Pierluigi Paganini
December 08, 2011
Have you ever wondered what are the main threats have concerns the banks and financial institutions? Several survey have been conducted and apart small differenced of on numbers they all have evidenced that Top fraud threats are
When these frauds are detected? The major part of the incidents are evidenced by the customers, the final victims. We are speaking of a percentage that is around the 80%,numbers that are worrying and highlight the difficulty of approaching a problem. Institutions feel prepared to prevent classic card fraud like check fraud and money laundering but it is not a new that these institutions are not so skilled to fight the new threat represented by cybercrime. We have observed an exponential escalation of malware attacks which target transactions, this kind of fraud is increasing respect the others.
Cyber threats are among those that are of particular concern and the reason is understandable analyzing the number of transitions that are made every second all over the word. A boundless ocean from which to “fish” and within each control and prevention is very difficult. Compounding the scenario is the same technological evolution, increasingly complex and sophisticated malware able to attack advanced platforms to provide miscellaneous services to customers and internal staff. Easy for those malware typically found before then next-generation agents that take advantage of 0 day vulnerability and from them is really hard to implement prevention policies.
But what are the main threats that the world of finance is concerned?
Attacck DDOS, spearphishing, malware as Zeus and SpyEye … but what would happen if all these components come together in one combined action? The threat could cause much damages, and if you think that is the result of my paranoia then read what I have to tell you:
The Federal Bureau of Investigation (FBI) recently warned consumers about a scam multiprong That Involves the use of spearphishing, the Zeus Trojan horses, DDoS attacks, and a jewelry heist.The spam campaign pretends to be Legitimate e-mails from the National Automated Clearing House Association (NACHA), advising the user there is a problem with the ACH transaction at Their bank. They click on the link Once They Are infected with a variant of the Zeus Trojan known as GameOver, Which Is Able to keylog and steal information Their Their online banking credentials, the Denver FBI Cyber Squad explained. “After the accounts are compromised, the perpetrators conduct a DDoS attack on the financial institution. The belief is the DDoS is used to deflect attention from the wire transfers as well to make them unable to reverse the transactions (if found). A portion of the wire transfers (not all) are being transmitted directly to high-end jewelry stores, wherein the money mule comes to the actual store to pick up his $100K in jewels (or whatever dollar amount was wired)”, the FBI explained.
I could finally give some additional information on the potential related to a malware that is designed to attack the banking sector.Let’s introduce for example Zeus, a Trojan developed to steal banking information by keystroke logging and form grabbing. Zeus is spread mainly through drive-by downloads and phishing schemes. In June 2009 the company Prevx has discovered that Zeus had compromised over 75,000 FTP accounts on websites of such companies as the Bank of America, NASA, Monster, ABC, Oracle, Play.com, Cisco, Amazon, and BusinessWeek. To give a dimension of the phenomenon the various Zeus’ botnets has been calculated to include to include aroind 4 millions of compromised computers only in USA. As of October 28, 2009 over 1.5 million phishing messages were sent on Facebook with the purpose of spreading the Zeus’ trojan.
It was still active in 2010.On July 14, 2010, security firm Trusteer filed a report, which says that the credit cards of more than 15 unnamed US banks have been compromised. The number of computers infected with the ZeuS banking trojan is four times higher than that of systems infected with SpyEye, according to statistics compiled by Trusteer.
Consider that the economic impact on the institutions is really high due direct fraud and other indirect voices like loss of productivity and loss of customer confidence. Of course, managing customer trust is tricky in consideration of the increase of cyber attacks like the phishing threat, where customers may think their institution has been breached even though that’s not the case.
Banks and similar institutions are responding to the threat in different way:
The awareness of the threat and the attention that the economic/financial world are paying for these new forms of fraud, a hopeful sign that the fight will be tough but that we are ready to deal with the right energy.
The world is changing and with it the way we do and offer banking services.
Pierluigi Paganini
References
http://www.fico.com/en/FIResourcesLibrary/Fraud-Survey-ExecSummary.pdf
http://en.wikipedia.org/wiki/Zeus_(trojan_horse)
