Pakistanis angry over detentions in Times Sq. case Monday, May 24, 2010
ISLAMABAD – Relatives of three men detained by Pakistan for alleged links to the suspect in the attempted Times Square bombing say the men are innocent.
They
AFP - Thursday, August 6TAIPEI (AFP) - - Taiwan's Beijing-friendly government on Wednesday denied boycotting an Australian film festival amid a row over the e
BERLIN (Reuters) - Chancellor Angela Merkel suffered a double blow on Thursday as a senior party ally in east German
Minister seeks closure of anti-Berlusconi websites Wednesday, December 16, 2009
ROME (AFP) - – The Italian government moved Tuesday to close down Internet sites encouraging further violence against Prime Minister Silvio Berlusconi, who
By ELAINE KURTENBACH,AP Business Writer AP - Wednesday, March 18SHANGHAI - Asia's stock market rally seemed to be running out of steam Wednesday, despite an
Edition:
U.S.
Africa
Arabic
Argentina
Brazil
Canada
China
France
Germany
India
Italy
Japan
Latin America
Mexico
Russia
Spain
United Kingdom
Home
Business
Business Home
Economy
Technology
Media
Small Business
Legal
Deals
Earnings
Social Pulse
Business Video
The Freeland File
Markets
Markets Home
U.S. Markets
European Markets
Asian Markets
Global Market Data
Indices
M&A
Stocks
Bonds
Currencies
Commodities
Futures
Funds
peHUB
World
World Home
U.S.
Brazil
China
Euro Zone
Japan
Mexico
Russia
India Insight
World Video
Reuters Investigates
Decoder
Politics
Politics Home
Election 2012
Campaign Polling
Tales from the Trail
Political Punchlines
Supreme Court
Politics Video
Tech
Technology Home
MediaFile
Science
Tech Video
Tech Tonic
Social Pulse
Opinion
Opinion Home
Chrystia Freeland
John Lloyd
Felix Salmon
Jack Shafer
David Rohde
Bernd Debusmann
Nader Mousavizadeh
Lucy P. Marcus
David Cay Johnston
Bethany McLean
Edward Hadas
Hugo Dixon
Ian Bremmer
Lawrence Summers
Susan Glasser
The Great Debate
Steven Brill
Jack & Suzy Welch
Frederick Kempe
Christopher Papagianis
Breakingviews
Equities
Credit
Private Equity
M&A
Macro & Markets
Politics
Breakingviews Video
Money
Money Home
Tax Break
Lipper Awards 2012
Global Investing
MuniLand
Unstructured Finance
Linda Stern
Mark Miller
John Wasik
James Saft
Analyst Research
Alerts
Watchlist
Portfolio
Stock Screener
Fund Screener
Personal Finance Video
Money Clip
Investing 201
Life
Health
Sports
Arts
Faithworld
Business Traveler
Entertainment
Oddly Enough
Lifestyle Video
Pictures
Pictures Home
Reuters Photographers
Full Focus
Video
Reuters TV
Reuters News
Article
Comments (0)
Follow Reuters
Facebook
Twitter
RSS
YouTube
Read
Greek pro-bailout parties seek new coalition
|
3:21am EDT
U.S. deserter in Sweden steps forward after 28 years
17 Jun 2012
Egypt Islamists claim presidency
|
2:41am EDT
Euro, shares jump on relief over Greek vote
3:30am EDT
Ozzy Osbourne son diagnosed with multiple sclerosis: report
17 Jun 2012
Discussed
155
Most say Bush to blame for weak U.S. economy, poll finds
116
Joy and anger as Obama relaxes deportation rules
110
China could impound European planes in carbon row
Watched
Protest over G20 priorities
1:01am EDT
Kate mucks in with childrens charity in countryside.
Sun, Jun 17 2012
Saudi royals mourn the death of Crown Prince
Sun, Jun 17 2012
Exclusive: Online bank-theft software grows more sophisticated
Tweet
Share this
Email
Print
Related News
LinkedIn works with FBI on password theft
Thu, Jun 7 2012
LinkedIn suffers data breach
Wed, Jun 6 2012
Analysis & Opinion
Investors fussing too much over Greek election
Modest U.S. growth prospects riddled with risks: bank economists
Related Topics
Tech »
By Joseph Menn
SAN FRANCISCO |
Mon Jun 18, 2012 4:18am EDT
SAN FRANCISCO (Reuters) - Two of the most pervasive and dangerous types of software for stealing money from bank accounts have been improved and can now transfer money out automatically, without a hacker's supervision, researchers said.
The latest variants of the widespread SpyEye and Zeus programs have already stolen as much as 13,000 euros ($16,487) at a time from a single account and are in the early stages of deployment, according to investigators at Trend Micro Inc, a Japan-based security company that has many banks as customers.
Trend Micro Vice President Tom Kellerman told Reuters that his company's researchers had seen the new attacks on a dozen financial institutions in Germany, the United Kingdom and Italy. That is troubling because European banks generally have greater technology defenses than those in the United States, and Kellerman said it is "inevitable" that the variants will cross the Atlantic.
The new code has the potential to dramatically escalate the amount being stolen from accounts and a years-old arms race between the banks and criminal groups that are often based in Eastern Europe.
"This has tremendous implications," especially as Americans move toward banking by phone, said Kellerman. "This attack toolkit ushers in a new era of bank heists."
Like other security companies, Trend Micro profits by selling software and services to institutions and consumers worried about online spying and account takeovers.
Though written and controlled by different groups, SpyEye and Zeus share the ability to be installed on computers that visit malicious websites or legitimate pages that have been compromised by hackers. Both programs are sold in the burgeoning underground hacking economy, where they can be customized or improved with additional modules like those just discovered.
The programs already have used a technique called "web injection" to generate new entry fields when victims log on to any number of banks or other sensitive websites. Instead of seeing a bank ask for an account number and password, for example, a victimized user sees requests for both of those and an ATM card number. Everything typed in then gets whisked off to the hacker, who later signs in and transfers money to an accomplice's account.
Those transfers can be time-consuming, and the hacker has to think about how much can be sent out at once without drawing attention. Multiple, smaller transfers are preferable but take more time.
For the past year or more, some variants have also captured one-time passwords sent from the banks by text messages to client cell phones as an added security measure. But in those cases, a hacker had to be online within 30 or 60 seconds in order to use the one-time password.
The new software allows the criminal to siphon money out while he sleeps. It could significantly increase the number of hacked accounts and the speed with which they are drained.
Brett Stone-Gross, a senior security researcher with Dell Inc unit Dell SecureWorks, said thieves "will be able to extract more money" with automation.
But he also said the landscape might not be transformed by the development, because the main limiting factor for crime groups is the number of accomplices, known as money mules, that they can hire to accept transfers from victim accounts. Automation will not lessen the need for mules, Stone-Gross said.
BASED IN EASTERN EUROPE
Trend Micro spoke online with sellers of the automated transfer modules who were based in Russia, Ukraine and Romania, where arrests and prosecutions are rare. Kellerman said the new software costs between $300 and $4,000 on top of the basic thieving tools, with customized jobs costing still more.
So far, the company has seen it run only on top of Microsoft Corp's Windows operating system, which is by far the most common for personal computers.
Banks generally make individuals whole for such losses if they are detected quickly. But recent versions of SpyEye and Zeus can present fake account balances to individual bank customers, so they might not realize their savings are being drained until too late.
Kellerman recommended that banks move more toward "out-of-band" authentication, such as direct phone calls to confirm online transfers.
In the United States, financial regulators last June also called for such checks and urged banks to explore newer technologies to combat Internet fraudsters.
(Reporting by Joseph Menn in San Francisco; Editing by Gary Hill)
Tech
Related Quotes and News
Company
Price
Related News
Tweet this
Link this
Share this
Digg this
Email
Reprints
We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
Comments (0)
Be the first to comment on reuters.com.
Add yours using the box above.
Edition:
U.S.
Africa
Arabic
Argentina
Brazil
Canada
China
France
Germany
India
Italy
Japan
Latin America
Mexico
Russia
Spain
United Kingdom
Back to top
Reuters.com
Business
Markets
World
Politics
Technology
Opinion
Money
Pictures
Videos
Site Index
Legal
Bankruptcy Law
California Legal
New York Legal
Securities Law
Support & Contact
Support
Corrections
Connect with Reuters
Twitter
Facebook
LinkedIn
RSS
Podcast
Newsletters
Mobile
About
Privacy Policy
Terms of Use
AdChoices
Copyright
Our Flagship financial information platform incorporating Reuters Insider
An ultra-low latency infrastructure for electronic trading and data distribution
A connected approach to governance, risk and compliance
Our next generation legal research platform
Our global tax workstation
Thomsonreuters.com
About Thomson Reuters
Investor Relations
Careers
Contact Us
Thomson Reuters is the world's largest international multimedia news agency, providing investing news, world news, business news, technology news, headline news, small business news, news alerts, personal finance, stock market, and mutual funds information available on Reuters.com, video, mobile, and interactive television platforms. Thomson Reuters journalists are subject to an Editorial Handbook which requires fair presentation and disclosure of relevant interests.
NYSE and AMEX quotes delayed by at least 20 minutes. Nasdaq delayed by at least 15 minutes. For a complete list of exchanges and delays, please click here.