Comments on: eBanking Victim? Take a Number. http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/ In-depth security news and investigation Sat, 11 Feb 2012 19:29:31 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: JCitizen http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4548 JCitizen Sun, 28 Mar 2010 21:58:21 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4548 All good questions, that I can't answer. I can only site that our local college is using a nearly identical paid for solution by Faronics, that has kept them clean for fourteen years, as far as their client machines go. I think they've had only one breach, and it was recently - I do believe - because of mistakes by a staff member who trashed the security on a server. It has always been my understanding, that once you lock the drive with steady state, it is just a simple thing to unlock it to do maintenance. This may only require rebooting during this operation. Here is more, and also a link to the handbook. http://www.microsoft.com/windows/products/winfamily/sharedaccess/faq.mspx I don't use steady state yet, because my in-depth defenses have proven themselves so far. I still take extraordinary steps to protect my credit, though - like a card that generates new card numbers for every vendor. Steady state does, like a VM, need a large partition. They say this is for 'caching', so I don't know how this compares to virtual technology. Also, If one's bank is not secure in the first place, PC security will be pointless. Many banks in our community have questionable security. There is always paypal; but even they have, in the past, been cracked at least once! All good questions, that I can’t answer. I can only site that our local college is using a nearly identical paid for solution by Faronics, that has kept them clean for fourteen years, as far as their client machines go. I think they’ve had only one breach, and it was recently – I do believe – because of mistakes by a staff member who trashed the security on a server.

It has always been my understanding, that once you lock the drive with steady state, it is just a simple thing to unlock it to do maintenance. This may only require rebooting during this operation. Here is more, and also a link to the handbook.

http://www.microsoft.com/windows/products/winfamily/sharedaccess/faq.mspx

I don’t use steady state yet, because my in-depth defenses have proven themselves so far. I still take extraordinary steps to protect my credit, though – like a card that generates new card numbers for every vendor. Steady state does, like a VM, need a large partition. They say this is for ‘caching’, so I don’t know how this compares to virtual technology.

Also, If one’s bank is not secure in the first place, PC security will be pointless. Many banks in our community have questionable security. There is always paypal; but even they have, in the past, been cracked at least once!

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Matt http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4547 Matt Sun, 28 Mar 2010 21:48:50 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4547 Id like to say thanks for the post too Terry, Ive been thinking about Puppy all weekend and your posts have cleared up alot of questions Ive had. Cheers. Id like to say thanks for the post too Terry, Ive been thinking about Puppy all weekend and your posts have cleared up alot of questions Ive had. Cheers.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: Terry Ritter http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4546 Terry Ritter Sun, 28 Mar 2010 20:49:05 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4546 Thanks for your support! Some things in Puppy Linux do not work as well for me as they do for others. This may be because I run Puppy for security, and so completely from DVD. Most others who run Puppy do so for other reasons and most install to the hard drive. In my view that is just asking for infection, and one of these days we will see it. In any case, the normal remastering stuff has not worked for me, and the end-of-session save stuff often fails, so I use "save" from the desktop instead. Just enough works to make it all practical. Since normal remastering does not work for me, the only alternative I know to duplicate the system involves "save." If we are running Puppy and introduce a plain Puppy DVD (just the .iso burn) and hit "save," it moves the full configuration to the new DVD. That is a way to duplicate the boot disc, except that different machines will have different video cards and will want a different video configuration. We may want to be careful about accidentally distributing personal information like saved files, bookmarks, saved addresses, the closed tabs list, NoScript and NoSquint site customizations and so on. "perhaps simply using a fresh Windows install on a dedicated machine or partition would render the same results using Microsoft’s free Steady State?" I can speak to Puppy Linux issues because I use Puppy for almost everything online, and in fact I am using it right now. While I have been aware of Steady State for some time, I have not used it and so cannot speak authoritatively. My concern would be the ability to update the base state, including Firefox and add-ons and their configurations. Of course the Microsoft "Patch Tuesday" updates also must be easy. And then what happens if we change the video card or sound card or whatever? One thing I learned from Puppy was that, without the ability to incrementally update the base configuration, we have a rather unpleasant platform. Also I wonder just how comparatively hard Steady State is to set up. People are all the time talking about how difficult Puppy is, although most of the configuration I see is Firefox and add-ons, which we need anyway. I would guess that Steady State would be much larger, to some extent complex, and also require some adjustment and relearning like Puppy. And if it is big and complex and Windows (and, thus, a target), it is reasonable to expect security issues. That has made me reluctant to use it. Thanks for your support!

Some things in Puppy Linux do not work as well for me as they do for others. This may be because I run Puppy for security, and so completely from DVD. Most others who run Puppy do so for other reasons and most install to the hard drive. In my view that is just asking for infection, and one of these days we will see it. In any case, the normal remastering stuff has not worked for me, and the end-of-session save stuff often fails, so I use “save” from the desktop instead. Just enough works to make it all practical.

Since normal remastering does not work for me, the only alternative I know to duplicate the system involves “save.” If we are running Puppy and introduce a plain Puppy DVD (just the .iso burn) and hit “save,” it moves the full configuration to the new DVD. That is a way to duplicate the boot disc, except that different machines will have different video cards and will want a different video configuration. We may want to be careful about accidentally distributing personal information like saved files, bookmarks, saved addresses, the closed tabs list, NoScript and NoSquint site customizations and so on.

“perhaps simply using a fresh Windows install on a dedicated machine or partition would render the same results using Microsoft’s free Steady State?”

I can speak to Puppy Linux issues because I use Puppy for almost everything online, and in fact I am using it right now. While I have been aware of Steady State for some time, I have not used it and so cannot speak authoritatively. My concern would be the ability to update the base state, including Firefox and add-ons and their configurations. Of course the Microsoft “Patch Tuesday” updates also must be easy. And then what happens if we change the video card or sound card or whatever? One thing I learned from Puppy was that, without the ability to incrementally update the base configuration, we have a rather unpleasant platform.

Also I wonder just how comparatively hard Steady State is to set up. People are all the time talking about how difficult Puppy is, although most of the configuration I see is Firefox and add-ons, which we need anyway. I would guess that Steady State would be much larger, to some extent complex, and also require some adjustment and relearning like Puppy. And if it is big and complex and Windows (and, thus, a target), it is reasonable to expect security issues. That has made me reluctant to use it.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: JCitizen http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4545 JCitizen Sun, 28 Mar 2010 19:32:38 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4545 Excellent post Terry; This is the road we hashed over at TR on this same subject. I like the LiveCD with update and remastering every so often, and update during session every reboot. However as you pointed to the trust issue with update Linux vs. Windows; perhaps simply using a fresh Windows install on a dedicated machine or partition would render the same results using Microsoft's free Steady State? Excellent post Terry;

This is the road we hashed over at TR on this same subject. I like the LiveCD with update and remastering every so often, and update during session every reboot.

However as you pointed to the trust issue with update Linux vs. Windows; perhaps simply using a fresh Windows install on a dedicated machine or partition would render the same results using Microsoft’s free Steady State?

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: Terry Ritter http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4544 Terry Ritter Sun, 28 Mar 2010 18:28:42 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4544 For some reason Puppy Linux was intended to be practical without a hard drive, which just happens to be a huge security advantage. Apparently Puppy has never been developed for security use, so there is room for security improvement. It is great to have somebody around who can do some of that. But changes also can bring unexpected consequences. "The primary issues being that Puppy Linux LiveCD/DVDs and LiveUSBs want to save the session state upon shutdown, and there is full access to connected devices." But those do not sound like "primary issues" to me, and here is why: It is not really true that Puppy "want[s] to save" when ending a session, it just asks if the user wants to save. The security-oriented user should just say "No." In practice, I only update my DVD every week or two, and then only by using the "save" button on the desktop. My current DVD is about 1/4 full after about 4 months of updates. It is true that Puppy can "access...connected devices," in particular, that would be the hard drive. The users coming from Microsoft Windows can read and write from and to their Windows drive. So when people work in Puppy, they can save their work for later use in Windows, which is good, not bad. Yes, it is possible that some rare malware could run in Puppy (!) and then access the hard drive, but that is not infection. Puppy boots from the DVD (or USB), not the hard drive. Yes, the mythical malware might damage hard drive data, but that is not preventable. Malware can provide its own device support. Not supporting hard drive access in the OS does not solve the problem. If we really want to prevent damage to data on the hard drive (or exposure!), we need to pull out the drive. My laptop now runs without a hard drive, and that works out surprisingly well; much better, in fact, than one would expect. My desktop now has an internal SATA drive caddy so the drive can be removed or replaced in seconds (when the power is off). "However, the concept of a LiveUSB for secure banking is compelling," The idea of taking a secure browsing system to arbitrary hardware is compelling, but Puppy has some issues. In particular, the video card setup does not recur on every boot, which, in my experience, means that booting on a different machine can be an unreadable mess. By knowing which selection invokes video setup the system can be recovered, but the process is very disturbing and inconvenient. That should be changed. It would be nice if Puppy supported both removal and re-insertion of a flash drive. Puppy will update a flash drive as it stands, as long as the drive remains connected. I have been looking at leveraging the write-protect switch on SD flash cards by using a USB card reader. I found one reader which is so narrow that the write-protect switch is partly exposed, and that might be a solution. One big advantage of a flash drive install is, at least potentially, a much faster boot. Also, Puppy supports flash drive encryption. One big disadvantage is that flash drives can be infected much faster, easier, and with less indication than even a writable DVD. With a Puppy DVD, the latest session or sessions can be voided, to get back to an earlier state, but there is no analogous concept in Puppy flash. "added the Java Runtime as some banks now use Java Applets during login." Loading Java is pretty scary, since Java has its own security issues. Although JavaScript is needed for most modern browsing, that is different (and should be under NoScript control anyway). Java is a very different story, and may have the potential to compromise the machine without first requiring malware to succeed under Linux, which is very, very scary. That is adding a new attack vector. Obviously, if Java really is needed for use there would be little choice, but otherwise it seems like Java should be avoided if at all possible. "To update (when a new version of FireFox is avalable, for example), boot the system without connecting to the network, update from a local hard disk, make other system changes, etc, and then remaster back to the LiveUSB device." It is hard to see much advantage in downloading something for installation, rather than updating automatically online. If we cannot trust Puppy online, we sure cannot trust Windows for download. And if we can trust Puppy, there would seem to be no advantage. Nor is updating an unusual event: Updates are required not only for major Firefox steps, but also for the add-ons like NoScript, Safe, Perspectives and all the others. It is easy for Firefox to get the updates. Having to explicitly download and apply each update is significant temptation to avoid the whole process. Perhaps the issue here is the "new 'remastering' process," which is unnecessary with incremental DVD updates (saves). If the tradeoff makes updates harder, that is a high price to pay, but it is not clear why that must be so. Optimizing Puppy for security is a really good idea. Unfortunately, while everyone likes "security," there can be a wide range of opinions on the best way to achieve it. But even discussing the problems and tradeoffs may be useful. There may not be just one security version. For some reason Puppy Linux was intended to be practical without a hard drive, which just happens to be a huge security advantage. Apparently Puppy has never been developed for security use, so there is room for security improvement. It is great to have somebody around who can do some of that. But changes also can bring unexpected consequences.

“The primary issues being that Puppy Linux LiveCD/DVDs and LiveUSBs want to save the session state upon shutdown, and there is full access to connected devices.”

But those do not sound like “primary issues” to me, and here is why:

It is not really true that Puppy “want[s] to save” when ending a session, it just asks if the user wants to save. The security-oriented user should just say “No.” In practice, I only update my DVD every week or two, and then only by using the “save” button on the desktop. My current DVD is about 1/4 full after about 4 months of updates.

It is true that Puppy can “access…connected devices,” in particular, that would be the hard drive. The users coming from Microsoft Windows can read and write from and to their Windows drive. So when people work in Puppy, they can save their work for later use in Windows, which is good, not bad.

Yes, it is possible that some rare malware could run in Puppy (!) and then access the hard drive, but that is not infection. Puppy boots from the DVD (or USB), not the hard drive.

Yes, the mythical malware might damage hard drive data, but that is not preventable. Malware can provide its own device support. Not supporting hard drive access in the OS does not solve the problem.

If we really want to prevent damage to data on the hard drive (or exposure!), we need to pull out the drive. My laptop now runs without a hard drive, and that works out surprisingly well; much better, in fact, than one would expect. My desktop now has an internal SATA drive caddy so the drive can be removed or replaced in seconds (when the power is off).

“However, the concept of a LiveUSB for secure banking is compelling,”

The idea of taking a secure browsing system to arbitrary hardware is compelling, but Puppy has some issues. In particular, the video card setup does not recur on every boot, which, in my experience, means that booting on a different machine can be an unreadable mess. By knowing which selection invokes video setup the system can be recovered, but the process is very disturbing and inconvenient. That should be changed.

It would be nice if Puppy supported both removal and re-insertion of a flash drive. Puppy will update a flash drive as it stands, as long as the drive remains connected. I have been looking at leveraging the write-protect switch on SD flash cards by using a USB card reader. I found one reader which is so narrow that the write-protect switch is partly exposed, and that might be a solution.

One big advantage of a flash drive install is, at least potentially, a much faster boot. Also, Puppy supports flash drive encryption. One big disadvantage is that flash drives can be infected much faster, easier, and with less indication than even a writable DVD. With a Puppy DVD, the latest session or sessions can be voided, to get back to an earlier state, but there is no analogous concept in Puppy flash.

“added the Java Runtime as some banks now use Java Applets during login.”

Loading Java is pretty scary, since Java has its own security issues. Although JavaScript is needed for most modern browsing, that is different (and should be under NoScript control anyway). Java is a very different story, and may have the potential to compromise the machine without first requiring malware to succeed under Linux, which is very, very scary. That is adding a new attack vector. Obviously, if Java really is needed for use there would be little choice, but otherwise it seems like Java should be avoided if at all possible.

“To update (when a new version of FireFox is avalable, for example), boot the system without connecting to the network, update from a local hard disk, make other system changes, etc, and then remaster back to the LiveUSB device.”

It is hard to see much advantage in downloading something for installation, rather than updating automatically online. If we cannot trust Puppy online, we sure cannot trust Windows for download. And if we can trust Puppy, there would seem to be no advantage.

Nor is updating an unusual event: Updates are required not only for major Firefox steps, but also for the add-ons like NoScript, Safe, Perspectives and all the others. It is easy for Firefox to get the updates. Having to explicitly download and apply each update is significant temptation to avoid the whole process.

Perhaps the issue here is the “new ‘remastering’ process,” which is unnecessary with incremental DVD updates (saves). If the tradeoff makes updates harder, that is a high price to pay, but it is not clear why that must be so.

Optimizing Puppy for security is a really good idea. Unfortunately, while everyone likes “security,” there can be a wide range of opinions on the best way to achieve it. But even discussing the problems and tradeoffs may be useful. There may not be just one security version.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: c.cobb http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4540 c.cobb Sun, 28 Mar 2010 04:49:55 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4540 Brian, thank you so much for this series. While reading another of your articles a couple of months ago, I noticed a few responders mentioning Puppy Linux and started looking at that. While the concept is brilliant there are, as JCitizen noted above, still some security holes. The primary issues being that Puppy Linux LiveCD/DVDs and LiveUSBs want to save the session state upon shutdown, and there is full access to connected devices. However, the concept of a LiveUSB for secure banking is compelling, and seems far more convenient -- carrying a tiny USB stick attached to your car key ring is the ultimate "portable PC." As such, I spent a little time creating a modified Puppy system as an attempt to find a workable USB solution. First, I disabled the "save session" option during reboot or shutdown. However, since it is still necessary to make changes to the system from time to time, I also created a new "remastering" process to update a LiveUSB, and simplified the process by eliminating all the dialogs (the original LiveCD remastering asks a lot of complex questions). On my older PC, this new process completes in about three and a half minutes. I also replaced "Seamonkey" with FireFox and added the Java Runtime as some banks now use Java Applets during login. So now, I envision two separate types of use for the system: online banking, and updating the system. To bank, connect the USB and install Puppy into memory, then disconnect the USB device from the computer. Next connect to the network and then access your accounts. To update (when a new version of FireFox is avalable, for example), boot the system without connecting to the network, update from a local hard disk, make other system changes, etc, and then remaster back to the LiveUSB device. After updating, if continuing on to a banking session, just remember to remove the USB from the computer first. There are a lot of people commenting here who obviously have a lot of experience with IT issues, and I would be interested to hear any feedback you have. A preliminary and experimental "BankPup" version of Puppy is available here: http://ccobb.net/demos/puppy/ I am also experimenting with booting Puppy on a Mac. I have been able to create a single LiveUSB stick that will boot Ubuntu Linux both on my PC and my MacBook so I know the concept works, but multi-booting Puppy remains to be seen. Thank you, Brian, thank you so much for this series. While reading another of your articles a couple of months ago, I noticed a few responders mentioning Puppy Linux and started looking at that.

While the concept is brilliant there are, as JCitizen noted above, still some security holes. The primary issues being that Puppy Linux LiveCD/DVDs and LiveUSBs want to save the session state upon shutdown, and there is full access to connected devices.

However, the concept of a LiveUSB for secure banking is compelling, and seems far more convenient — carrying a tiny USB stick attached to your car key ring is the ultimate “portable PC.”

As such, I spent a little time creating a modified Puppy system as an attempt to find a workable USB solution. First, I disabled the “save session” option during reboot or shutdown.

However, since it is still necessary to make changes to the system from time to time, I also created a new “remastering” process to update a LiveUSB, and simplified the process by eliminating all the dialogs (the original LiveCD remastering asks a lot of complex questions). On my older PC, this new process completes in about three and a half minutes.

I also replaced “Seamonkey” with FireFox and added the Java Runtime as some banks now use Java Applets during login.

So now, I envision two separate types of use for the system: online banking, and updating the system.

To bank, connect the USB and install Puppy into memory, then disconnect the USB device from the computer. Next connect to the network and then access your accounts.

To update (when a new version of FireFox is avalable, for example), boot the system without connecting to the network, update from a local hard disk, make other system changes, etc, and then remaster back to the LiveUSB device. After updating, if continuing on to a banking session, just remember to remove the USB from the computer first.

There are a lot of people commenting here who obviously have a lot of experience with IT issues, and I would be interested to hear any feedback you have. A preliminary and experimental “BankPup” version of Puppy is available here:
http://ccobb.net/demos/puppy/

I am also experimenting with booting Puppy on a Mac. I have been able to create a single LiveUSB stick that will boot Ubuntu Linux both on my PC and my MacBook so I know the concept works, but multi-booting Puppy remains to be seen.
Thank you,

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Eliézer http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4522 Eliézer Fri, 26 Mar 2010 16:49:56 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4522 Olá! òtimo Post, realmente esse problema veem se alastrando a um bom tempo e curioso saber que em um pais com tantos profissionais como nos USA tenha esse tipo de problemas, é por isso que os bancos pagam tão caro por esse recursos. Realmente aqui no Brasil é uma lacuna enorme de prejuizos, qualquer um pode se aproveitar disso! Att, Silva; Eliézer Olá! òtimo Post, realmente esse problema veem se alastrando a um bom tempo e curioso saber que em um pais com tantos profissionais como nos USA tenha esse tipo de problemas, é por isso que os bancos pagam tão caro por esse recursos. Realmente aqui no Brasil é uma lacuna enorme de prejuizos, qualquer um pode se aproveitar disso!

Att,
Silva; Eliézer

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Sari Greene http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4520 Sari Greene Fri, 26 Mar 2010 15:48:27 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4520 Like all high risk activities, secure online banking requires a partnership of defensive and offensive controls. In this case, the controls need to be instituted on both the customer and financial institution side. While banking customers must do their part (AV, firewall, patching, separate PC etc…) it is important not to create a false sense of security. Zeus and its ilk are insidious. Our nDiscovery log analysis service has identified Zeus penetration on very well secured network environments. Many financial institutions as well as NACHA – the Electronic Payments Association (http://www.nacha.org/) are taking this threat very seriously. For those institutions that aren’t, their next regulatory exam will be a wake-up call. The regulators are focusing in on ACH and Wire Transfer procedures. They are not only expecting institutions to have implemented strong (multifactor) authentication but also out-of-band verification, fraud detection, monitoring, credit line/limit reviews and customer (and internal) education. They are also being asked to be on the lookout for patterns of “money mule” activity. I work directly with a number of financial institutions. They recognize that this is not only a financial and reputational relationship issue but also one that directly impacts the strategic initiative of Internet based banking. Believe me; they are looking hard at internal controls. It is in their best interest to keep their customers information and funds secure. Sari Stern Greene http://www.sagedatasecurity.com Like all high risk activities, secure online banking requires a partnership of defensive and offensive controls. In this case, the controls need to be instituted on both the customer and financial institution side. While banking customers must do their part (AV, firewall, patching, separate PC etc…) it is important not to create a false sense of security. Zeus and its ilk are insidious. Our nDiscovery log analysis service has identified Zeus penetration on very well secured network environments.

Many financial institutions as well as NACHA – the Electronic Payments Association (http://www.nacha.org/) are taking this threat very seriously. For those institutions that aren’t, their next regulatory exam will be a wake-up call. The regulators are focusing in on ACH and Wire Transfer procedures. They are not only expecting institutions to have implemented strong (multifactor) authentication but also out-of-band verification, fraud detection, monitoring, credit line/limit reviews and customer (and internal) education. They are also being asked to be on the lookout for patterns of “money mule” activity.

I work directly with a number of financial institutions. They recognize that this is not only a financial and reputational relationship issue but also one that directly impacts the strategic initiative of Internet based banking. Believe me; they are looking hard at internal controls. It is in their best interest to keep their customers information and funds secure.

Sari Stern Greene
http://www.sagedatasecurity.com

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Terry Ritter http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4348 Terry Ritter Mon, 22 Mar 2010 17:58:52 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4348 "these attacks go well beyond the typical attacks that could be dealt with reliably by your traditional tools. The biggest defense you have against these types of attacks are smart users; if you lack that, well…" While better computer education cannot hurt, it also cannot be the solution: All humans make mistakes, even computer experts. But even a single human mistake can be enough to infect a Microsoft Windows hard drive forever (or at least until Windows is re-installed). And there are no tools which guarantee to detect that infection. “these attacks go well beyond the typical attacks that could be dealt with reliably by your traditional tools. The biggest defense you have against these types of attacks are smart users; if you lack that, well…”

While better computer education cannot hurt, it also cannot be the solution:

All humans make mistakes, even computer experts. But even a single human mistake can be enough to infect a Microsoft Windows hard drive forever (or at least until Windows is re-installed). And there are no tools which guarantee to detect that infection.

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: BrianKrebs http://krebsonsecurity.com/2010/03/ebanking-victim-take-a-number/comment-page-1/#comment-4344 BrianKrebs Mon, 22 Mar 2010 13:23:49 +0000 http://www.krebsonsecurity.com/?p=1522#comment-4344 @prairie_sailor & george. most of the the systems being infected are using the latest patch levels of Windows XP. generally speaking, the people I am speaking to either don't know those technical details, or they don't care to disclose them. but in any case, it doesn't matter. the attackers in every case used the ZeuS Trojan, which involves social engineering -- tricking the recipient of a Zeus-laden e-mail into downloading and running an attached file. There have been one or two examples of ZeuS being distributed through software exploits, but those are the exception, and far from the rule. The major Anti-virus programs out there do a horrible job of detecting ZeuS, across the board, even when they are up to date. I don't want to overmythologize ZeuS, which has already been pretty badly hyped, IMHO, but these attacks go well beyond the typical attacks that could be dealt with reliably by your traditional tools. The biggest defense you have against these types of attacks are smart users; if you lack that, well... @prairie_sailor & george. most of the the systems being infected are using the latest patch levels of Windows XP.

generally speaking, the people I am speaking to either don’t know those technical details, or they don’t care to disclose them. but in any case, it doesn’t matter. the attackers in every case used the ZeuS Trojan, which involves social engineering — tricking the recipient of a Zeus-laden e-mail into downloading and running an attached file. There have been one or two examples of ZeuS being distributed through software exploits, but those are the exception, and far from the rule.

The major Anti-virus programs out there do a horrible job of detecting ZeuS, across the board, even when they are up to date.

I don’t want to overmythologize ZeuS, which has already been pretty badly hyped, IMHO, but these attacks go well beyond the typical attacks that could be dealt with reliably by your traditional tools. The biggest defense you have against these types of attacks are smart users; if you lack that, well…

Like or Dislike: Thumb up 2 Thumb down 0
]]>