Archive for category: iovation

KOMO reports “The city of Burlington (Washington) is warning its employees to check their bank accounts after finding out funds have been stolen. They believe computer hackers got access to the city bank account, which is used as a direct deposit to pay workers. It is unknown how much money was taken, but more than $400,000 has been transferred to several accounts over the past two days.”Any time that more than $400,000 actually moves out of a city of Burlington account, there can’t possibly be a joke involved,” said town administrator Bryan Harrison. “It actually is very chilling.”

Chilling indeed. Hacks like this often take place as a result of a virus getting into a machine that has access to the bank account. In one scenario the offending machine is not properly updated with antivirus and the virus allows a criminal remote access to the device or the virus acts as a “Man In The Middle” Attack.

RSA reports in one of the most interesting cases of organized cybercrime this year, a cyber gang has recently communicated its plans to launch a Trojan attack spree on 30 American banks as part of a large-scale orchestrated crimeware campaign. Planned for this fall, the blitzkrieg-like series of Trojan attacks is set to be carried out by approximately 100 botmasters. RSA believes this is the making of the most substantial organized banking-Trojan operation seen to date.

RSA further reports American banks are the major target.  “Another attractive element for the attackers appears to be the slim deployment of two-factor authentication (2FA) for private banking consumers in the US, unlike many European banks that generally require all consumers to use 2FA for wire transfers.”

Multi-factor authentication, requires a username, password “something you know” and “something you have”—a personal security device separate from the PC. But that’s not even enough.

The Federal Financial Institutions Examination Council (FFIEC) states: “Since virtually every authentication technique can be compromised, financial institutions should not rely solely on any single control for authorizing high risk transactions, but rather institute a system of layered security, as described herein.”

Enhanced device identification is also essential. The FFIEC suggests complex device identification. While complex device identification is more sophisticated than previous techniques, take one step instead of two and incorporate device reputation management.

Robert Siciliano, personal security and identity theft expert contributor to iovation. He is the author of 99 Things You Wish You Knew Before Your Mobile was Hacked! See him knock’em dead in this identity theft prevention video. Disclosures.

The term Hacker was made popular by Steven Levy in his book “Hackers: Heroes Of The Computer The Revolution” published in 1984 was about those brilliant and eccentric nerds from the late 1950s through the early ’80s who took risks, bent the rules, and pushed the world in a radical new direction.

In the past decade there have been hundreds of data breaches resulting in millions of compromised records. The motivation behind these hacks? Identity Theft. Meanwhile dozens of new laws and government intervention to protect citizen data have emerged.

Black Hat (bad), White Hat (good) or Grey Hat (good by day bad by night), over the past decade the media has given the term “hacker” a negative connotation. Or is it hackers that gave the term a negative connotation?

Either way, whenever I’m talking bad guy hacker I’m careful to precede the word hacker with “criminal” so I don’t piss off anyone who considers themselves a good guy hacker.

Thomas Edison, Benjamin Franklin and Alexander Graham Bell were all hackers. Good ones too.

Today we are faced with a real issue of hackers attacking our financial systems, critical infrastructure and even our own PC’s. And now as we use our mobile phones for commerce hackers are going after them too.

John Haney, Sales Executive at iovation stated “With more people than ever conducting banking activities from mobile devices, being able to proactively detect risk and suspicious activity in real-time is essential to protecting financial institutions and their customers. Although mobile banking is a powerful tool, it can also be used as a weapon for cybercrime and we want financial institutions to be prepared to fight mobile fraud. This is especially poignant given the FFIEC guidelines that established expectations for companies to adopt a layered approach to prevent cyber-attacks.”

Through its ReputationManager 360 service, iovation tracks the reputations of everything from desktops to laptops, mobile phones to tablets, and gaming consoles to smart TVs. By utilizing iovation’s device reputation intelligence.

Meanwhile, as a consumer, you are directly responsible for the security of your own network and devices.

Install and update antivirus, antispyware, antiphishing and a firewall on your devices.

Update your operating systems critical security patches.

Encrypt your home/office WiFi connection

Beware of phishing, vishing and internet scams.

Robert Siciliano, personal security and identity theft expert contributor to iovation. He is the author of 99 Things You Wish You Knew Before Your Mobile was Hacked! See him knock’em dead in this identity theft prevention video. Disclosures.

Your tax dollars are being put to work in ways to secure your bank accounts and our critical infrastructure. But there’s still more work to do.

The FBI reports Early last year, hackers were discovered embedding malicious software in two million computers, opening a virtual door for criminals to rifle through users’ valuable personal and financial information. Last fall, an overseas crime ring was shut down after infecting four million computers, including half a million in the U.S. In recent months, some of the biggest companies and organizations in the U.S. have been working overtime to fend off continuous intrusion attacks aimed at their networks.

To that end, the FBI over the past year has put in place an initiative to uncover and investigate web-based intrusion attacks and develop a cadre of specially trained computer scientists able to extract hackers’ digital signatures from mountains of malicious code. Agents are cultivating cyber-oriented relationships with the technical leads at financial, business, transportation, and other critical infrastructures on their beats.

Richard McFeely, executive assistant director of the Bureau’s Criminal, Cyber, Response, and Services Branch was quoted saying “It’s important that everybody understands that if you have a computer that is outward-facing—that it’s connected to the web—that your computer is at some point going to be under attack,” he said. “You need to be aware of the threat and you need to take it seriously.”

When he says “you” he means banks, retailers, and just about everyone involved in eCommerce or anyone with a connection to the internet.

Smart businesses engaged in eCommerce are helping to stem the tide of cybercrime by incorporating device reputation into their transactions. iovation, is headquartered in Portland, Oregon, and has pioneered the use of device reputation to stop online fraud and abuse. The software-as-a service used by online businesses assesses risk of Internet transactions all over the world and recognizes if a device such as a PC, tablet or smartphone has a history of fraudulent behavior.  This helps organizations make educated decisions if they want to do business with the person using the device.

Robert Siciliano, personal security and identity theft expert contributor to iovation. He is the author of 99 Things You Wish You Knew Before Your Mobile was Hacked! See him knock’em dead in this identity theft prevention video. Disclosures.