Showing posts with label Banking. Show all posts
Showing posts with label Banking. Show all posts

Friday, 2 March 2018

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

23,000 HTTPS certificates axed after CEO emails private keys

A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates. Read more…

Equifax Discloses 2.4 Million More Mega-Breach Victims

Equifax says it identified 2.4 million U.S. consumers whose names and snippets of their driver's license numbers were stolen, adding to what is one of the largest and most sensitive data breaches on record. Read more…

Big banks want to weaken the internet’s underlying security protocol

The tech and financial industries are butting heads over the latter’s push to intentionally weaken a security protocol that underlies how the public securely accesses the vast majority of the internet. Critics are charging that the financial industry is pushing for a weakness in the new version of the Transport Layer Security (TLS) protocol, all for the sake of avoiding the time, effort and resources needed to adapt to the new standard. Read more…

Another massive DDoS internet blackout could be coming your way

A massive internet blackout similar to the Dyn DNS outage in 2016 could easily happen again, despite relatively low-cost countermeasures, according to a new study. The DDoS attack on Dyn took many major web sites offline for most of a day, including Twitter, PayPal, Reddit, Amazon, and Netflix. Millions of compromised IoT devices, belonging to the Mirai botnet, flooded Dyn's DNS service with up to 1.2 TBps of bogus traffic, making it impossible to respond to genuine DNS requests for their customers' websites. Read more…



Friday, 25 August 2017

Weekly NewsRoundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Cryptocurrency cyber crime has skyrocketed alongside the popularity of ICOs

Almost 10% of all the money invested in initial coin offerings (ICOs) this year using cryptocurrency Ethereum has fallen into the hands of thieves. Read more…

Barclays enables voice payments with Siri

Barclays says it’s the first UK high street bank that lets mobile banking customers make a payment by asking Siri. The payment, which relies on TouchID for authentication, can be completed without opening the Barclays mobile banking app. Read more…

Ransomworms on the rise: yet another wake up call for the enterprise

90 percent of enterprises still recording exploits for vulnerabilities that are more than three years old, and 60 percent for vulnerabilities more than ten years old says Fortinet report, with twice as many attacks at weekends. Read more…

Popular Robots are Dangerously Easy to Hack, Cybersecurity Firm Says

Some of the most popular industrial and consumer robots are dangerously easy to hack and could be turned into bugging devices or weapons. Read more…

Friday, 11 August 2017

Weekly News Roundup



Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Oracle Offers API to Link Banks to Fintechs
Oracle Corp. is offering a payments application programming interface based on the ISO 20022 standard that will allow banks to more easily collaborate with fintechs and other third parties. Read more…

UK data protection laws to be overhauled

Britons could obtain more control over what happens to personal information under proposals outlined by the government. Citizens will be able to ask for personal data, or information posted when they were children, to be deleted. Read more…

HBO Data Dumped, Hackers Demand Millions

Attackers who reportedly stole 1.5TB of data from HBO release a second data dump and demand millions in ransom. Hackers behind the recent HBO data breach have dumped a second collection of stolen files and demanded millions in ransom. Read more…

UK calls for smart car cyber protection

A new generation of internet-connected cars will have to be better protected from cyber attackers, under tough new UK government guidance. Read more…


Friday, 28 July 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Wells Fargo said to get regulatory questions after breach

Wells Fargo, already in the regulatory spotlight because of last year’s fake-accounts scandal, is drawing renewed scrutiny after a lawyer’s unauthorized release of sensitive client details for tens of thousands of accounts belonging to wealthy customers of its brokerage unit. Read more…

Feds Indict Russian Over BTC-e Bitcoin Exchange

Police in Greece on Tuesday arrested Alexander Vinnik, 38, for allegedly running a massive money laundering operation that processed $4 billion in bitcoins, many of which may be tied to the largest bitcoin exchange heist in history. Read more…


Hack on Italy's largest bank affects 400,000 customers


Data about loan accounts belonging to 400,000 customers of Italy's largest bank has been put at risk by two security breaches. Unicredit said that personal data and account numbers could have been stolen. Read more…

GSM -based credit card skimmers hit New York gas stations

GSM-based credit card skimmers capable of sending credit card data via text messages were found at three New York gas stations. While the technology itself isn't new, this is the first time the SMS-enabled skimmers have been found inside gas pumps. Read more…



Friday, 21 July 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

Hackers steal $32 million in Ether cryptocurrency hack

Hackers have stolen $32 million worth of Ether, a popular and increasingly valuable cryptocurrency, by exploiting a critical security vulnerability in wallet software that allowed an attacker to steal over 153,000 Ether. Read more…

South Carolina hit with 150,000 Election Day hacking attempts
More information about the scale of attempted election hacks has been released and it involves a rather surprising target -- South Carolina. The state's voter-registration system was hit with nearly 150,000 hack attempts. Read more…

Global cyberattack could spur $53 billion in losses: Lloyd's of London

A major, global cyberattack could trigger an average of $53 billion of economic losses, a figure on par with a catastrophic natural disaster such as U.S. Superstorm Sandy in 2012, Lloyd's of London said in a report on Monday. Read more…

US Banks Targeted with Trickbot Trojan

Necurs botnet spreads Trickbot malware to US financial institutions, while new Emotet banking Trojan attacks discovered - signaling increasingly complex attacks on the industry. Read more…



Friday, 26 May 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

“Yahoobleed” flaw leaked private e-mail attachments and credentials

For years, Yahoo Mail has exposed a wealth of private user data because it failed to update widely used image-processing software that contained critical vulnerabilities. That's according to a security researcher who warned that other popular services are also likely to be leaking sensitive subscriber secrets. Read more…

27 arrested for black box ATM attacks across Europe

Europol said in a statement last week that 27 people have been arrested for their connection to a string of successful black box attacks against ATMs across Europe. Since 2016, these attacks have resulted in more than €0.45 million in losses. Read more…

Target Reaches Breach Settlement: $18.5 Million Fine, Security Controls

Target to cough up $18.5 million to 47 states in a settlement following its 2013 security breach, which exposed data of millions of customers. Read more… 

How the Trump Budget Would Fund Cybersecurity

The Donald Trump administration, in its proposed fiscal year 2018 budget, outlines steps it contends would strengthen the U.S. federal government's information systems, even as it would cut some cybersecurity spending at specific agencies. Read more…


 

Friday, 12 May 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. Banking Trojan tests new attack techniques against high-profile targets

One of the world's most widespread forms of banking malware has taken on a more advanced form attack to dupe victims of some of most high-profile banks in the world into giving financial details and login credentials. Read more…


2. New IoT malware targets 100,000 IP cameras via known flaw

Over 100,000 internet-connected cameras may be falling prey to a new IoT malware that’s spreading through recently disclosed vulnerabilities in the products. Read more…

3. Emergency Microsoft patch fixes 'crazy bad' Windows malware scanner bug

Microsoft has released an update for the malware scanning engine bundled with most of its Windows security products to fix a highly critical vulnerability that could allow attackers to hack computers. Read more…

4. Trump signs cybersecurity executive order

Today, after 3 months on the table, President Donald Trump today signed a Cybersecurity Executive Order, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, meant to bring efficiency, clarity and additional protections to government IT systems. Read more…


Friday, 5 May 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. Google Docs users hit with phishing scam

This week a Google Docs phishing scam affected about 1 million users. Users who clicked a link and followed instructions risked giving hackers access to their email accounts. Read more…

2. IBM warns of malware on USB drives shipped to customers

IBM has urged customers to destroy USB drives which shipped with some of its Storewize storage systems because they may contain malware. Read more…

3. Bank Account Hackers Used SS7 to Intercept Security Codes

Hackers have exploited the Signaling System #7 international telecommunications signaling protocol as part of a two-stage attack designed to drain money from online bank accounts. Read more…

4. Snake malware is a sophisticated serpent aiming to poison Macs

News has emerged of yet another piece of malware targeting Apple’s computers, and this one is a heavyweight offender in terms of being a sophisticated piece of malicious software. Read more...


Friday, 28 April 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. Russian hackers 'target' presidential candidate Macron

Russian hackers are targeting the campaign of French presidential candidate Emmanuel Macron, security experts say. Read more…

2. U.S. regulators to review decision denying Bitcoin ETF: filing

The U.S. Securities and Exchange Commission plans to review its decision last month to block the listing of the first U.S. exchange-traded fund tracking the digital currency bitcoin, a regulatory filing showed. Read more…

3. Denial-of-service, web app attacks plague banks

Cybercriminals who hack banks are mainly taking aim at their web servers and websites according to a new report. Read more…

4. Malware shuts down Virginia State Police email

The Virginia State Police network Wednesday was hit with a malware attack which shut down the department's email services. Read more…

5. FalseGuide malware victim count jumps to 2 million

An estimated 2 million Android users have now fallen victim to malware mistakenly downloaded from Google Play, which was initially reported to have affected approximately 600,000 users. Read more…

Friday, 7 April 2017

Weekly News Roundup


Too busy working all week to keep up with the most interesting stories coming out of the technology and security industries? Below are our recommendations for a roundup of the top stories happening now that you need to know.

1. Scottrade Bank data breach exposes 20,000 customer records

Scottrade Bank recently secured a MSSQL database containing sensitive information on at least 20,000 customers that was inadvertently left exposed to the public. Read more…

2. China-Based Threat Actor APT10 Ramps Up Cyber Espionage Activity

An unknown number of managed service providers and their customers are victims of a massive, global cyber espionage campaign by a China-based threat actor that this week was also fingered in another attack against a U.S. group involved in lobbying around foreign trade policy. Read more…

3. Finicity first to ink data exchange deal with Wells Fargo

Wells Fargo and data aggregation provider Finicity have signed a deal that provides an API-based method for sharing Wells Fargo customer information with the financial apps and services that Finicity supports. Read more…

4. Google Discovery Shows Fragility of Mobile Phone Security

Flaws in a microchip used widely in Apple and Android mobile devices could be used to remotely hack a device over Wi-Fi. Read more…


Friday, 31 March 2017

Money’s Digital Makeover: BOHH Labs’ CEO Offers Insight on SAP Radio Show




Recently, BOHH Labs CEO, Simon Bain, participated on the radio show Coffee Break with Game-Changers, presented by SAP, addressing money’s digital makeover, what that means and discussing blockchain (aka Distributed Ledger Technology) that is becoming an increasingly popular security method.

Simon jumpstarted the conversation with the following quote to set the stage:

“Grown-ups never understand anything by themselves, and it is tiresome for children to be always and forever explaining things to them.” (Antoine de Saint-Exupéry, Le Petit Prince)

He went on to discuss with the other participants how he believes the cashless society still has a long way to go before full adoption and his views on the shortcomings of blockchain. 
He believes people are looking at blockchain as the only method, and we aren’t really looking at the core issues.

What do you think?

To listen to the radio segment, visit https://www.voiceamerica.com/episode/98156/moneys-digital-makeover-part-1

Tuesday, 21 March 2017

Celebrated Technology Leaders Come Together To Tackle Devasting Data Loss In Banking


Secure Banking Platform from BOHH Labs Presents First-of-its-Kind Cyber Security Solution

OAKLAND, Calif., March 21, 2017  -- Three eminent technology leaders have joined forces to launch BOHH Labs, with the goal of turning the tide against the skyrocketing costs of banking security breaches. Simon Bain, Damion Hänkejh and Ken Hawkins bring a combined 75 years of security technology experience, four patents with six pending, international corporate pedigrees spanning Hewlett Packard Labs, Amazon, Oracle, and deep experience in online banking and money transfer technology.

The World Economic Forum estimates that the global cost of cybercrime could reach a staggering $6 trillion by 2021, and banking and financial organizations are prime targets. As ransomware, credit card fraud, phishing, keylogging and malware-based attacks continue to gain traction, the banking industry is at ever increasing risk from costly hacks that grow more intricate and difficult to prevent each day, as well as continued pressure to provide more secure, faster, and convenient services to customers.

"The current cybersecurity landscape has serious ramifications for the banking industry, and today's transaction infrastructures require a new approach to defeat the increasingly sophisticated daily attacks that threaten banks' infrastructure, brand and bottom line," said Simon Bain, Founder and CEO, BOHH Labs. "Our goal is to provide the most secure real-time messaging platform for FinTech, and transform banking security to become more dynamic within the existing system, redefining how FinTech organizations securely transport account data without compromising performance, speed or customer accessibility."

The BOHH Labs senior leadership team has a distinctive track record bringing together innovators and growing and leading billion dollar companies to exits in the cyber security, FinTech and Internet sectors. Key accomplishments include:

  • Simon Bain, Founder, Chief Executive Officer, Director – Simon has been a recognized leader in the IT industry for more than 20 years, and is best known for developing innovative security and search applications. Simon has worked with Abbey National (Santander) on its online banking platform, as well as other banks including Co-operative where he helped them with the SWIFT banking schema. He is also called upon by leading companies and governments to devise secure yet user-friendly solutions to high stakes initiatives, such as the first online voting application to be granted security clearance for use on interactive digital TV in the UK. Bain holds four patents with six pending on search and security.
  • Damion Hänkejh, Founder, Chief Strategy Officer, Director – Damion began his career as the first teenager in the Hewlett Packard R&D lab, serving as the company's youngest systems analyst. His work has earned him a series of accolades, from being the Smithsonian Laureate awarded CTO at Virtual OR to CTO of Majestyk Apps, the 2014 IBM Watson Mobile Developer Challenge Award winner. Damion invented Internet customer service before IBM coined the term "eCommerce" as the founder of InstantService.com, the first and largest carrier-class telecom platform for live customer service (acquired by Oracle in a $1 billion roll-up, and now Oracle Live Help).
  • Ken Hawkins, Chief Technology Officer – Ken brings a deep history of Internet entrepreneurialism and experience. He served as CTO of Payz, director of technology of Broadjam.com, as well as holding several leadership positions at Amazon, where he tied in AOL's shopping experience with Amazon.com's processes and delivery systems. Ken also served as the chief architect of InstantService, the first interactive customer service portal on the Internet, which subsequently became Oracle's Live Agent.

To see the original post of this announcement, click here.

Thursday, 26 January 2017

Banking Trojans – What Are They & How Can you Stay Protected?



Meghan O’Leary, CMO of BOHH Labs
With more people relying on the Internet, computers and phones for their banking activities, this makes their accounts more vulnerable to security risks and cybercriminals have noticed. One specific tool hackers use for banking attacks are called Banking Trojans.
Banking Trojans are a type of malware used by hackers to attempt to steal confidential information about users using online banking and payment systems. What this type of Trojan does is it redirects the traffic from a bank’s website to another a website that the hacker has access to. This works because the Trojan typically looks like a normal piece of software, but it has a backdoor for hackers, so once it is installed, the hacker can get access to the computer’s system and files. Basically, once a hacker has backdoor access, they have remote control of your computer and can send, steal, receive, delete and so on files from your computer.
Once the hacker infects the computer system with a Banking Trojan, it is all a matter of the waiting game. When a user takes part in an online baking activity, the software starts creating folders and editing registry entries each time the computer system is started. The Trojan also searches for specific cookie files that are related to financial websites that have been stored on the computer and can get information like login credentials and other access to the user’s information.
There are many ways a hacker will use a Banker Trojan to steal your information. Some of the most common methods include:
  • Phishing (stealing information by impersonating a legitimate bank)
  • Logging keystrokes to send captured data to remote servers
  • Man-in-the-Middle attacks
  • Stealing information from a clipboard
  • Intercepting passwords
  • Bypassing two-factor authentication
  • Changing DNS settings to redirect users to malicious versions of legitimate banking sites
Now that you have a better understanding of what a Banking Trojan is and what it can do, there are some measures you can take as users to help ensure your information stays protected. Below are a few best practices tips to follow when online banking to help minimize your chances of become a victim to a Banker Trojan.
  • Read and be familiar with your bank and credit card policies. If you receive a suspicious online notification, verify with your bank or credit card company before taking action.
  • Don’t save personal information, bank account numbers and passwords on your phone or computers.
  • Check for encryption on bank websites. Look for a small lock icon somewhere on your browser, and URLs that begin with “https:” This means the site is secured and your data is encrypted.
  • Make sure your security software is up-to-date, regardless of if you are using a computer or mobile device.
  • Change your passwords and PIN number frequently.
  • Be careful of what you post on social media. This may sound silly, but by posting personal information about yourself on your social tools can give criminals easy access to find more information about you and use it to their advantage.
  • Monitor your accounts. Regularly check in on your accounts to ensure all transactions are your own. If you find fraudulent or suspicious activity, immediately report it to your bank and they will put a hold on your card/take measures to secure your account and typically will cover your loss.

Thursday, 22 December 2016

Practicing Safe Banking: How to Keep Your Money Better Protected



There’s no denying that today people interact with money in a much different way than even just 10 years ago. Credit cards, mobile phones and the Internet have become the primary tools people use to manage and monitor their finances. Customers have tasted what it’s like to have anywhere, anytime access and the simplicity of checking their account balances, depositing money, paying bills and so on with the click of a button. While this new era of mobile banking brings convenience for customers, it also opens up their accounts to security risks, fraud and personal information.
With customers embracing mobile banking, they may be unknowingly revealing — via the Internet — all their account information, personal information and easy access to all of their financial assets in an unprotected and insecure way when they use their own devices or Internet to handle their money.
Below are several tips people should think about when they are using the Internet or mobile devices to manage their finances.
  1. Don’t save personal information, bank account numbers and passwords on your phone or computers. Never click “remember me” when logging into your accounts, regardless of if you’re on a computer website, your phone’s web browser or even your banking app on your phone. By doing so, gives the site or application a cookie that is easily open to misappropriation.
  2. Think about where you are banking from. For example, by using public Wi-Fi, it’s rather simple for someone to intercept your data in a man-in-the-middle attack. When accessing your bank account online, it is advisable to use your own Wi-Fi network that is setup with password protection. If you can’t do your banking at home, you can still check your account on the go, just make sure your device is using cellular data instead of Wi-Fi.
  3. Be conscious of mobile apps you download. It is important to read the privacy policies and understand what type of personal information an app can access before you click download.
  4. Check for encryption on bank websites. Look for a small lock icon somewhere on your browser, and URLs that begin with “https:” This means the site is secured and your data is encrypted.
  5. Don’t respond to emails that claim to be from your bank (or any other company) requesting your account details. No bank is ever likely to approach you this way to ask for personal information
  6. Make sure your security software is up-to-date, regardless of what if you are using a computer or mobile device. These updates come our for a reason, so they can help reduce the number of security holes in your systems.
  7. Use strong passwords for all your accounts. Create passwords that can’t be easily guessed by a human or computer. This typically means a password with 8 or more characters, including letters, numbers and symbols. It is also advisable to use different user IDs and passwords for your financial accounts and for any other sites you use online.
  8. Never use any of your Social Security number (or any other sensitive info, like a credit card number) as a password, user ID or personal identification number. This is one of the first things a hacker will try to use to get into your account if they somehow get access to this information.
  9. Change your passwords and PIN number frequently. Though this may seem like overkill, changing your login details every couple of months helps you ensure your information stays better protected from hacks and makes you more of a moving target to get.
  10. Be careful of what you post on social media. This may sound silly, but by posting personal information about yourself on your social tools can give criminals easy access to find more information about you and use it to their advantage.
  11. Be aware when using ATM’s (yes, these still are a thing!) Scammers often target an ATM and place a card reader over the card slot so they can copy your card details. This isn’t as easy with chip cards, but they also can have a camera on the machine to access the details required to skim your card. Always check the slot to make sure it has not been tampered with.
  12. Monitor your accounts. Regularly check in on your accounts to ensure all transactions are your own. If you find fraudulent or suspicious activity, immediately report it to your bank and they will put a hold on your card/take measures to secure your account and typically will cover your loss.
  13. To take it one step further, set up notification alerts. Many banks offer text or email notifications to alert customers to certain activities on their account.
  14. Sign out when you finish with online banking. This may sound easy, but you should always log out of your online banking session rather than let it expire. This will help reduce the chances of your session being hacked. Most banks will log you out automatically after you are idle for a couple of minutes, but logging out is still a good habit to get in to.

Monday, 17 October 2016

How the Banks are Underwriting the Cloud


OK, so let’s start out by saying that I am neither a bank apologist nor someone who believes that banks do not have a lot to answer for.
Now that is said, let me move on.
When was the last time you had to have a replacement Credit or Debit card because your current one was compromised? Maybe the new one just appeared in the post? Or maybe you had noticed a few dollars that you could not account for on your statement? Whichever it was, any loss sustained was not paid for by you! No, your financial institution took that charge.
Chances are, they were also not at fault for the loss; It could have been the online store that you had been using or maybe your card details were stolen during a shopping trip on High Street. Or maybe you were using a free Wi-Fi service and went on to your favorite shopping site. During that visit, your computer could very easily have been compromised by that very helpful guy or gal sitting behind you…
Whatever the reason, it is unlikely that the banks were actually to blame. It is more likely that they are the true victims. We as the customer are inconvenienced, but that is all. The banks are out of pocket by 2 or 3 dollars, as well as the costs of the replacement card. Not a lot really, until you multiply that by the number of cards they replace each year. You then get to a very large number. So why are they doing it? My answer is going to have to be a guess as I have asked the question on a number of occasions but I have never received a real answer. This is understandable as the banks do not want to publicize how much online fraud really costs, especially as we all jump to the conclusion that it is they, not us, at fault. So here is my guess; Cloud banking and online purchasing is a growing business with billions of dollars of transactions taking place each year. The banks need this business as at the end of the day it streamlines how they work and cuts costs. But this is currently coming at an even larger expense, the reimbursement of fraudulent transactions. I believe the banks are betting on these being reduced over time and the cost savings then coming in to play.
If we really want a Cloud banking infrastructure and to be able to purchase on-line securely with little or no worries about having our transactions interrupted, then we need to help the bank! Yes, I know it is not a natural thing to want to do. But think about the consequences. The figures I have been speaking of are huge. At some point the banks will have to start to recharge them, so I am actually asking us all to help ourselves. Here are a few things we can do to make life a little safer:
Public Wi-Fi: If you do use the Wi-Fi in your local coffee shop, DO NOT use it to make purchases, input passwords or do anything private, unless you have installed and turned on a Virtual Private Network (VPN) which encrypts all data.
Connecting: When you connect to a public Wi-Fi, make sure that you know it is a real one. For example, if you see an Open Connection named “Freds Open Wi-Fi” or “My Favorite Coffee House Free Wi-Fi” or Even “Connect to Me Now!” Do not connect to it. It is more than likely not a safe one to use.
Only ever connect to your bank from your own home, office or mobile network connection. This does not guarantee security but makes it far more likely.
Passwords: Finally, be very careful with your passwords. They are important to you. In a lot of cases, they are your life. Do not give them out, keep them secure and make sure that every web site that you use understands the importance of security and is not just paying lip service to the word. If you do hear that a web site has had your (Remember it is your) password stolen, make sure that you change it straight away and go to all of your other accounts with the same password and change that too. Then go back to the site and demand an apology and recompense. That maybe the only way that some of these site will actually learn that our data is not just important, it is OURS!