Golden rule: If someone calls saying they’re from your bank, just hang up and call them back — ideally using a phone number that came from the bank’s Web site or from the back of your payment card. Here is how a tech industry pro (having worked in security for several years at a fairly major cloud-based service) fell for a banking scam

https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/

Malware evolution - New (sLoad) downloaders can perform reconnaissance and then determine what malware to install

 The new SLoad Banking Trojan downloader gathers information about the infected system, including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. It will also take screenshots of the target machine.


Current targets are banks in Canada, the UK and Italy (this can expand)

https://threatpost.com/sload-banking-trojan-downloader-displays-sophisticated-recon-and-targeting/138542/

"Dark Tequila" - Advanced Keylogger that as been targeting customers of several Mexican banking institutions since at least 2013 and was discovered recently

Dark Tequila has primarily been designed to steal victims’ financial information from a long list of online banking sites, as well as login credentials to popular websites, ranging from code versioning repositories to public file storage accounts and domain registrars

The list of targeted sites includes "Cpanels, Plesk, online flight reservation systems, Microsoft Office 365, IBM Lotus Notes clients, Zimbra email, Bitbucket, Amazon, GoDaddy, Register, Namecheap, Dropbox, Softlayer, Rackspace, and other services,"

Once executed, a multi-stage payload infects the victim's computer only after certain conditions are met, which includes checking if the infected computer has any antivirus or security suite installed or is running in an analysis environment.

Besides this, "the threat actor behind it strictly monitors and controls all operations. If there is a casual infection, which is not in Mexico or is not of interest, the malware is uninstalled remotely from the victim’s machine," the researchers say.


https://thehackernews.com/2018/08/mexico-banking-malware.html

Bank Of America, HSBC or TunnelBear customers may want to take a look at this

Researchers from the UK have uncovered a serious vulnerability in the way nine banking and VPN apps handle encrypted communication that puts tens of millions of users at risk of man-in-the-middle (MitM) attacks

"Our tests find that apps from some of the world's largest banks contain the flaw, which if exploited, could enable an attacker to decrypt, view and modify traffic - including log-in credentials - from the users of the app," write Chris Mcmahon Stone, Tom Chothia, and Flavio Garcia of University of Birmingham

For More:
https://www.darkreading.com/mobile/man-in-the-middle-flaw-in-major-banking-vpn-apps-exposes-millions/d/d-id/1330586?_mc

Terdot trojan - once infected you may end up with TearDrop(s)

It can target social media networks  including Facebook, Twitter, Google Plus, and YouTube, and email  service providers including Google's Gmail, Microsoft's live.com, and  Yahoo Mail.

It can also bypass restrictions imposed by TLS (Transport Layer Security) by generating its own Certificate Authority (CA) and generating certificates for every domain the victim visits


For More:
https://thehackernews.com/2017/11/facebook-twitter-hack.html

Watch out for this banking Malware - ICEDID

The malware listens for the target URL from the list (of financial institutions) and, once it encounters a trigger, executes a designated webinjection. The webinjection sends the victim to a fake bank site set up in advance to match the one originally requested,” researchers wrote.

It performs a smart trick:
To thwart detection by the end user, the malware redirects traffic at the same time keeping the bank’s correct URL in the address bar. That live connection also means the bank’s correct SSL certificate always shows

For More
https://threatpost.com/new-icedid-trojan-targets-us-banks/128851/

Bank Heist - Reminds me of the song Smooth Criminal(s)

Interesting part is  that this Targeted attack includes good coordination at physical and technical levels.

Hussey says his company investigated heists at five different banks in post-Soviet countries. Attackers made off with sums between $3 million and $10 million per bank, for a total of over $40 million



For More:
https://www.bleepingcomputer.com/news/security/bank-cyber-thieves-get-clever-with-new-overdraft-technique/

Banking Apps - Good news & Bad News (actually its Bad News)

Good news -

1. 11 million banking app logins a day during 2015.
2. American Federal Reserve stats show that 71% of people using mobile banking services are confident about the security of mobile banking transactions.

Bad news - Pradeo Labs study: 
50 top banks from 22 countries

•  7 breaches per app
• 100% failure 
• 50 million risky users

Check here for more info:
http://www.itsecurityguru.org/2017/02/24/security-specialist-identifies-security-breaches-apps-50-top-global-banks/

How would you feel if someone stole your money and you don't even know it

 I am pretty sure "ignores is bliss" may not work in this scenario



According the article:
Attackers have begun sending spam emails with poisoned attachments to customers at 14 different Japanese banks, according to Limor Kessem, a cybersecurity evangelist with IBM


(here is the interesting part)
After making off with a victim’s money, in some instances, URLZone hides the transaction line with HTML injections, making it appear like no money was taken.

For More Info:
https://threatpost.com/urlzone-back-targeting-banks-in-japan/116107/

Carbanak backdoor - Sound like something you want to install at home. Nah, it is a financial APT (meaning bad Malware)

Now, it has an upgrade.
The silver lining is it targets banks rather than end users.
Let's hope that the Banks have sensible (not expensive) security.


From the article:

The attacks begin with spearphishing emails that have rigged attachments containing the Carbanak backdoor. Once on a compromised machine, Carbanak gives attackers remote control of the machine and the criminals used that as a foothold on the bank’s network and then stole money in several different ways.

researchers at CSIS in Denmark say they’ve seen new variants of Carbanak that have some unique characteristics. The folder in which Carbanak installs itself and the filename it uses are both static. The malware injects itself into the svchost.exe process as a way to hide itself.

“As several other advanced data stealing threats, Carbanak utilizes plugins. The plugins are installed using Carbanak’s own protocol


Carbanak is what we define as a financial APT. In its nature, it is very targeted and it is being deployed in small numbers. In this way, it tends to slide under the radar .

For more info
https://threatpost.com/new-versions-of-carbanak-banking-malware-seen-hitting-targets-in-u-s-and-europe/114522

Believe it or NOT - Some ATMs are still running Windows XP

You would expect banks to be careful because they deal with money.

Apparently it is not true.

And also some of them had USB ports and CD ROM enabled

From the article:

Jacco Van Tuijl, who conducts penetration testing (sanctioned hacking into systems to determine their vulnerability to attacks) for banks in the Netherlands, pointed out that many ATMs still use the now-obsolete, 13-year-old Windows XP operating system

"The ATM is basically a computer. We have conducted penetration tests and were able to access USB ports inside of ATMs by cutting through the metal.

Police said the suspects hacked the machines by inserting a disc into the ATMs' CD-ROMs that would then infect the machines with a virus or malware.

For more details follow the link below:

http://www.thestar.com.my/News/Nation/2014/10/24/ATM-hack-must-update-systems/

Banks Hacked- News gets more and more interesting

Apparently it is 7 banks now

Some had their records deleted




The link below has more information:-


http://www.cnet.com/news/jpmorgan-hackers-altered-deleted-bank-records-says-report/

Multi-faceted hack attack against Swiss banks

looks like we have more and more creative people getting involved with hacking.

Or, is it being crowdsourced got better results.

From the Article

That tactic was accomplished by Malware that manipulated a victims' DNS settings and installed an SSL certificate for the phishing sites before wiping itself clean to remove evidence of infection.

Users who fell for the email campaign and subsequently installed the malware would be prompted to install an Android app to purportedly secure their banking transactions, but which would serve to steal second factor SMS tokens and furry it off to an attackers' command and control server or mobile phone number.

Follow this link for additional details:

http://www.theregister.co.uk/2014/07/23/ruskie_vxers_change_dns_nuke_malware_in_swiss_bank_raids/

Zeus malware variant - Uses vaild digital signature (claims Comodo)

According to the article:- 

What is alarming about this is that the file is digitally signed with a valid certificate, making it appear trustworthy at first glance. The digital certificate is issued to “isonet ag”.

There  are three components to an attack launched by Zeus:

1. The Downloader: Delivered to the user system by an exploit or an attachment in a phishing email. It will download the rootkit and malware component of the attack.
2. The Malware: In this case it is a data stealer, the program that will steal valuable user data, login credentials, credit card info, etc. that the user keys into a web form.
3. A Rootkit: A rootkit hides the installed malware component, protecting it from detection and removal.

The link below has more information:-

https://blogs.comodo.com/e-commerce/comodo-av-labs-id-zeus-trojan/

New kid in the block - SANDROID - Android Botnet

Targets Android smartphone users who bank at financial institutions in the Middle East.

Infected more than 2,700 phones, and has intercepted at least 28,000 text messages.


According to the article:- 

bundled with Android apps made to look like mobile two-factor authentication modules for various banks, including Riyad Bank, SAAB (formerly the Saudi British Bank), AlAhliOnline (National Commercial Bank), Al Rajhi Bank, and Arab National Bank.



The link below has more information:-
http://krebsonsecurity.com/2014/04/android-botnet-targets-middle-east-banks/

Send a text message to an ATM - Then collect Cash (from someone else's account)

 I am not sure how easy it will be to connect a Cell phone to a ATM. However, this attack has been successful.

According to the article:- 

A new technique that has been discovered is the use of mobile technology to control an ATM remotely. The threat, Backdoor.Ploutus, was originally discovered in Mexico but is now available in the English language, suggesting that the new variation -- Backdoor.Ploutus.B -- is expanding to other countries.

By simply sending a text message to the compromised system, hackers can control the ATM, walk up to it, and collect dispensed cash

BUT -  First. the attacker must connect the ATM to a mobile phone via USB tethering.

While modern ATMs often have enhanced security, including encrypted hard drives, models running on Windows XP are not protected well against these types of attacks. In addition, while money is usually locked away inside a safe, the computer system often is not -- leaving the access point to cash vulnerable.

The links below has more information:

http://www.zdnet.com/hackers-text-atms-for-cash-via-windows-xp-flaws-7000027672/#ftag=RSS4d2198e

Some of the UK's biggest banks race to update Windows XP ATMs. - Did they lose all their IT budget during 2008 Market Crash?

At least they are lucky as Microsoft had already extended the deadline for its point of sale operating system XP Embedded - found in many ATMs and cash register units - until 2016.

According to the article:- 

She added that the majority of these upgrades would take place during 2014 and 2015. "During this migration period, ATM operators will mitigate any additional risk through the use of third-party security software and/or by purchasing extended Windows XP support."

The links below has more information:

http://www.v3.co.uk/v3-uk/news/2334526/banks-race-to-update-windows-xp-atms-as-support-deadline-looms