25 February 2018


Retired Member

3,420Posts 12,747,197Views 4,239Comments
Online Banking

Online Banking

This community is for discussion of developments in the e-banking world, including mobile banking. This can include all the functional, business, technical, marketing, web site design, security and other related topics of Internet Banking segment, including public websites of the banks and financial institutions across the globe.

Zeus continues to reign on high

05 May 2010  |  3887 views  |  2

News last week that Zeus, a virus that steals online banking details from infected computer users, is more powerful than ever should come as no surprise.

The malware steals log-in information by recording keystrokes when the infected user is on a list of target websites. The user's data is then sent to a remote server to be used and sold on by cyber-criminals. Banks’ web sites are top of the target list.

Banks can protect their customers’ online banking from criminals by introducing two-factor authentication – either via the mobile or via a CAP reader. The passwords captured using the keystroke logger become useless without the second factor. Ultimately, two-factor authentication could be used for log-in and to sign transactions, but this is probably unwieldy for most online use – and security is always a balance of cost, security and usability. Savvy banks however have come up with a compromise: ask customers for usernames and passwords to log-in, but require two-factor authentication when customers wish to access or change sensitive information or authorise payments and transfers of funds.

Unfortunately not all banks have taken this approach, and until they do, their customers will remain vulnerable. Only by properly securing the internet banking process using two-factor authentication can banks start waging an equal war against the cyber criminal.


Comments: (3)

Ben Smyth
Ben Smyth - University of Birmingham - UK | 21 May, 2010, 18:32

Should the use of mobile phones be advocated for authentication in banking systems?

Zane Lackey, iSec Partners, and Luis Miras, an independent security consultant, suggest telephones are becoming popular for phishing style attacks. Surely it would therefore be prudent to avoid their use for authentication purposes?

Zane Lackey and Luis Miras (2009) Attacking SMS. In proceedings of Black Hat Briefings USA, Caesars Palace, Las Vegas, USA.

Jeff Anderson (2010) Mobile Spoofing. BBC Watchdog, http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.html

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
A Finextra member
A Finextra member | 27 May, 2010, 10:25

Thanks for the information Ben. I had not seen this specific information on mobile phone phishing attacks. It was quite worrying to see the lady on the BBC Watchdog clip giving away her account details and personal information so easily. Phishing through whatever means probably cannot be eliminated, but better awareness of its dangers can potentially reduce its impact.

There are various two-factor approaches using mobile phones. Some of them do not require any network connection once the two-factor application has been downloaded to the phone and validated. I can't see how phishing could attack this approach very easily.

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
Ben Smyth
Ben Smyth - University of Birmingham - UK | 27 May, 2010, 13:08

Thanks for the reply. I believe http://www.cronto.com/ offer services similar to those that you describe.

Be the first to give this comment the thumbs up 0 thumb ups! (Log in to thumb up)
Comment on this story (membership required)

Retired's profile

job title
member since 2014
Summary profile See full profile »

Retired's expertise

Member since 2009
3420 posts4,239 comments
What Retired reads

Who's commenting on Retired's posts

Ketharaman Swaminathan
Edward Sutton
Paul Love
Dharmesh Mistry