McAfee called it the ‘biggest ever’ online bank heist. The loss of seven to eight million Swedish korna, the equivalent of $1.1 million dollars US, was a shock to the bank and its customers but security researchers said it was only a matter of time.
How it happened
The attack started with one of the most popular forms of attacks on the internet. Nordea is saying that close to two hundred fifty customers were targeted with phishing emails containing a custom-made Trojan program. The Trojan would use the name of the bank and encourage customers to download anti-spam software. Users downloaded the attached file named ‘raking.zip’ or ‘raking.exe’ and were infected with the Trojan some security companies like McAfee call ‘haxdoor.ki’.
haxdoor.ki’ is a keylogger. A program that will record keystrokes, and hides itself from anti-virus applications. The Trojan activated when users went to the Nordea online banking website. Once there users were redirected, as the Trojan took over, to a fake login page where their account information was recorded and sent to an offsite location for pick-up.
Police are able to confirm that the information recorded was sent to servers located in the United States and Russia. The connection to Russia is leading police officials to think this is the work of online Russian organized crime. This would not be the first time the Swedish bank was attacked in such a fashion. In 2005, it had to stop online banking operations due to a severe phishing attack on its users.
What happens next?
A Nordea spokesperson told the BBC News, “What is important is that none of our customers will have lost their money. We are doing all we can to stop this.” Nordea has refunded the money lost to the accounts, and is working closely to police and security companies to complete the investigation as soon as possible. Over one hundred people have been arrested in connection with the heist each of them believed to have connections to the Russian criminals.
Boo Ehlin, spokesperson for the bank is reported as saying the problem was most customers affected were not using anti-virus software and were open to attack. Social Engineering is the major factor involved he said, not a fault with the banks security policy.
"It is more of an information, rather than a security problem," said Ehlin. "Codes are a very important thing. Our customers have been cheated into giving out the keys to our security, which they have in good faith."
The bank will move to improve its information for customers, and alert them to possible fraud. Policy in place at the financial firm alerted them to possible fraud because of the volume, and types of transactions. Banks often used monitoring programs that notice out of the ordinary transactions of the customers. It was this type if system that alerted them to possible problems and allowed them time to act.
Nordea is reported to service over two million online customers, and those numbers is in all actuality a testament to its current security policy. Only two hundred fifty customers were affected, and that the fraud was stopped before it got any worse shows the bank was clearly demonstrative of the people, vigilant in protecting the account holders.
Security wise, this attack shows two things. First, it shows that online frauds and attacks are growing bolder, and taking on a larger scale. A trend that is only going to get worse before it gets better. The second is the fact that the victims were poorly protected because of the lack of virus software. This factor allowed the attack to happen in the first place, and might have been less damaging if not for the end user being poorly informed of the dangers that exist on the internet. No computer on the internet these days should be without Malware, and Virus software.
http://tech.monstersandcritics.com/n...on-dollar_loss















Linear Mode
21 OCZ Fans!