Major £30m cyberheist pulled off using MOBILE malware

Re: What worries me..

Please fork over a bunch of personal information

Now please install some crap on your smartphone.

Insert two fingers in electrical socket while we rob you blind.

Thank you please.

Dunno. Judging by the tenner in my jeans it's actually easy. You just need to use bigger notes (and bigger jeans).

Re: More explanation on the Android attacks please?

Android won't install from outside the play store unless you let it so this puzzles me too.

But as with so many security stories the details are missing... so I assume it was all done using pixie dust

Re: Schools

I'm actually involved in ISECOM's Hacker Highschool project as an author, and I fully intend to take the full material into my kids' school once the v2 release is complete.

I'm very much tempted to write a new piece about privacy - people are goaded into revealing information that is simply dangerous in the wrong hands. The Belgians actually made a good (albeit slightly too long) video about this..

Re: Schools

I'm an ICT teacher for a secondary school, we cover "Online Safety" several times as a full project, in fact I taught it today, and was asked "Can mobile phones be infected with viruses, sir?", so I think the kids are okay!

Re: Schools

Why are the kids getting the blame for falling for these phishing scams? Although it's anecdotal I'd say the teenagers I know are a lot more savvy about this stuff than the 40+ year olds that I know. Looking down my list of friends on Facebook, the few teenagers that have added me all use pseudonyms, most of the adults are using their full names with D.O.B. and occasional phone numbers listed. Yes, teenagers are prone to saying bloody stupid things on the internet but then they've always said bloody stupid things. No amount of 'awareness' classes are going to make them mature any faster. As for things posted to Facebook affecting their employment possibilities, the pages of under 18's are not searchable to those over 18, regardless of what privacy settings they may or may not have enacted.

Re: I must be heartless

Internet banking is (misleadingly) touted as a utility - flick the switch, it works. The party line is that you don't need 'qualifications' to use it.

Re: Very easy...

I remember a very old apple one that deleted/corrupted your files while you played some sort of strip poker game...

Re: That's a big pile of money

That's the whole point of laundering the money - breaking the trail to make it difficult to identify where the money went.

Classic case was bouncing it between multiple dupes in different jurisdictions, so you have to slowly trace through each bank in turn. Route it through a jurisdiction that doesn't ask many questions and doesn't provide much help to law enforcement and that's half the battle won. Put an (apparently) legitimate purchase or two in the middle, and everything slows right down. It is intentionally difficult to reclaim money from vendors due to the past experience of customers reversing payments once they get the goods. The number of dodgy customers is higher than the number of dodgy vendors, so that's the way things work.

The key for the hackers is to get the money out of the conventional system as fast as possible. By the time the customer has cried Fraud, the money has disappeared. Where it pops up again, who knows. Half the time the laundering is actually done by governments for various purposes. Prime example - the UK government laundered almost a billion dollars worth of IRA funds as part of the NI peace settlement.

There was quite the bizarre set of statements in the Lords back in 2010 where curiously the media comment on it was extremely rapidly quashed.

http://www.publications.parliament.uk/pa/ld201011/ldhansrd/text/101101-0003.htm#10110215000101

Start reading from 1 Nov 2010 : Column 1538 onwards.

"Open code can be checked by anyone. "

Indeed, but there's no guarantee that anyone will actually do so. Nor is there any guarantee that the person(s) checking the code are even remotely competent to do so, let alone whether they'll tell everyone about what they find, rather than just keeping their knowledge to themselves and using it to their own nefarious ends.

Any shyster with a copy of "Programming Bullshit for Shysters" can pretend to know what they're talking about. And any sociopath can decide to keep a juicy little bug to themselves.

Open source is no better or worse than closed source when it comes to security. It never was. (And it's certainly nowhere near as good as commercial closed-source development when it comes to design and innovation. When your only means of making money is by charging for support, good UI design suffers.)