An article relating to this blog post on Finextra:
ABN Amro compensates victims of 'man-in-the-middle' attack
Four ABN Amro customers activated a virus allowing a man-in-the-middle attack that overcame the bank's two-factor authentication. After the attack, ABN Amro removed an 'urgent payment' option from its...
See article
I blogged
here last August, that it was predicted Man in the Middle attacks would defeat tokens, and sure enough here we go.
"The bank says that its customers opened an email attachment that resulted in a virus being executed on their machines. This virus changed their browsers' behaviour so when they went to open the real ABN Amro online banking site, they were instead re-directed
to a spoof site.
The customers then typed in their passwords, which the attacker in turn used to access the bank's real Web site. The customer's own transactions were passed along to the real site, so they didn't notice anything wrong right away, while the attacker simultaneously
made their own fraudelent transactions using the bank's urgent payment feature."
One thing that 100% of security experts will tell us, is that there is no universal solution. Security requires a layered approach of a security portfolio comprising multiple solutions. Tokens have been held out as
"the" solution, and this simply not true.