Pixel Imperfect Security | TechSNAP 180

chris

8 years ago

Is there a fix to the human flaw in banking systems? We’ll debate. Plus how hackers can take over your internal network using a pixel on a webpage.

Then its a huge batch of your storage questions, the Giganews conspiracy & much, much more!

Thanks to:

Five people have been charged as part of an identity theft ring in which bank tellers used personal information about customers to withdraw a total of $850,000 from numerous accounts over the course of several years.
The tellers used customer information to create fake driver’s licenses and checks to gain access to accounts
“The victims were customers at several of banks in the region, including JPMorgan Chase and Bank of America locations in the Bronx, White Plains and Yonkers”
“The banks reimbursed the customers whose accounts were affected”
The five defendants were each charged with grand larceny, identity theft and scheme to defraud. Four of the five have already been arrested, while the fifth is from Florida and is currently being sought by the New York State Attorney’s office
The three women involved in the scheme worked as tellers at a TD Bank in Apollo Beach, Fla., a Bank of America in White Plains, a JPMorgan Chase in White Plains, and a Wachovia (now Wells Fargo), in Newburgh, N.Y.”
How do you maintain security when it is the people who are supposed to enforce that security that are stealing the information?

In an attack we practically predicted on a previous TechSNAP…
The website of Politica Estadao (one of the biggest newspapers in Brazil) was compromised
The pages had a series of iframes injected, which basically carried out a simple brute-force attack against the admin credentials of common routers
“Five domains and nine DNS servers were found in this attack hosting bank phishing sites“
“The payload was trying the user admin, root, gvt and a few other usernames, all using the router default passwords,”
“Hackers are well aware of the shortcomings of home and small business routers, most of which are woefully shy of appropriate patching levels, and are likely protected only by a default or weak password“
“At the DEF CON conference last month, the SOHOpelessly Broken contest enumerated the security issues around SOHO routers. Fifteen zero-day vulnerabilities were disclosed and demonstrated during the contest, leading to seven full router compromises and another attack that could have led to corruption of the internal network.“
Watch your browser disclose your local network configuration
Additional Coverage: Sucuri
Additional Coverage: SecureList
Previous Coverage: TechSNAP 86
Previous Coverage: TechSNAP 106