Forgot your password?
typodupeerror
Security Linux

Washington Post Says Use Linux To Avoid Bank Fraud 422

Posted by kdawson
from the just-common-sense dept.
christian.einfeldt writes "Washington Post Security Fix columnist Brian Krebs recommends that banking customers consider using a Linux LiveCD, rather than Microsoft Windows, to access their on-line banking. He tells a story of two businesses that lost $100K and $447K, respectively, when thieves — armed with malware on the company controller's PC — were able to intercept one of the controller's log-in codes, and then delay the controller from logging in. Krebs notes that he is not alone in recommending the use of non-Windows machines for banking; The Financial Services Information Sharing and Analysis Center, an industry group supported by some of the world's largest banks, recently issued guidelines urging businesses to carry out all online banking activities from 'a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible.' Krebs concludes his article with a link to an earlier column in which he steps readers through the process of booting a Linux LiveCD to do their on-line banking." Police in Australia offer similar advice, according to an item sent in by reader The Mad Hatterz: "Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit told the hearing that he uses two rules to protect himself from cybercriminals when banking online. The first rule, he said, was to never click on hyperlinks to the banking site and the second was to avoid Microsoft Windows."
This discussion has been archived. No new comments can be posted.

Washington Post Says Use Linux To Avoid Bank Fraud

Comments Filter:
  • by Profane MuthaFucka (574406) <busheatskok@gmail.com> on Tuesday October 13, 2009 @10:33PM (#29740385) Homepage Journal

    A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

    • Re: (Score:3, Interesting)

      by Shakrai (717556)

      And asking me for my Mother's maiden name is really that much better? Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?

      I like the security token [wikipedia.org] concept myself. It doesn't rely on easy to figure out (Mother's maiden name, hospital you were born at, etc.) information and is easy enough that most lusers can figure it out quickly. I don't understand why more financial institutions haven't adopted them.

      • Re: (Score:2, Insightful)

        by AvitarX (172628)

        Countrywide had a nice system.

        I had to enter my user name, and then then the password screen came up, I would type in my password, and then click on one of about 40 images on the screen.

        I had to click the one that was my image (this was rather than a sign in button).

        Also, I think a security token can count as a second factor of authentication, and I agree on security questions, never help at all, and often I can't find options with an obvious answer (for myself).

        • by Profane MuthaFucka (574406) <busheatskok@gmail.com> on Wednesday October 14, 2009 @12:32AM (#29741127) Homepage Journal

          That's not two factor, it's one factor. It's something you know, in two parts. A key fob introduces something you have.

          A big problem with what you described is that 40 images to choose from is like adding one more character to your password, allowing lowercase, numbers, and 4 other punctuation marks only.

          It doesn't add much to security at all, in other words.

          • Re: (Score:3, Interesting)

            by Lord Bitman (95493)

            technically, a key fob still uses "what you know", it's just "what you know that you are unlikely to know without what you have", which is good enough for now.

          • Re: (Score:3, Informative)

            by PitaBred (632671)
            If you do account locking after a certain amount of tries (as every bank I know of does), it most certainly does add security.
        • Re: (Score:3, Informative)

          by wh1pp3t (1286918)

          I had to click the one that was my image (this was rather than a sign in button).

          The image you choose is used by Countrywide (BofA) to provide you with the verification that you are not signing into a phishing site, not as part of your login credentials.

      • by FooAtWFU (699187) on Tuesday October 13, 2009 @10:48PM (#29740491) Homepage
        Security tokens are the second factor in two-factor authentication. The banks are just convinced that another-password is good enough, mostly because it's cheaper than doing it right.
        • by greenbird (859670) * on Tuesday October 13, 2009 @11:16PM (#29740695)

          mostly because it's cheaper than doing it right.

          Of course it's cheaper than doing it right. They've managed to twist bank robbery do to their lack of adequate security into identity theft that they blame on the costumer and force the costumer to suffer all the financial consequences. It's the perfect scam. If you walk into the bank with a fake id and steal money it's never been blamed on the costumer.

          • by Inner_Child (946194) on Tuesday October 13, 2009 @11:56PM (#29740925)
            What in the holy hell do people who make costumes have to do with any of this? I would be more concerned about the banks blaming things on their customers.
            • by bdwoolman (561635) on Wednesday October 14, 2009 @05:00AM (#29742257) Homepage

              What in the holy hell do people who make costumes have to do with any of this?

              If you are going to rob a bank anonymously you absolutely need a costumer. The costumer is the person who dresses up the bank robber in his archetypal stripped shirt and handkerchief mask. Costumers are typically blond with big... ideas.

              • Re: (Score:3, Funny)

                by Rudeboy777 (214749)
                If you are going to rob a bank anonymously you absolutely need a costumer. The costumer is the person who dresses up the bank robber in his archetypal stripped shirt and handkerchief mask.

                Right, but is it the bank or the costumer responsible for the sack with the dollar sign on it?
          • by Jason Levine (196982) on Wednesday October 14, 2009 @09:18AM (#29743555)

            As a victim of Identity Theft, I can tell you that banks and credit agencies just don't care. The bank writes off the loss due to fraud. The credit agency shrugs their shoulders at bad information in your credit file and tells *you* to fix it (while they happily go on reporting the bad information). In the case of stolen credit card numbers, the credit card company simply issues a new card and reverses the fraudulent charges. Meanwhile, the thief has their new television and the store is out a few thousand dollars.

            In my case, the credit card company opened a line of credit for "me" even though the online application contained the wrong Mother's Maiden Name. I only found out about it because the thieves put in for a rush delivery of the card and *then* changed the address on the account. The card wound up at my house instead of their house/drop box/whatever. The incorrect maiden name and quick address change didn't set off any fraud alerts. Neither did "me" trying to get a $5,000 cash advance on the card prior to activating it. And when I called them about it, they refused to give me any information because "I might run out and kill the thief and then they're liable." They even gave the police department the runaround.

            As I said, they just don't care. They'll do everything in their power to protect themselves. Even if protecting themselves in the short term means the identity thief gets away and commits more fraud against their business in the long term. In the end, you are only important to them insofar as how much green they can make off of you.

        • by Eivind (15695) <eivindorama@gmail.com> on Wednesday October 14, 2009 @02:16AM (#29741545) Homepage

          True, but it doens't have to be that expensive to do right. My bank offers two different solutions for the second-factor. One is s crypto-key tokenthing that they send you to hang on your keychain. (so you log in with a password + a 5-digit security token from the gadget)

          The other is, quite simply your mobile phone. You enter your username and password, if correct, they send you a SMS with a 5-char one-time-password, you enter this and are in.

          Yes, it adds 10 seconds to the login-procedure, but it's a very efficient way of stopping keyloggers and malware from learning how to access your account. Even if they successfully snoop your password, that doesn't help them aslong as they can't ALSO intercept SMS-traffic to your cellphone. This isn't IMPOSSIBLE offcourse, but it sure as hell raises the bar.

          • Re: (Score:3, Informative)

            by Animaether (411575)

            The ING bank in NL uses three forms (mostly after fully incorporating the Postbank).

            I should note that these are all for authorizing a transaction. Logging into your account still only requires a username and password. Should those be acquired by a malicious party somehow, they will be able to see your balance, your recent transactions (and if they see you always withdraw $200 from a specific ATM every tuesday at 10am, that's dangerous enough, tyvm), and change several settings including your password (bu

      • by schon (31600) on Tuesday October 13, 2009 @11:50PM (#29740895)

        And asking me for my Mother's maiden name is really that much better? Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?

        Those are both the same factor, just like a user's password.

        Security factors are

        1. something you know
        2. something you have
        3. something you are

        In order to qualify as "two factor", you must have two of those (no, having two of the same factor doesn't count.)

        So passwords, personal question, and favourite image are all examples of "something you know", and don't represent two-factor authentication.

        The Security-token would be an example of "something you have", and thus combining them with a password would be two-factor authentication.

    • by nmb3000 (741169) <nmb3000@that-google-mail-site.com> on Tuesday October 13, 2009 @10:47PM (#29740487) Homepage Journal

      A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

      And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

      If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

      • Re: (Score:3, Funny)

        by Shakrai (717556)

        If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

        What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

        • by Tynin (634655) on Tuesday October 13, 2009 @11:02PM (#29740591)

          What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

          This computer is protected by retaliatory DoS attacks? I guess that is the best we can hope for until we work out a better implementation of PoIP (Punched over Internet Protocol).

        • Re: (Score:2, Insightful)

          by Evil Shabazz (937088)

          If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

          What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

          A Penguin.

          Seriously. Because it doesn't matter what OS the computer is running, no matter how badass its security model is, when you have PHB's at the keyboard. Same for the Smith & Wesson: no matter how badass the gun is, that security is only as good as the guy with his finger on the trigger.

        • Re: (Score:3, Funny)

          by JumpDrive (1437895)
          "This computer runs Windows 7"
          The most secure operating system yet.
          And it will stay that way , Mr Balmer, as long as you don't release it.
          • Re: (Score:3, Insightful)

            by HangingChad (677530)

            And it will stay that way , Mr Balmer, as long as you don't release it.

            Good one. That was the same story we heard when XP came out. Yeah, yeah, Windows 7 is all over that now.

            For about six months.

      • by Cousarr (1117563) on Tuesday October 13, 2009 @11:11PM (#29740659)
        You realize that the way two factor security is supposed to work is that is requires you to know something and have something right? The way that two factor security is usually done from what I've seen is requiring a password that the client knows and a rolling code from a small device the client has. As long as a bank does not allow that same rolling code to be used twice it doesn't matter what kind of keystroke logging, mouse gesture capturing, or screen recording is used nor how fast it is sent to the bad guys.

        For you car enthusiasts, it's like taking the engine with you when you leave the car. Even if the car is hot-wired, it's not going anywhere without that thing you still have.
        • by DarkFencer (260473) on Tuesday October 13, 2009 @11:21PM (#29740739)

          Though I agree two factor authentication is useful, the 'taking the engine' analogy overestimates the difficulty of breaking through it.

          All the scammers have to do is instead of recording your keystrokes, gesturing, etc., they display a 'fake' copy of the bank to you through whatever software they have installed on your computer. They take the information you think you are sending to your bank (but are sending to them instead) and instantly have their scripts login to the site from their own systems (or some other bot on the net).

          If they prevent your initial login to the site from happening, they can use your username + password + rolling code themselves if their software auto logs in.

          This of course requires a user to go to a phishing site (miscellaneous.scammersite.com or something more complex), or requires the phisher to own the user's computer enough that they can intercept their connections & deal with the SSL certificate issues) while the phisher's automated software automatically goes to the real miscellaneousbank.com site.

        • by shird (566377) on Wednesday October 14, 2009 @12:19AM (#29741065) Homepage Journal

          And do you realise this authentication scheme has also been broken?

          The crooks these days are breaking into your account in real-time by using your security token code as you login, and preventing you from logging in.

          Read the article, he mentions this.

      • by some_guy_88 (1306769) on Tuesday October 13, 2009 @11:21PM (#29740737) Homepage

        The Commonwealth bank in Australia (and probably many others) sends you a random code via SMS to your phone that you have to type back in to the site in order to transfer money to an account you've never transfered to before.

      • by trawg (308495) on Tuesday October 13, 2009 @11:23PM (#29740747) Homepage

        And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

        The way it works here with some banks in Australia is they send you a code via SMS when you try to issue a transfer from Internet banking. You need to enter the code into the website to continue the transaction. So the extra factor here of having the phone offers a pretty useful extra layer.

        My bank doesn't offer it; I wish it did.

      • by hidden (135234)

        Well, with a token generator (for example), the thief would only have a few minutes to login before the token changed... that would help considerably.

        Of course, that means the banks somehow convincing everyone to carry a token generator... (could some of these "printing circuits on paper" things we've been seeing lately be used to put a token generator on your bank card?)

      • by mjwx (966435) on Tuesday October 13, 2009 @11:53PM (#29740903)

        And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

        Because a 2 factor authentication token like an RSA key changes every 10 or so seconds so by the time Bad Guy #1 has finished parsing that log the 2nd authentication factor is out of date. The far cheaper way of doing this which most banks in Australia have started using is a one time password sent to you via SMS. This password works one time only (hence we call it a one time password, geddit) so if the Bad Guys(TM) get the entire password in real time and are reading their logs in real time then they still cant use it as the password has already been used.

        Yes it's a band aid solution but at least it's a decent kind of band aid. The alternative is complaining that it doesn't work and then having nothing happen because no one has a better practicable idea.

        • by shird (566377) on Wednesday October 14, 2009 @12:25AM (#29741095) Homepage Journal

          This can be automated easily enough.

          Also, it's trivial to redirect the POST to login.cgi or add an entry to /etc/hosts for bank.com to a different site that just presents a 'failed to login' instead of logging in. Meanwhile your password, security code etc has been sent off to the bad guys machine which does an automated "transfer *.* funds to x" script using these credentials.

          It's been done.

        • by Compholio (770966) on Wednesday October 14, 2009 @12:28AM (#29741107)

          Because a 2 factor authentication token like an RSA key changes every 10 or so seconds so by the time Bad Guy #1 has finished parsing that log the 2nd authentication factor is out of date. The far cheaper way of doing this which most banks in Australia have started using is a one time password sent to you via SMS. This password works one time only (hence we call it a one time password, geddit) so if the Bad Guys(TM) get the entire password in real time and are reading their logs in real time then they still cant use it as the password has already been used.

          None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have. In one of the examples they specifically stated that crackers used the token code and delayed the customer's request:

          Johnston's bank requires customers to enter the code from a Vasco security token. But the thieves - armed with malware on the company controller's PC - were able to intercept one of those codes when the controller tried to log in, and then delay the controller from logging in. Indeed, Johnston said the company's computer logs show that the controller logged into the system while the series of thefts was already in progress.

          So, instead of the cracker getting blocked the customer would have been blocked because the "malware" made the customer's request come in AFTER the cracker's. If you were really clever you'd program the thing to intercept all the communication before it gets encrypted to go out to the bank and then fake the returned data so the user doesn't know that you're toying with them (yes, you can intercept the crypto library calls - I toyed with this some to get the Red Alert 3 Beta working on Wine). I don't know about you, but I can't think of a solid way around this interception (except having the bank only allow logins from a special custom browser that they load on a Live CD).

          • Re: (Score:3, Insightful)

            by AnyoneEB (574727)

            None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have.

            That's not entirely true. If there is some sort of challenge-response scheme that involves the "what you have" part of the authentication (either by a lookup in a table of single-use tokens or by typing the challenge into a security token-like device) and the challenge is based on what the user is requesting to do (ex. the user explicitly types the amount and target account number into their security token and then feeds the response into the website), then you can avoid unauthorized transfers even from a c

    • by jamstar7 (694492) on Tuesday October 13, 2009 @11:44PM (#29740865)

      A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

      Per TFA, the banks in the two cases mentioned in the summary used two factor authentication. The hackers' malware delayed their access, and the hackers used a VPN tunnel to access the bank through the compromised computer.

    • Re: (Score:3, Interesting)

      by MBGMorden (803437)

      Some have gotten a little better.

      Both my credit card accounts are now setup so that if I login on a NEW computer (and after a period of time on a computer I've been using), they'll ask me for the answers to 3 security questions. If you get those correct you are then prompted for the password along with a message you entered when you first registered. The idea there being that if the phrase doesn't match, then you're not really on their site and it's a phishing attempt.

      It's still not great, but it's decent

  • How about BSD?

    Or even better, how about a modified build of BSD underneath a GUI based on a 25 year tradition of Human Interface Guidelines?

    (Just askin')

  • Ya, it stops key loggers, and that's great, but it aint going to do much for your browser security unless you keep your LiveCD up to date, and hey, who says your CD burning software isn't infected - implications on trusting trust and all.

    • Most of the problem is malware and the live cd protects against that threat very well. Also, if your cd burning software is so compromised that it some how manages to corrupt the live cd without the integrity checking program finding it then you probably shouldn't be banking on that computer anyway.

    • Re:terrible advice (Score:5, Interesting)

      by fuzzyfuzzyfungus (1223518) on Tuesday October 13, 2009 @10:52PM (#29740513) Journal
      Unless your browser is listening for incoming connections, or your bank is running third party banner ads(in which case, switch right the fuck yesterday), does a browser vulnerability really matter?

      If you are using the LiveCD as a dedicated banking only environment, the only input your browser will see is your bank's website. If you can't trust user behavior, and want to really be sure, you could have it set to reject anything that doesn't have the bank's SSL cert. If your bank wants to 0wn you, you are already doomed. If no other site can reach your browser, your browser cannot be owned, no matter how buggy.
      • Re:terrible advice (Score:4, Interesting)

        by QuantumG (50515) * <qg@biodome.org> on Tuesday October 13, 2009 @11:06PM (#29740623) Homepage Journal

        sigh. Just off the top of my head I can think of about a dozen attacks one could direct against a bank user who thinks they're bulletproof because they're using a Linux LiveCD. For example, booting off a LiveCD won't save you from the truncated SSL cert attack that was demonstrated in the direction of PayPal the other day.. only having an up-to-date browser will do that. Encouraging people to use unpatched known-vulnerable software to do their banking just so they can avoid malware on their regularly patched machines makes no sense at all. Of course, that's the extreme case.. suggesting people use a LiveCD of Linux instead of an unpatched copy of Windows XP SP1 is a different kettle of fish.

        • Re: (Score:2, Interesting)

          by black3d (1648913)
          A dozen? I can only think of three. Excluding such fanciful attacks as "camera over the shoulder". Indeed, a forged cert combined with DNS poisoning could be used as a possible MITM attack. However, as in my post below, you can explore possible attack vectors for the sake of argument into infinite regression. Opposite to your argument is the fact that my bank always requires the latest version of Java to be installed to use its online banking. Each time Java is updated and my LiveCD thus becomes out-of-date
          • by QuantumG (50515) *

            If you regularly have to create a LiveCD, and you're the kind of person who is susceptible to malware attack, then:

            1) You're not going to do it, and
            2) You're likely going to get owned during the LiveCD creation chain..

            It kinda seems like all the value of using a LiveCD disappears as soon as you start trying to update it.. which is why I was bothering to object to suggesting to people that they use a LiveCD, as they necessarily contain software that is not patched up-to-date.

            None of this is n

        • I thought the truncated SSL was only affecting those using the MS crypto library?

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Ya, it stops key loggers, and that's great

      Yeah, it is great, because a huge part of on-line fraud is from keyloggers. Modern ones even record 'screencast' movies of you using your computer.

      but it aint going to do much for your browser security unless you keep your LiveCD up to date

      Between booting up and getting a DNS record for your bank how are they going to exploit a browser security problem? You could safely use unpatched IE5 to do online-banking. There might be some null-prefix type problems, but in reality going directly to your bank's site is pretty hard to get in between.

      who says your CD burning software isn't infected - implications on trusting trust and all.

      There are lots of different CD burning software, lots of di

    • Re:terrible advice (Score:5, Insightful)

      by black3d (1648913) on Tuesday October 13, 2009 @10:57PM (#29740555)

      Browser security is only an issue if you're visiting other sites, in the same session, on the same boot, on your LiveCD. Browsers on LiveCDs don't magically download malware from the internet by themselves - you have to direct them to. And most conventional malware must install itself - which won't happen on a LiveCD. There are a very few flash/js based attacks that work live in the same session - but really, if your either (a) your bank has third-party inline flash ads or (b) you don't trust java content from your bank's own website, then why are you banking with them online?

      And going as far as questioning whether your CD burning software is infected is ridiculous. You can't be any more certain that your mouse doesn't have imbedded circuitry tracing your movement pattens, or your keyboard doesn't have a keylogger built directly into it, or the aliens aren't tapping directly into your cablings electromagnetic intereference patterns to directly access your bank account as you do. You're going to extremes purely for the point of argument, but although it may have passed you by, it was established several thousands years ago that "nothing is certain".

      If you can imagine up scenarios like malware built into your cd-burning software specifically to target LiveCDs being used for online banking, I can't fathom how you trust a banks own employees enough to actually keep your money with them instead of under the mattress.

      • Re: (Score:3, Funny)

        Browser security is only an issue if you're visiting other sites, in the same session, on the same boot, on your LiveCD.

        Wrong. Any security compromise on the same boot lends a possibility of compromising that session. Not all vulnerabilities will lead to that, but some can.

        And going as far as questioning whether your CD burning software is infected is ridiculous. You can't be any more certain that your mouse doesn't have imbedded circuitry tracing your movement pattens, or your keyboard doesn't have a keylogger built directly into it,

        No, the question is not whether the software came pre-0wned. The question is, once this practice becomes widespread, won't malware authors target the ISO downloading and/or CD burning process? If malware attaches itself to Nero, and Nero injects something into your shiny new livecd, what are you going to do? Ask it to verify itself?

        or the aliens aren't tapping directly into your cablings electromagnetic intereference patterns to directly access your bank account as you do. You're going to extremes purely for the point of argument,

        Which is exactly what yo

    • by grahamsz (150076)

      Honestly, you'd be as good if not better with a windows XP bootable PE disk. It's a factory minted CD that's been time tested.

    • by Draek (916851) on Tuesday October 13, 2009 @11:26PM (#29740773)

      hey, who says your CD burning software isn't infected - implications on trusting trust and all.

      I understand there's only a fine line between safety and paranoia, but the idea of a CD burning software having been compromised to detect Linux LiveCD ISOs and add a software keylogger to the system included therein is so far up in 'paranoia' territory it already got full citizenship and is considering running for president against "Elvis is hidden in Area 51" and "9/11 was planned by Israel to draw the US into the middle east".

  • by nweaver (113078) on Tuesday October 13, 2009 @10:42PM (#29740457) Homepage

    Its not just "linux vs Windows" but "trusted boot": All you need to rely on is that the live CD is OK and your BIOS is not corrupted and you can effectively safely connect to your bank.

    I use it myself for my Schwab account, with the added bonus of there is enough math to show active traders lose big, so don't trade active, which goes into play here.

  • Alternate Headline (Score:5, Insightful)

    by Minwee (522556) <dcr@neverwhen.org> on Tuesday October 13, 2009 @10:44PM (#29740467) Homepage

    "Washington Post Urges Thieves To Distribute Linux LiveCDs"

    A few racks full of CDs in a highly visible place, or even cheap preloaded USB drives delivered right to the mark's front door along with a friendly letter explaining how running Linux would help improve security and thwart The Bad Guys could make your job of stealing from the clueless even easier than before.

    • Re: (Score:3, Insightful)

      by fermion (181285)
      Exactly. The problem is that many users click on any thing that is bright and shiny. While some problems are caused without user interactions, other clearly come from users navigating towards "carefully constructed web pages". There is really no way to stop this. One CD with 'naked women version of secure linux' on it, and it would be open season for the office bank accounts.

      The only real solution is to make banks liable for online bank fraud, just like credit cards are liable for credit fraud. The c

  • To be safe... (Score:4, Informative)

    by Antony-Kyre (807195) on Tuesday October 13, 2009 @10:48PM (#29740495)

    Well, don't do online banking.
    Or, use a totally separate computer to do online banking. Only use the web browser to access one's bank account.
    Or look for those "freeze" type software, which makes the harddrive essentially read only.
    Also, it doesn't hurt to check which processes you are running, and whether any of those are unusual.

  • There is nothing special about a "Linux LiveCD" that ensures that the programs on it can be trusted. Most distributions still include binary blobs in their corresponding source code that can bring the kinds of problems for which Microsoft Windows is advocated against in the article. Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software. Depending on the value of your target and the determination of your attacker there is a software solution for you
    • Re: (Score:3, Insightful)

      Most distributions still include binary blobs in their corresponding source code that can bring the kinds of problems for which Microsoft Windows is advocated against in the article.

      You won't find the word "proprietary", "open source", or "source code" in the article. The reason Windows is advocated against is simple: Malware is written to target Windows. Malware could as easily be written to target any operating system which is vulnerable.

      Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software.

      And 100% proprietary hardware, unless you've got schematics for all of it.

      Never mind that you're connecting to a webserver running the bank's proprietary software...

      Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software.

      Which you've of course scrutinized every single line for security vulnerabilities...

  • by HalAtWork (926717) on Tuesday October 13, 2009 @11:02PM (#29740587)
    The browser on a LiveCD may be out of date. How about a USB flash drive that can save your ISP settings and can update the browser? Banks could distribute them for the price of the flash drive as a safer option for online banking.
  • by mlts (1038732) * on Tuesday October 13, 2009 @11:03PM (#29740603)

    Devil's advocate here:

    Of course, a diskless system running Linux would reduce the chance of malware on clients, but perhaps if a company is dependent on Windows, almost as good security (and I state almost) would be obtained from denying admin access and using something like DeepFreeze, Windows SteadyState, or similar?

    Combine DeepFreeze with AppLocker, some decent enterprise antivirus utilities, BitLocker, and the usual physical and BIOS protection on a machine, and one can make a decently locked down terminal that can cleanly run Windows apps. Should additional software be needed, no need to install it, just use something like VMWare ThinApp and have it runnable from a central location.

    There is nothing wrong with a diskless system and booting from a CD-ROM. However, unless one creates a custom image with reliable enterprise level auditing tools, it becomes difficult to extract data from a group of PCs (and this is important for larger businesses come tax season, or regulatory compliance), and it is definitely an issue to add or update software without a reboot, unless it is a precompiled binary on a central server that people run.

    Also, instead of running live CDs, why not consider going to a vendor like Wyse and going with truly thin technology? This way, there is little to no fiddling with the client side. If a thin terminal has a problem, just swap it out for another one, chuck the old one in the RMA box and be done with it. This is arguably a lot easier than the cost for maintaining standard PCs [1].

    [1]: I'm primarily intending enterprise level here. For some SMBs, it is a lot cheaper to go with a boot CD and a generic PC, but for larger companies, it may mean more futzing around with stuff for their IT staff, especially on the scale of thousands of endpoints. If I had a startup with a call center of 5 people, PCs are a lot more economical. However, 500 to 1000 people in a non-technical call center, then I'd take a serious look at thin terminals and a beefy internal network fabric.

    • Re: (Score:3, Interesting)

      by Rennt (582550)
      Yes, a hardened single-purpose Windows machine is almost as resilient as a Live CD. Almost. It is also infinitely harder to set up correctly and significantly less useful all those times you aren't banking. It is understandable why it is not the solution recommended for non-technical users or people who only want one computer.
  • by SuperBanana (662181) on Tuesday October 13, 2009 @11:05PM (#29740613)
    ...it's more a matter of a read-only medium. If people start doing this is greater numbers, all the evil people will do is start distributing hacked ISOs pretending they're legitimate. This also doesn't do much for machines which have been hacked at a BIOS/bootloader level. In fact, if the PC is set to boot to the hard drive and the trojan supervisor is smart and puts up a boot menu that looks bios-ish (ie, allowing you to select the boot device), 95% of users would never notice. So unless Linux LiveCDs start running checks to see if they're being virtualized, this isn't a very good safety net.

    Also, honestly, how many people do you think check the MD5 sum on an ISO? Hell, I've never had a RedHat/Fedora disc that passed its self-check. I gave up on that ages ago.

  • by davide marney (231845) * <davide,marney&netmedia,org> on Tuesday October 13, 2009 @11:12PM (#29740667) Journal

    A bank with any technical savvy would be immediately preparing a LiveCD/USB distro that boots as quickly as possible into a browser pre-configured with the bank's portal page set as the home page. The distro would contain nothing extraneous -- just enough for fast, safe banking. It would, of course, be thoroughly branded, but completely legit vis a vis source code and license notices. Give them away in the mail, or even sell USB drives.

    • by gapagos (1264716) on Tuesday October 13, 2009 @11:30PM (#29740805)

      Sorry to break it to you, but doing this would be marketing-suicide for any bank that does this.

      All of its competitors, and 99.9% of its non-tech-savy client base (so 99.5% of its clients including the tech-savy ones) would interpreat it as:

      "This bank is SO insecure that they push me to use some kind of complicated pc configuration everytime before I go to their website. What a pain in the ass. Why can't they pay for their security problems themselves? I'm switching to another bank."

      A good bank should educate their clients about being responsible online, not make their online banking even more inconvenient.
      A great bank should protect their client bank accounts even if their PCs and their accounts have been compromised.
      An horrible bank is one that expects its users to go through a long and complicated process for their "safety", disreguarding the negative user experience in the process, like you're suggesting.

      I realize you're suggesting it as an option, not a forced policy, but the mere existence of the option will make average joe panic about its security and take for granted it's almost mandatory or he's fucked.

  • IE (Score:3, Informative)

    by bruthasj (175228) <bruthasj AT yahoo DOT com> on Wednesday October 14, 2009 @07:37AM (#29742861) Homepage Journal
    Beyond multi-factor authentication, there's another fundamental problem with many Bank websites. They only work in IE. It's difficult to convince non-power-users to drop a bank and go with another that works in Konqueror or even Firefox. This is especially a problem in a non-US country where every bank has the same problem.
    • Re: (Score:3, Interesting)

      by MollyB (162595)

      there's another fundamental problem with many Bank websites. They only work in IE.

      As an Ubuntu user, my bank (FCU, actually) just sprung this "Windows/Mac only" policy lately. I've complained loudly to Member Services to no avail. They even said blankly that my "Lynux" system would no longer be able to access Online Banking because they were "beefing up security"!?!

      I have CrossOver Office installed and it is simple to open IE8 and do my banking, but when I pointed out this flaw in their thinking, they had no comment.

      Another point: I live in a rural area and have banked at this location f

  • by vorlich (972710) on Wednesday October 14, 2009 @09:11AM (#29743489) Homepage Journal
    But the banking system here, requires the use of single use numbers for each online banking transaction. Your bank provides you with a unique sheet of them and if you lose it, you have to request a new one. Nor are credit cards popular with German consumers. Sites such as Amazon.de allow payment by bank transfer (Uberweisung). You can manually complete the transactions slip and give to your bank or do the same thing with your online banking. Any issue and the transfer has to be reversed. There are an awful lot more banks too - one just around the corner from me and at least three within a few minutes walk with real people working there and very, very friendly managers - if you're liquid!

If I want your opinion, I'll ask you to fill out the necessary form.

Working...