Language Selection

English French German Italian Portuguese Spanish

FDIC advises banks on how to protect against spyware

Filed under
Security

The Federal Deposit Insurance Corp. (FDIC) today issued a list of best practices for financial services firms that details how to protect against spyware, which the agency said can be used by criminals to collect customer data or hack into banking systems.

"It is critical that banks stay vigilant about the risks involved with this malicious software and take appropriate action so that they and their customers do not fall victim to it," said Michael Zamorski, director of the FDIC's Division of Supervision and Consumer Protection.

The guidance spells out the risks associated with spyware and recommends actions that financial institutions can take to mitigate those risks on internal computers as well as on those used by customers to connect to transactional banking Web sites.

The FDIC recommends rolling out multifactor authentication to limit the ability of identity thieves to access customer accounts. Firms should also consider spyware as part of their risk-assessment analysis and bolster security against it by setting Internet-use policies for employees. The FDIC also recommends that banks advise customers on the risks of using public computers such as those in hotels, libraries or Internet cafes to connect to online banking Web sites because of the uncertainty of what spyware may have been installed on the public equipment.

According to the FDIC, the risks associated with spyware include allowing attackers to eavesdrop and intercept sensitive communications, such as customer IDs and passwords; allowing unauthorized access to user accounts; permitting unauthorized access to bank systems; and increasing vulnerability to other Internet-based attacks, such as phishing.

By Lucas Mearian
ComputerWorld.

More in Tux Machines

Remembering Linux Installfests

Ah, yes. I remember the good old days when you had to be a real man or woman to install Linux, and the first time you tried you ended up saying something like “Help!” or maybe “Mommmmyyyyy!” Really, kids, that’s how it was. Stacks of floppies that took about 7,000 hours to download over your 16 baud connection. Times sure have changed, haven’t they? I remember Caldera advertising that their distribution autodetected 1,500 different monitors. I wrote an article titled “Monitor Number 1501,” because it didn’t detect my monitor. And sound. Getting sound going in Linux took mighty feats of systemic administsationish strength. Mere mortals could not do it. And that’s why we had installfests: so mighty Linux he-men and she-women could come down from the top of Slackware Mountain or the Red Hat Volcano and share their godlike wisdom with us. We gladly packed up our computers and took them to the installfest location (often at a college, since many Linux-skilled people were collegians) and walked away with Linuxized computers. Praise be! Read more

What New Is Going To Be In Ubuntu 17.04 'Zesty Zapus'

Right on the heels of Ubuntu 16.10 'Yakkety Yak' is Ubuntu 17.04 Zesty Zapus. Ubuntu 17.04 is currently scheduled for release on April 13, 2017 but know that this is only an estimate. One thing to know is that all things being equal, it is going to be released in April 2017. Ubuntu Zesty Zapus will be supported for only 9 months until January 2018 as it is not a LTS (long term support) release. Read
more

Security News

  • News in brief: DirtyCOW patched for Android; naked lack of security; South Korea hacked
  • Millions exposed to malvertising that hid attack code in banner pixels
    Researchers from antivirus provider Eset said "Stegano," as they've dubbed the campaign, dates back to 2014. Beginning in early October, its unusually stealthy operators scored a major coup by getting the ads displayed on a variety of unnamed reputable news sites, each with millions of daily visitors. Borrowing from the word steganography—the practice of concealing secret messages inside a larger document that dates back to at least 440 BC—Stegano hides parts of its malicious code in parameters controlling the transparency of pixels used to display banner ads. While the attack code alters the tone or color of the images, the changes are almost invisible to the untrained eye.
  • Backdoor accounts found in 80 Sony IP security camera models
    Many network security cameras made by Sony could be taken over by hackers and infected with botnet malware if their firmware is not updated to the latest version. Researchers from SEC Consult have found two backdoor accounts that exist in 80 models of professional Sony security cameras, mainly used by companies and government agencies given their high price. One set of hard-coded credentials is in the Web interface and allows a remote attacker to send requests that would enable the Telnet service on the camera, the SEC Consult researchers said in an advisory Tuesday.
  • I'm giving up on PGP
    After years of wrestling GnuPG with varying levels of enthusiasm, I came to the conclusion that it's just not worth it, and I'm giving up. At least on the concept of long term PGP keys. This is not about the gpg tool itself, or about tools at all. Many already wrote about that. It's about the long term PGP key model—be it secured by Web of Trust, fingerprints or Trust on First Use—and how it failed me.

OpenSUSE Ends Support For Binary AMD Graphics Driver

Bruno Friedmann has announced the end to AMD proprietary driver fglrx support in openSUSE while also announcing they don't plan to support the hybrid proprietary AMDGPU-PRO stack either. Friedmann wrote, "Say goodbye fglrx!, repeat after me, goodbye fglrx... [In regards to the newer AMDGPU-PRO stack] I will certainly not help proprietary crap, if I don’t have a solid base to work with, and a bit of help from their side. I wish good luck to those who want to try those drivers, I’ve got a look inside, and got a blame face." Read more