ENISA: banks should assume customer PCs are infected

 

Gallery

By Stewart Mitchell

Posted on 6 Jul 2012 at 15:09

The European cyber security agency has warned banks to stop assuming that customers' computers are free from malware and consider offline checks before making large transactions.

The warning from the European Network and Information Security Agency comes in the wake of a series of multimillion pound heists on wealthy bank account holders.

“Banks really should change their stance and assume that all of the customer computers are infected, otherwise it’s difficult to be secure,” a spokesperson for ENISA told PC Pro. “With that in mind, you need to secure the devices and also have a cross check, because they can’t just assume customer computers are clean... The banks should take protection measures to deal with this.”

While banks do use stringent security measures, many of the systems can be circumvented if users' computers are infected with common malware packages, ENISA said.

Many online banking systems, some with one-time transaction codes, calculators or smartcard readers, work based on the assumption that the customer’s PC is not infected

“Many online banking systems, some with one-time transaction codes, calculators or smartcard readers, work based on the assumption that the customer’s PC is not infected,” ENISA said. “Given the current state of PC security, this assumption is dangerous.”

According the ENISA, instead of relying on web security alone when processing large transactions, banks should also use channels that cannot be interfered with by malware on their customers’ PCs.

“It is important to cross check with the user the value and destination of certain transactions, via a trusted channel, on a trusted device via an SMS or a telephone call,” ENISA said. “Even smartphones could be used here, provided smartphone security holds up.”

High-roller attacks

The warning follows a series of attacks – dubbed “high-roller heists” because the targets all had large account balances – that recently extracted million £48 million from bank accounts. The theft used a technique that circumvented the regular chip and pin authentication processes.

After using phishing attacks to identify wealthy, often corporate, accounts, malware - including SpyEye, Zeus and Ice 9 - was loaded onto the victim’s PC.

Later, the account details were used to transfer funds to mule accounts – all without the user’s knowledge and using a method that rendered the second-level authentication devices impotent.

“The banks’ protection measures, such as two-factor authentication and fraud detection, were circumvented,” ENISA said. “Users did not notice this right away because the fraudulent transactions were hidden by malware that was inserting Javascript code into pages.”