Forest Global Training Partners

Cyber Risks · Krebs on Security

Sold a Lemon in Internet Banking

Summary: Thieves used the ZeuS trojan on a Green Ford Sales controller's Windows PC to log into the Kansas car dealership's First Bank Kansas account and submit a fraudulent $63,000 payroll batch, adding nine money mules as new employees. The bank's confirmation email never reached the controller because the attackers also controlled his email account and deleted it, and First Bank Kansas recovered all but $22,000 of the stolen funds.

What you should know: An attacker with control of a customer's PC can intercept, delete, modify or re-route every communication the bank relies on to authenticate a transaction, so any authentication scheme that depends on the customer's machine being clean is trivially defeated. The dealership's post-incident fix - two confirming emails, an ACH limit held at $0 except on paydays, and email passcodes - still runs over email that can be hijacked on the customer's end.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related