Swedish Bank loses $1 Million through Russian hacker phishing attack

by Alex Zaharov-Reutt

Sunday, 21 January 2007

Russian hackers have used phishing techniques to get hundreds of customers of Sweden’s largest bank to divulge their username and password without realizing it, resulting in losses over well over $1 Million dollars.

Sweden’s largest bank, called Nordea Bank, has been under phishing attack since 2005, with the first successful attack taking place in August 2006. Detected only a month later, the attacks have continued, resulting in a massive loss through phishing fraud, perpetrated by Russian hackers routing their attacks through servers in the US.

250 customers have been affected so far, with at least 121 more customer accounts under investigation. The hackers used a phishing email that advised bank customers to download an anti-spam tool that loaded the ‘haxdoor.ki’ Trojan.

The malware waited until customers tried to log into the online banking service of Nordea, displaying an error message asking the customer to re-enter their data. Once this was done by compliant customers, the crucially sensitive login details were sent to the Russian hackers servers for later use in stealing funds.

Police in Sweden have already arrested over 100 middlemen in Sweden, who it would seem
were working with the Russian hacker criminals.

The bank has advised that affected customers have been compensated.

According to an article at The Register, “phishing attacks continue to escalate both in numbers and sophistication according to Internet monitor Netcraft, with at least 609,000 confirmed phishing sites last year”.

Their article continues that “Several attacks saw phishers hack into bank web servers and use them in attacks. In March, a Chinese bank's web server hosted phishing sites targeting US banks. The phishing pages were placed in hidden directories on The China Construction Bank (CCB) Shanghai Branch. This attack was the first recorded instance where a bank's infrastructure was used to attack another institution”.

Interestingly, The Register also says that “a July attack on Citibank demonstrated a technique that was even able to defeat two-factor authentication tactics. The second authentication factor used by Citibank is provided by a security token which generates a one-time password that remains valid for approximately one minute”.

Does this mean that two-factor authentication is effectively useless? It would appear so, if the hackers can so easily get past it, and are so easily able to escale their attack methods, especially as none of these security solutions bring the end user's computer into the bank's security chain. Brian Krebs at The Washington Post, in his Security Blog, talks about yet another threat – the ‘Man-in-the-Middle’ attacks which also show how poor the current security systems in use by banks really are.

Bruce Schneier has also written a very interesting article on 'The Failure of Two Factor Authentication'. Just the start of his article says that: "Two-factor authentication isn't our savior. It won't defend against phishing. It's not going to prevent identity theft. It's not going to secure online accounts from fraudulent transactions. It solves the security problems we had ten years ago, not the security problems we have today".

Ted Egan, CEO and Co-Founder of anti-phishing software TrustDefender, a freely downloadable software program for consumers that eliminates the threat posed by any kind of phishing attack, said that:”All the multi factor solutions, one time passwords, two-factor authentication, virtual keyboards and more being deployed by banks, financial institutions and even the eBay/Paypal companies are short term stop guards, very expensive and only give consumers a false sense of security until they get attacked....and the end user remains outside the security chain”.

Egan continued: “As we have been saying for some time now, the only way these financial organizations are going to stop the fraudsters and start protecting customer identities and confidential information is when banks and other organizations integrate the end users computer (pc and mobile computing device) into the overall security chain”.

Egan upped the ante to the online community relying on outdated security systems by saying that: “Company directors and CSIO's, CIO's and CTO's are investing in the short-term stop guards and so the vicious circle plays into the hands of online criminals due to a sheep mentality approach of using two-factor authentication and other security systems which are well proven to be easily hackable, putting customer data, funds, identities and more at risk when TrustDefender’s Enterprise solution solves these problems once and for all by integrating the end users computer into the overall security chain of the financial or other institution.”
{moscomment}

Please enable JavaScript in your browser to post your comment!