Secure websites used to steal bank and credit card information

print this

Criminals are using increasingly sophisticated means in their attempts to steal bank and credit card information by using vulnerabilities on reliable websites, warns the software company Symantec.
      Unplugged gaps mean that an Internet user can think that he or she is on a secure online service, when in reality, the web page is tailored for stealing personal information and identity.
      Symantec found nearly 12,000 cases in the second half of 2007 in which a page of a web service was open to alteration for purposes of deceiving individual users. The number of cases grew by 60 per cent in a six-month period. Only four per cent of the problems were fixed.
      Vulnerabilities were found in a number of web services, ranging from banks, the Finnish Parliament, and the police.
      While most of the hacking was done by pranksters, Symantec says that they give a good chance for online fraud.
      "It used to be that criminals would try to reach as great a number of people as possible, so that at least someone might fall for the fraud. Now the swindles are targeted at a limited number of people whose confidence is won over through a familiar web service or community page", says Symantec technology director Marko Haarala.
     
Symantec's Internet Security Threat report, which is published twice a year, is based on information gathered from more than 180 countries. In addition to investigating security gaps, the company sells online security software.
      According to Marko Haarala, Finns were kept relatively safe from old-fashioned "phishing" scams by a language barrier; it is not very cost-effective for fraudsters to use a language that is spoken by relatively few people, and Finns' suspicions are easily aroused by an approach in English.
      In exploiting the new vulnerabilities, criminals can keep the content of the original page and even use a URL that looks reliable.
      Haarala says that online crime has become increasingly professional.
      He also notes that two thirds of all known malware codes were written in 2007.
      Haarala says that in the United States, 50 billion dollars in losses were caused by data theft in the past five years. The bill is paid largely by banks and credit companies.
     
The Finnish Communications Regulatory Authority (FICORA) has reported on dozens of vulnerabilities on Finnish web pages.
      The head of the FICORA CERT-FI unit, Erka Koivunen, notes that the vulnerabilities are harmless for the company involved, but allow for the swindling of a user in an exceptional manner.
      "It is problematic, whether or not the responsibility falls on the victim of the scam, or on the owners of the website, who should fix the gaps that are insignificant from the company's point of view", Koivunen says.
      He notes that Finland has only been targeted by scattered attempts at stealing data. For instance, customers of Nordea Bank have been asked for information in 2005 and 2006. In February significant amounts of money were taken from customers' accounts with the help of malware (see link), but more extensive money transfers were averted.
      There have also been reports of individual cases of data theft.
      "We have been waiting for a time when there might be thousands of swindles using new weapons. We will be ready here when that happens", Koivunen says.


Previously in HS International Edition:
  Nordea Bank customers hit by malware incident (27.2.2008)

Helsingin Sanomat