Sign in / up

back to article ZeuS trojan attacks bank's 2-factor authentication

A variant of the ZeuS banking trojan is targeting mobile phone users who rely on their handsets to get enhanced, two-factor authentication from ING Bank Slaski in Poland, a security blogger said on Monday. The ZeuS man-in-the-mobile attacks appear to similar to those that hit Spain in September, researchers from antivirus …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. Anonymous Coward
    Headmaster

    Ever heard of Unicode?

    It's called "Śląski", not "Slaski".

    1 0
  2. Gabor Laszlo
    Boffin

    Easy:

    for all your mTAN needs, use a mobile just smart enough to receive SMS and no smarter.

    Or use NoScript so you don't get XSpwned. Oh and don't give your mobile number to crooks?

    1 0
  3. dave 46
    FAIL

    There's no such thing as fool proof

    Fools are evolving all the time.

    At some point we'll have to stop trying to secure accounts with technology and start educating the users.

    2 1
    1. Ru
      Reply Icon
      Thumb Down

      Re: User Education

      This cannot and will not ever work, and no public system should ever require this in order to be secure.

      2 0
  4. Andrew Churchill
    FAIL

    Fail for Bank & Criminal

    So they get Zeus on your PC to get the online banking number and static passwords, then con you into infecting your mobile with another Zeus variant. But why bother?

    As you're typing the OTP mTAN into the infected PC anyway, the extra step is pointless (and requires an additional risk that the element of social engineering alerts the user).

    Bank 3/10 - poor security, which fails to understand the point of out of band security

    Criminal 6/10 - potentially successful, but fail to understand they're messing up their own attack

    0 0
  5. Anonymous Coward
    Big Brother

    the solution

    > The ZeuS Mitmo injects a fraudulent field into webpages that prompts users for their cellphone number and the type of handset they use ..

    The solution being to run your Browser off a bootable CD or readonly USB device. Seriously folks, how often do I have to keep on saying this. Yes, I know all about in memory hacks, but they are a rarity and get flushed on the next reboot.

    On a related note, in the interests of security and 'compliance', the IT people here have banned the use of Linux and require the sole use of the 'compliant' Windows XP/7. At the same time the system is wide open to anyone with a wireless laptop. Thing is, I really don't understand how spying on me is going to protect me from the 'terrorists' ...

    http://www.uploadimage.co.uk/images/76814164512008090281.png

    http://en.wikipedia.org/wiki/Ubuntu_Live_USB_creator

    0 0
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      ...until next year

      ...when a ZeuS variant infects your OS such that when it creates a bootable CD or USB key, the OS contained therein is modified to already contain the ZeuS trojan.

      Basically the Stuxnet approach to getting round the physical network isolation of the PLC controllers.

      Yes, you could run a MD5 check (or some other hash) against the OS image, but how do you know your computer is telling you the right answer? We can't even go back to buying physical CDs as the pressing plant may have been compromised.

      0 0
  6. Anonymous Coward
    Thumb Down

    *sigh*

    Could I PLEASE get my paper OTP lists back now?

    0 0
This topic is closed for new posts.

Other stories you might like