In-Session Phishing Attack

A new way of stealing internet banking passwords has been discovered. Here’s how a victim would see it:

How can this happen?

I won’t go into the technical explanation, suffice it to say that most browsers will trust and run code under certain conditions, and hackers have discovered how to exploit those conditions.

It works because it knows what banks to look for and won’t do anything until you log into your internet banking. So to a casual person it sounds plausible that they need your password again.

What can be done to prevent this?

  • Use a good antivirus package that scans web pages. This isn’t 100% reliable but it’s will protect you from most malicious sites.
  • A more extreme measure is to walk into your bank’s branch and use their computers to do internet banking. This is ok, it’s just very inconvenient.
  • This is also a good time to remind you not to do internet banking from public computers, such as an internet cafe, a public library, etc. You need to trust the computer you’re working on.

    • The makers of web browsers (Microsoft, Mozilla, Google, etc) need to address this issue. When they do it’s up to you to update your browser to the latest version. Then this particular problem will go away.

    Below is a press release from a banking security company offering more information on this type of attack.

    http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf

    19 January, 2009 | Filed Under General, Phishing 

    Comments

    Leave a Reply