Bank Trojan Uses New Tricks to Hijack Account Info

12

Comments

+ Add a Comment
avatar

Zach56

"  Well I certainly don't want any of these slimeball hackers to have access to my bank account but if by some miracle they do break into my account, they aren't gonna find much money in there anyway.  LOL  

So I guess this means that we'll all have to answer another 20 questions whenever we login like" "Fav Pet" or "Uncle Billy's middle name".  Can't wait!

avatar

dethdeks

i was actually reading about securing sessions and tokens the other day and an simple solution would be to secure the sessions better by adding checks to see if things have changed I.E ip address. if i login to my bank at home via my pc and then login to it at a friends house at the same time its gonna notice the ip's are different and is gonna make us log back in. also another simple secure way that can be put into place(but sorta easy to bypass) is user agent checks. I.E check to see what browser and what version your on. and if it changes chances are your not running two different browsers at the same time checking one thing on your bank site. but again like i said that can be bypassed by checking the user agent before running your browser with that token.

avatar

Blaze589

I figure the best thing you can do is to have a blocklist that covers all Eastern European countries. You can also have a browser sandboxed. Sandboxing a browser will make it difficult for the browser to communicate with the malware. This assumes you're infected so your first line of defense is your common sense followed by your AV client and a blocklist if implemented.

avatar

jgrimoldy

Hmmm...

I suppose you *could* always just.. y'know:

  1. Do your banking at the bank, in person.
  2. Mail old-fashioned checks to your creditors.

'Doesn't seem that hard to thwart

avatar

nsvander

You realize that the checks could just as easily be stolen, and then they would have the routing number and account number to your checking account.  Then then could also get access to your credit card if you are sending that in, and like a good member wrote the account number for the card on the check like they are always asking for.

avatar

jgrimoldy

>>You realize that the checks could just as easily be stolen

No.  No, I don't.  Stolen from where?  Stolen from your home in a break in?  mmmmm.. kay... So can a lot of valuables.

Stolen from your home's mailbox that you raised the flag on for pickup by your mailman?  Yes, absolutely.  It's generally a pretty dumb idea to mail your bills that way.

Stolen after you dropped them off at the post office?  I s'pose you're right and that's just one of the countless risks of living in the U.S.  I think that's sort of unlikely.

Stolen from the increasingly rare blue neighborhood mailbox that you dropped them in?  Really?  Does that happen in your neighborhood?

Look, be lazy.  I really don't care... You know the risks.  I'll take my chances with the post.

 

avatar

mesiah

If we are going to go that far why don't we just stuff all our money under the matress like grandpa...

avatar

jgrimoldy

Really?  You equate mailing checks and banking in person with stuffing money in your mattress?

I do suppose that the interest rate won't be too much different.

Look, if you're that married to the streamlined processes of bill-pay, online banking, and direct deposit, go right ahead.  You know the risks.  The alternative, antiquated ways of 10 years ago do not carry the same risks, and they get you out of the house.

Bonus: Banking in person helps to keep people in your neighborhood (known as tellers) employed.

avatar

armyguy298

@SOMEUID

You can use a program called "Process Explorer" from Sysinternals/Microsoft to view anything you want about a particular process. Unfortunately you do need to be administrator to install the program...

http://technet.microsoft.com/en-us/sysinternals/bb896653

 

This article is talking about a "man-in-the-middle" attack that is extremely hard to pull off. If the OddJob software is tweaked properly, it can be a very dangerous for anyone using SSL/TLS sessions to a secure website. Make sure your malware software is up to date and you know ALL your running programs!!

avatar

someuid

Insideous.  Time for app-->network connection mapping software program to give you another level of monitoring.  My workstaton here at work has 11 copies of svchost running and I couldn't begin to tell you which program established each instance.

avatar

al360ex

Another example of hackers taking over the world...

avatar

Neufeldt2002

That is scary.

Log in to MaximumPC directly or log in using Facebook

Forgot your username or password?
Click here for help.

Login with Facebook
Log in using Facebook to share comments and articles easily with your Facebook feed.