PREVIOUS ARTICLENEXT ARTICLE
NEWS
By 8 December 2011 | Categories: news

0

As the holiday season approaches, with many people opting to do seasonal purchases online, Norton has reported a renewed need for local users to become more vigilant when banking and carrying out everyday tasks online.

One of the key threats identified by the company at this time are Trojans, a form of malware that cybercriminals use to exploit financial transactions being done on the internet.

“As with any holiday we can see consumers spending and travelling more across the region and abroad, and whether to book a flight to somewhere exotic or buy a gift for a relative, users can now choose to do this from the comfort of their home computer or from their smartphone or their tablet,” stated Kara Rawden, senior marketing manager, consumer - Middle East and Africa Symantec Corporation.

She explained that this amounted to broadcasting sensitive financial information that could easily find its way into the wrong hands. “Cybercriminals are first and foremost financially motivated and we should be looking at how we are protecting ourselves when sharing these details online to prevent attacks through Trojans or otherwise,” she added.

Trojan terrorists

The company explained that for Trojans to spread, they must be “invited” onto one’s computer, much like the story of the invasion of Troy after which they are named. This can happen by opening an (infected) email attachment or downloading and running a file from the internet. Once a computer is infected with the Trojan, it could trigger loss or theft of data.

Traditionally Trojans typically captured data traffic exchanged between the user and the online banking website. The captured information included the authentication information, which is collected and sent to the attacker by the Trojan for their use or to sell on to other parties for a profit.

However, more sophisticated banking Trojans employ a man-in-the-browser (MITB) method that is designed to overcome defenses, such as SSL encryption and multi-factor authentication. MITB is achieved by monitoring and intercepting user activities in the browser in real time and modifying the HTML content inside the context of the browser, either to display false information to the user or to manipulate details of transactions sent from the user to the bank.

In addition to being able to just steal information, Trojans offer a back door (as did its namesake), allowing a remote attacker to essentially control the infected computer. Commands range from listing and terminating processes running on the computer, clearing browser cookies, executing arbitrary programs, to completely rebooting the computer.

Strategy for defense

However, the company outlined a three pronged strategy that online shoppers can use to mitigate the Trojan threat. This includes:

 

  • Be skeptical and be wary: Generally speaking, you should treat anything you see online with some degree of skepticism. Do not believe everything you read, be it financial advice, breaking news, or tips on free giveaways — especially if it involves clicking on a link or installing an application. If someone asks you for money in advance, it might be a scam. People on the internet are not always who they claim to be.
  • Privacy Policies: Most banking services have specific privacy guidelines and rules that are published on their websites. Make sure you understand them, even though they may be tedious to read. Good, strong passwords are key to keeping safe, containing letters and numbers, as well as special characters if possible.
  • Stay Updated: Some of the newer attacks are very sophisticated and are sometimes hard to spot for an untrained eye. Use comprehensive security software to protect against these threats and always ensure that the software you use is up-to-date. Not only does this include the operating system and web browser, but also third-party plug-ins, such as PDF viewers.
To the point

While the Trojan warning may be easier to ignore, this could prove a costly mistake. The company pointed out that the direct cash cost due to cybercrime in South Africa amounted to R4 billion in the last twelve months according to the Norton Cybercrime Report, and indicated that each attack takes on average 16 days to resolve.

Our advice: Microsoft does not want to give you money for free, you have not won an iPhone or iPad by being the 1 millionth/billionth visitor to a particular site, and if it sounds dodgy or looks suspicious, it probably is.

In recent news, a new report cited that as many as 78% of children had a negative experience online.

USER COMMENTS

Read
Magazine Online
TechSmart.co.za is South Africa's leading magazine for tech product reviews, tech news, videos, tech specs and gadgets.
Start reading now >
Download latest issue

Have Your Say


What new tech or developments are you most anticipating this year?
New smartphone announcements (43 votes)
Technological breakthroughs (27 votes)
Launch of new consoles, or notebooks (14 votes)
Innovative Artificial Intelligence solutions (27 votes)
Biotechnology or medical advancements (21 votes)
Better business applications (132 votes)