|
Aurora, Il USA
Experience: Advanced
Platform: TradeStation
Trading: futures
Posts: 5,854 since Nov 2010
Thanks Given: 3,295
Thanks Received: 3,364
|
Cybercriminals are sneaking past security protections to access online accounts across 34 banks in Switzerland, Sweden, Austria and Japan. And in doing so, experts say, the hackers are defeating what’s often touted as one of the more effective online security protocols.
The attack can get past two-factor authentication, which requires customers to type in a code sent to their cellphone or inbox to ensure the user is who he or she claims to be, by convincing customers to download a malicious smartphone app, according to a report released Tuesday by the security firm Trend Micro. The researchers dubbed the technique “Emmental” — like the Swiss cheese — because they say it shows the security flaws in online banking. So far, funds “in the seven figures” have been taken from bank accounts, according to Trend Micro spokesman Thomas Moore.
Hackers are turning to Japan’s free messaging app, Line, to target its users. The WSJ’s Yun-Hee Kim speaks with Tokyo reporter Megumi Fujikawa, who had her account hacked.
In typical form, the attack begins with realistic-looking phishing emails that install malware to give hackers control. Then the malware deletes itself, leaving no traces, and users are redirected to malicious servers when using banking websites. The website asks users to log in, and then install a special mobile app to receive the security code to log on. Instead of fostering more secure transactions, the app intercepts customer data.
Two-factor authentication, hailed as an essential second gatepost for online accounts, can sometimes prove to be an empty promise. Experts have found that the text messages that banks send customers can be intercepted, or in other cases, the hackers can scrape peoples’ screens to know the answers to extra security questions. Last month, PayPal said it was working to fix a flaw in its two-step authentication that virtually made the extra layer useless.
“This is a threat that’s going to migrate west,” says Tom Kellermann, Trend Micro’s chief cybersecurity officer, adding that European banking security is more stringent and “if this attack code is viable against those institutions, then it will be even more prevalent here in the U.S.”
The researchers said they found Russian slang in the app’s code, including the phrase “Obnilim rid,” which translates to “set to zero.” They also found connections originating from Romania, according to the report.
“This shows technical sophistication on par with the intelligence community,” Kellermann says.
Hackers bypass online security at 34 banks - MarketWatch
|
