank by market value, said Monday that David Eldon would retire as chairman of Hongkong and Shanghai Banking Corp.
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."