Blog article
See all stories »

Zeus continues to reign on high

News last week that Zeus, a virus that steals online banking details from infected computer users, is more powerful than ever should come as no surprise.

The malware steals log-in information by recording keystrokes when the infected user is on a list of target websites. The user's data is then sent to a remote server to be used and sold on by cyber-criminals. Banks’ web sites are top of the target list.

Banks can protect their customers’ online banking from criminals by introducing two-factor authentication – either via the mobile or via a CAP reader. The passwords captured using the keystroke logger become useless without the second factor. Ultimately, two-factor authentication could be used for log-in and to sign transactions, but this is probably unwieldy for most online use – and security is always a balance of cost, security and usability. Savvy banks however have come up with a compromise: ask customers for usernames and passwords to log-in, but require two-factor authentication when customers wish to access or change sensitive information or authorise payments and transfers of funds.

Unfortunately not all banks have taken this approach, and until they do, their customers will remain vulnerable. Only by properly securing the internet banking process using two-factor authentication can banks start waging an equal war against the cyber criminal.

3982

Comments: (3)

Ben Smyth
Ben Smyth - University of Birmingham - UK 21 May, 2010, 18:32Be the first to give this comment the thumbs up 0 likes

Should the use of mobile phones be advocated for authentication in banking systems?

Zane Lackey, iSec Partners, and Luis Miras, an independent security consultant, suggest telephones are becoming popular for phishing style attacks. Surely it would therefore be prudent to avoid their use for authentication purposes?

Zane Lackey and Luis Miras (2009) Attacking SMS. In proceedings of Black Hat Briefings USA, Caesars Palace, Las Vegas, USA.

Jeff Anderson (2010) Mobile Spoofing. BBC Watchdog, http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.html

A Finextra member
A Finextra member 27 May, 2010, 10:25Be the first to give this comment the thumbs up 0 likes

Thanks for the information Ben. I had not seen this specific information on mobile phone phishing attacks. It was quite worrying to see the lady on the BBC Watchdog clip giving away her account details and personal information so easily. Phishing through whatever means probably cannot be eliminated, but better awareness of its dangers can potentially reduce its impact.

There are various two-factor approaches using mobile phones. Some of them do not require any network connection once the two-factor application has been downloaded to the phone and validated. I can't see how phishing could attack this approach very easily.

Ben Smyth
Ben Smyth - University of Birmingham - UK 27 May, 2010, 13:08Be the first to give this comment the thumbs up 0 likes

Thanks for the reply. I believe http://www.cronto.com/ offer services similar to those that you describe.

Retired Member

Member since

19 Mar 2009

Location

Blog posts

4,182

Comments

4,992

This post is from a series of posts in the group:

Online Banking

This community is for discussion of developments in the e-banking world, including mobile banking. This can include all the functional, business, technical, marketing, web site design, security and other related topics of Internet Banking segment, including public websites of the banks and financial institutions across the globe.


See all