Showing posts with label Phishing. Show all posts
Showing posts with label Phishing. Show all posts

Yet Another Reason Banks Should Call for the Mass Adoption of Peripheral Card Readers for Online Banking




European Banks:  29

American Banks: Zero
During the course of the past year, I have made a huge effort to point out that online banking (the way it is conducted now) is doomed for failure. (see related posts below)  I started with a series I called: "Online Banking is Weak Week."



Bottom line?  Online Banking MUST be done "outside" the browser space.  We've seen the ZeuS, Clampi, URLZone, BlackEnergy2 banking trojans, we've seen lawsuits filed by customers against banks accusing them of lax authentication procedures, we've see keylogging, man in the middle and man in the browser attacks, we've seen billions of phishing attempts, we've seen the head of the FBI swear off online banking, we've been told we need a "dedicated" machine for online banking.  We've seen Avivah state that nothing in the browser can be trusted, I can go on and on... and I will because...










OTP's (One Time Passwords) will be circumvented

by MITB attacks. (and real-time keylogging)
American banks go on and on with their belief they can protect the security of their customers by asking them to type data into boxes in a browser.  (European Banks are trending towards issuing card readers and almost 30 percent (see chart above) of European online banking customers use a card reader)



Either I don't get it or the banks don't.  I'm confident enough to say that if you were to go back through the PIN Debit blog over the past 18 months or so and look at everything I've posted regarding online banking, you will see that I'm not the one who doesn't get it.  (type "online banking security" into the custom search box for proof)







I'm not Nostradamus, but I can tell you this.  Banks would "prophet" from the eradication of "typing" and thus all the problems associated with with it. 


When Kaspersky Labs calls for the mass adoption of peripheral card readers and suggests that banks could be big drivers of this type of hardware, then banks might want to pay more attention.  On the horizon is a new dilemma for online banking security.  





Avivah Litan, distinguished analyst from Gartner Research points out that banks rely on "flash cookies" to identify legitimate users and that's about to change.  



Again...Why not use a common sense approach to authenticate legitimate users.  Take your "bank issued" card out of your purse/wallet and swipe it through a PCI certified PIN Entry Device designed for online commerce and securely enter your PIN.  What you have (card) and what you know (PIN) is entered into what the bank owns (the peripheral PED card reader)  





Adobe Flash Player Private Browsing May Force Change in Fraud Fight 





A report from Gartner highlights how the reliance on Flash cookies as an authentication mechanism by online banks may need to change with the release of Adobe Flash Player 10.1. Flash Player's "Private Browsing" feature will make it easier to clear Flash cookies, and e-commerce businesses will need to adjust, some say.










Banks Should Be Big Drivers

of this kind of hardware.  First

they need to admit that they're

in a losing battle with hackers

and must stop with the band-aid

responses to the real threats they face.
When the final version of Adobe Flash Player 10.1 hits desktops later this year, it will bring with it new functionality designed to allow users to automatically clear Flash cookies after a Web session. But while the feature may be lauded in the name of privacy, it may also force online banks to change how they fight fraud.


Flash cookies, also known as LSO (local shared objects), are used by many banks and e-commerce sites to identify legitimate users and block unauthorized or fraudulent access. In a report entitled, "Privacy Collides With Fraud Detection and Crumbles Flash Cookies," Gartner analyst Avivah Litan writes that the practice of using HTTP browser cookies for authentication gained steam roughly three years ago due to guidelines imposed by the Federal Financial Institutions Examination Council.



“Most banks responded by implementing stronger authentication that depended in large part on knowing that their online banking customer was logging in from a known PC,” Litan wrote.


“Upon entering a user ID to log into an online banking session, the bank Web server would check for the presence of this cookie…If the bank software could not find the cookie – for example because the user was logging in from a different PC – then the bank software would generally challenge the user with a series of questions that only the legitimate user could presumably answer.”


But a growing desire for privacy led users to delete their browser cookies more often, meaning banks had to find something else to rely on, the report noted. Enter Flash LSOs, which are “basically hidden from casual users who aren’t aware of them and don’t know how to delete them.”


Now that approach could be threatened as well, Litan told eWEEK...<<read more>>
Related articles by Zemanta
Enhanced by Zemanta

Full Story
Posted by John B. Frank Friday, June 18, 2010 0 comments

Yet Another Reason Banks Should Call for the Mass Adoption of Peripheral Card Readers for Online Banking

Yet Another Reason Banks Should Call for the Mass Adoption of Peripheral Card Readers for Online Banking

European Banks:  29
American Banks: Zero
During the course of the past year, I have made a huge effort to point out that online banking (the way it is conducted now) is doomed for failure. (see related posts below)  I started with a series I called: "Online Banking is Weak Week."

Bottom line?  Online Banking MUST be done "outside" the browser space.  We've seen the ZeuS, Clampi, URLZone, BlackEnergy2 banking trojans, we've seen lawsuits filed by customers against banks accusing them of lax authentication procedures, we've see keylogging, man in the middle and man in the browser attacks, we've seen billions of phishing attempts, we've seen the head of the FBI swear off online banking, we've been told we need a "dedicated" machine for online banking.  We've seen Avivah state that nothing in the browser can be trusted, I can go on and on... and I will because...



OTP's (One Time Passwords) will be circumvented
by MITB attacks. (and real-time keylogging)
American banks go on and on with their belief they can protect the security of their customers by asking them to type data into boxes in a browser.  (European Banks are trending towards issuing card readers and almost 30 percent (see chart above) of European online banking customers use a card reader)

Either I don't get it or the banks don't.  I'm confident enough to say that if you were to go back through the PIN Debit blog over the past 18 months or so and look at everything I've posted regarding online banking, you will see that I'm not the one who doesn't get it.  (type "online banking security" into the custom search box for proof)
I'm not Nostradamus, but I can tell you this.  Banks would "prophet" from the eradication of all the problems associated with Typing vs. Swiping.

When Kaspersky Labs calls for the mass adoption of peripheral card readers and suggests that banks could be big drivers of this type of hardware, then banks might want to pay more attention.  On the horizon is a new dilemma for online banking security.  


Avivah Litan, distinguished analyst from Gartner Research points out that banks rely on "flash cookies" to identify legitimate users and that's about to change.    Again...Why not use a common sense approach to authenticate legitimate users.  Take your "bank issued" card out of your purse/wallet and swipe it through a PCI certified PIN Entry Device designed for online commerce and securely enter your PIN.  What you have (card) and what you know (PIN) is entered into what the bank owns (the peripheral PED card reader)  


Adobe Flash Player Private Browsing May Force Change in Fraud Fight 


A report from Gartner highlights how the reliance on Flash cookies as an authentication mechanism by online banks may need to change with the release of Adobe Flash Player 10.1. Flash Player's "Private Browsing" feature will make it easier to clear Flash cookies, and e-commerce businesses will need to adjust, some say.


Banks Should Be Big Drivers
of this kind of hardware.  First
they need to admit that they're
in a losing battle with hackers
and must stop with the band-aid
responses to the real threats they face.
When the final version of Adobe Flash Player 10.1 hits desktops later this year, it will bring with it new functionality designed to allow users to automatically clear Flash cookies after a Web session. But while the feature may be lauded in the name of privacy, it may also force online banks to change how they fight fraud.

Flash cookies, also known as LSO (local shared objects), are used by many banks and e-commerce sites to identify legitimate users and block unauthorized or fraudulent access. In a report entitled, "Privacy Collides With Fraud Detection and Crumbles Flash Cookies," Gartner analyst Avivah Litan writes that the practice of using HTTP browser cookies for authentication gained steam roughly three years ago due to guidelines imposed by the Federal Financial Institutions Examination Council.

“Most banks responded by implementing stronger authentication that depended in large part on knowing that their online banking customer was logging in from a known PC,” Litan wrote.

“Upon entering a user ID to log into an online banking session, the bank Web server would check for the presence of this cookie…If the bank software could not find the cookie – for example because the user was logging in from a different PC – then the bank software would generally challenge the user with a series of questions that only the legitimate user could presumably answer.”

But a growing desire for privacy led users to delete their browser cookies more often, meaning banks had to find something else to rely on, the report noted. Enter Flash LSOs, which are “basically hidden from casual users who aren’t aware of them and don’t know how to delete them.”

Now that approach could be threatened as well, Litan told eWEEK...<<read more>>


Read more: http://pindebit.blogspot.com/2010/06/yet-another-reason-banks-should-call.html#ixzz0rEqSGASJ
Enhanced by Zemanta

Full Story
Posted by John B. Frank 0 comments

Tabnapping (New Phishing Technique)

Picture taken by Peishan Tan. She has public d...Image via Wikipedia


Mozilla's Aza Raskin (left) is warning about a new type of phishing attack called tabnabbing.
Unlike traditional phishing attacks which trick people into clicking on links that take them to bogus sites that look legitimate, tabnabbing doesn't require a user to click on a link. But it too can trick people into disclosing their usernames and passwords.
While you're visiting a Web page infected with malicious tabnabbing code, a tab in the background morphs into what appears to be a legitimate site like Gmail or a banking site. To the user it looks quite familiar and since it's not uncommon for people to have multiple tabs open at the same time, it's easy to assume that it really is the site you want to visit. When you click on it, you're not logged in, but that too can seem quite normal since many sites log you out automatically after a period of time. However, if you're a tabnabbing victim and try to log in to the site, you wind up giving your log-in credentials to the tabnabber.


Related articles by Zemanta
Enhanced by Zemanta

Full Story
Posted by John B. Frank Monday, June 14, 2010 0 comments

Phishers Ambush Military Credit Unions

Internet.com is reporting that "a number of bogus Web sites that appear to be the official pages of a pair of credit unions used by military personnel are actually phishing traps designed to steal soldiers' identities."



Phishing can be eliminated. What they are "phishing" for are online banking passwords and usernames. Get rid of the antiquated login process and start "really" getting serious about authentication.



Replicate the same trusted process to disperse cash "in real time" from an ATM and two-factor" authenticate the online banking session by having customers swipe their bank-issued card and enter their bank-issued PIN.  



Start doing that, and banks will eradicate the "phishing" problem...because there will be nothing left to phish phor.



The money banks spend "phighting" phishing can be spent providing their customers with a PCI 2.1 Certified PED resulting in the complete eradication of the threat posed.  (it would also provide an ROI to the issuing bank via interchange revenue derived from usage of the device for eCommerce purchases)



Whats the phake phishing site going to ask people to do? Swipe their card and Enter their PIN?  Worthless move.  It's instantly 3DES DUKPT encrypted inside the device and guess who "doesn't" have the encryption key? If you said the phisher you're right.  If you said the online banking customer you are also correct.  The way it's done now, the customer does have the information being phished phor.  



Translation: No more username/passwords.



Even the customer him/herself does NOT have the "information" the phishers are looking for so they cannot be "duped" into providing it.



Make sense?  When swiping the card and entering the PIN "outside the browser and inside the box" and there isn't "ANY phishable" information.





That's why Eugene Kaspersky of Kaspersky Labs last week called for "MASS adoption of peripheral card readers for ALL internet banking customers. (see top left...and click the top right sidebar graphic for the complete story)



May 28, 2010  By Larry Barrett


Phishers don't play favorites and their latest intended victims are the men and women in uniform.









As eSecurity Planet discovered, several clever phishing traps have popped up online in the past year with almost the exact same look and feel of a pair of popular credit unions primarily used by folks serving in the U.S. military.


Security software experts are warning customers of both USAA, an insurance and financial services firm, and the Navy Federal Credit Union to be especially vigilant before divulging their Social Security numbers, passwords, account numbers and other personally identifying information.
Symantec said this latest attack comes from Web sites hosted on servers in Taiwan and variants of this particular phishing URLs have been used to spoof other online brands as well.
U.S. Strategic Command officials are joining leading security software vendors in warning soldiers serving in the U.S. Army, Navy, Air Force and Marine Corps to be on high alert for a new phishing scam that targeting customers at a pair of credit unions catering to servicemen and their families.
Gen. Kevin P. Chilton, the STRATCOM commander, is warning soldiers and their families that bogus Web sites imitating both USAA, a popular insurance and financial services firm catering to military families, and the Navy Federal Credit Union have successfully stolen the personal and banking data of an unknown number of customers. 

Read the full story at eSecurity Planet: 

Phishing Scam Targets Military Credit Unions





Related articles by Zemanta
Reblog this post [with Zemanta]

Full Story
Posted by John B. Frank Saturday, May 29, 2010 0 comments

Phishers Ambush Military Credit Unions

Internet.com is reporting that "a number of bogus Web sites that appear to be the official pages of a pair of credit unions used by military personnel are actually phishing traps designed to steal soldiers' identities."



Phishing can be eliminated. What they are "phishing" for are online banking passwords and usernames. Get rid of the antiquated login process and start "really" getting serious about authentication.



Replicate the same trusted process to disperse cash "in real time" from an ATM and two-factor" authenticate the online banking session by having customers swipe their bank-issued card and enter their bank-issued PIN.  



Start doing that, and banks will eradicate the "phishing" problem...because there will be nothing left to phish phor.



The money banks spend "phighting" phishing can be spent providing their customers with a PCI 2.1 Certified PED resulting in the complete eradication of the threat posed.  (it would also provide an ROI to the issuing bank via interchange revenue derived from usage of the device for eCommerce purchases)



Whats the phake phishing site going to ask people to do? Swipe their card and Enter their PIN?  Worthless move.  It's instantly 3DES DUKPT encrypted inside the device and guess who "doesn't" have the encryption key? If you said the phisher you're right.  If you said the online banking customer you are also correct.  The way it's done now, the customer does have the information being phished phor.  



Translation: No more username/passwords.



Even the customer him/herself does NOT have the "information" the phishers are looking for so they cannot be "duped" into providing it.



Make sense?  When swiping the card and entering the PIN "outside the browser and inside the box" and there isn't "ANY phishable" information.





That's why Eugene Kaspersky of Kaspersky Labs last week called for "MASS adoption of peripheral card readers for ALL internet banking customers. (see top left...and click the top right sidebar graphic for the complete story)



May 28, 2010  By Larry Barrett


Phishers don't play favorites and their latest intended victims are the men and women in uniform.









As eSecurity Planet discovered, several clever phishing traps have popped up online in the past year with almost the exact same look and feel of a pair of popular credit unions primarily used by folks serving in the U.S. military.


Security software experts are warning customers of both USAA, an insurance and financial services firm, and the Navy Federal Credit Union to be especially vigilant before divulging their Social Security numbers, passwords, account numbers and other personally identifying information.
Symantec said this latest attack comes from Web sites hosted on servers in Taiwan and variants of this particular phishing URLs have been used to spoof other online brands as well.
U.S. Strategic Command officials are joining leading security software vendors in warning soldiers serving in the U.S. Army, Navy, Air Force and Marine Corps to be on high alert for a new phishing scam that targeting customers at a pair of credit unions catering to servicemen and their families.
Gen. Kevin P. Chilton, the STRATCOM commander, is warning soldiers and their families that bogus Web sites imitating both USAA, a popular insurance and financial services firm catering to military families, and the Navy Federal Credit Union have successfully stolen the personal and banking data of an unknown number of customers. 

Read the full story at eSecurity Planet: 

Phishing Scam Targets Military Credit Unions





Related articles by Zemanta
Reblog this post [with Zemanta]

Full Story
Posted by John B. Frank 0 comments

Online Phishing Scams Get Personal, Experts Caution






If we swiped vs. typed there would be nothing to phish phor...



We offer the only PCI 2.0 Certified PIN Entry Device

designed specifically for online banking authentication,

eCommerce and mCommerce use.  (USB & DTMF)









Online Phishing Scams Get Personal, Experts Caution
(from Yahoo at 5-18-2010)
In a new phishing trend, spammers are focusing on individualized attacks. Recipients may be deceived into thinking the message is from a friend, but these spammers want access to their credit card accounts. Phishing is a common scamming practice that involves emailing users under false pretenses with the aim of tricking them into revealing their private information. The emails feature the recipients' names in the subject lines, claim to have seen them at Starbucks, and ask them to click on... read more»
Reblog this post [with Zemanta]

Full Story
Posted by John B. Frank Tuesday, May 18, 2010 0 comments

Online Phishing Scams Get Personal, Experts Caution






If we swiped vs. typed there would be nothing to phish phor...



We offer the only PCI 2.0 Certified PIN Entry Device

designed specifically for online banking authentication,

eCommerce and mCommerce use.  (USB & DTMF)









Online Phishing Scams Get Personal, Experts Caution
(from Yahoo at 5-18-2010)
In a new phishing trend, spammers are focusing on individualized attacks. Recipients may be deceived into thinking the message is from a friend, but these spammers want access to their credit card accounts. Phishing is a common scamming practice that involves emailing users under false pretenses with the aim of tricking them into revealing their private information. The emails feature the recipients' names in the subject lines, claim to have seen them at Starbucks, and ask them to click on... read more»
Reblog this post [with Zemanta]

Full Story
Posted by John B. Frank 0 comments

Payments Industry News Blog

Search the PIN Debit Blog by Subject

Kapersky Calls for Mass Adoption of Card Readers

Kapersky Calls for Mass Adoption of Card Readers