https://threatpost.com/attackers-backdoor-another-software-update-mechanism/127452/
BTW, the title is a direct quote from a guy I knew that wrote bank software for international bank-to-bank transactions. That was 15 years ago but, imo, the hackers have progressed more than software security during that time.
NetSarang does software for banks & financial institutions.
Nothing electronic has access to my bank accounts, no: ATM, no debit card, no automatic payments, not even an account linked to PayPal anymore.
I did set up that newfangled Apple Pay, but I've never used it. I keep forgetting how.
This one was just found in the Chrome extensions
QuoteThe malware, in this case, was a data gathering one, designed to allow further exploitation of the victims. After securing form login information from the user, the malware transfers that data to a server controlled by the attackers, who can then use it to profile their victim. They then use that information to go after those who have financial control over the company they work for.
In targeted attacks, they call them up and use a combination of social engineering and phishing to have them give the attacker further access to financial information, which can result in banking theft.
....avoided detection by the 58 most common anti-viral applications
https://www.digitaltrends.com/web/chrome-extension-malware-reposted/
And another article. Must be the season for them, I haven't tuned my reader to pick them up.
QuoteBanking trojans were eventually spotted showing fake overlays on top of Android Pay and other mobile payment apps, but also apps used for booking flights and hotel rooms.
Now, researchers at Kaspersky Lab have found an Android trojan that collects payment card data from taxi & ride-hailing apps.
This move makes perfect sense, as most ride-hailing apps won't even let users sign up if they don't enter payment card details. This means that users are conditioned to handing over payment card data.
https://www.bleepingcomputer.com/news/security/banking-trojans-set-their-sights-on-taxi-and-ride-hailing-apps/
[Related]
My tech-inclined kids wonder why I still send paper checks.
http://www.rawstory.com/2017/09/records-of-four-million-time-warner-cable-customers-left-unsecured-gizmodo/
TWC is my ISP.
UK: Bank branch closures
703 set to shut this year. 461 branches closed in 2015, while 583 shut last year. The latest cull brings the total to 1,747 in three years.
The news comes after a British Bankers' Association (BBA) report in July found almost 20 million people now bank on their mobile phone.
http://www.which.co.uk/news/2017/09/mapped-the-703-banks-closing-this-year/
- 97% of the apps tested lacked the proper code protection, opening themselves up to reverse engineering or decompiling. ...
- 90% of the financial institution (FI) apps shared services with other programs on the device. ...
- 83% insecurely stored data. ...
- 80% of the FI apps used weak encryption algorithms or incorrectly implemented strong ciphers. ...
- 70% of the apps used insecure random number generators to limit access to sensitive information. ...
How financial institutions are risking customer data through insecure mobile apps - TechRepublic
https://www.techrepublic.com/article/how-financial-institutions-are-risking-customer-data-through-insecure-mobile-apps/
I use CC for anything I can. It's easy to track everything. Those that won't take it get a paper check, and that includes those who charge extra for CC payments.
I trust none of these guys and never have.
> Don't bank online
Whaaat?! Sure you should and all and everything else you do financially. I gotta pay them bills and keep the family fed. LOL.
> - 97% of the apps tested lacked the proper code protection, opening themselves up to reverse engineering or decompiling. ...
If you only knew how many people and devs we have working across teams to address this.. and we're only the 20th largest financial corp here.
>I trust none of these guys and never have.
Hehehe, we need a 1-1 conversation next month bud. How can you not trust a face like mine? ;)
Oh I trust you buddy, but I have my own devs too so I know what the fuck is up. hhh
It's the damn Ukrainians I don't trust. Sumbitches are smarter than banks.