Malware gang steal over £700K from one British bank

Which bank?

I think this is pertinent information.

surely that IS the point.

Most people working will have £800 in their account at least one day in a month.

Then that presents a far greater target to hit. If you increase the amount to something actually representing "substantial", say £20k+ then you limit your attack base.

simple (if immoral) economics.

Any bank

I saw this in the wild last month. The AV and anti-spyware on my client's PC failed to spot the Trojan. (I had to delete by hand using an Unbuntu boot disk)

On my client's PC, when they accessed their bank account, the virus was sitting as a proxy on the PC swapping the pages that would appear on the screen. The initial bank "front page" looked normal, and asked for the account number.

Then the second page which normally asks for "second, fourth and eighth" characters of the password was swapped for a VERY convincing looking fake page which asked for ALL of the password to be entered.

I am glad I scare by clients into paranoia as this client spotted the change of procedure at that stage. Even though the quality branded AV and anti-spyware programs could not spot it.

Most people will just assume that the Bank has changed its login system and carry on regardless. So this does not surprise me that it has landed so much cash for the scammers.

(Though I do wonder why the bank did not spot the patterns of cash transfers earlier?)

I am not naming the bank as there is no point. This is a scam that is probably running on many banks at the same time as it is such a clean looking con.

Credability

"the cyber criminals have successfully stolen £675,000 ($1,077,000)" and how exactly would the amount be known by anyone other then the criminals?

Does the bank is question know it is being scammed and not care? Perhaps it thinks it is cheaper to ignore then acknowledge? Either way, I am sure they wouldn't publish the figure.

Or does this 'security consultancy' have the means to monitor the exact amounts being transfered? So why didn't they stop them? Perhaps they were waiting for it to pass the Million Dollar mark to make it interesting 'news', or perhaps they are touting this around to sell their services. "Pay us X amount and we will tell you if you are the victim of this scam." Now there is an idea I could sell on Dragon's Den.

M86

"Researchers at the M86's Security Labs came across the attack after discovering the botnet's command & control centre" - so the bank didnt detect it themselves??

I've seen quite a bit of this

I've seen this several times over the past week - the major AV suites all seem to miss the infection (although the Microsoft MSRT catches it). The giveaway symptom is that you cannot get to Windows Updates. Running Wireshark on the cable shows that neither IE nor Firefox even do a DNS lookup. I haven't tried other browsers, but I expect them to be the same.

The other thing that Wireshark shows is the retrieval of target URLs from a machine in Eastern Europe. The PC then goes on to do the biggind of its bot master. Mostly click fraud, but passwords are also being stolen, and all search traffic seems to be echoed to a snooping server.

One of my customers uses online banking. I told him he had this infection, and that he should change all his passwords as a matter of urgency. He phoned the bank, just as I said he should. They replied that he could change his credentials himself on another computer. Nice to see the banks taking security so seriously - I mean, what harm can compromised credentials do?

Vic.