alanm, I think you should try to go to the bank's secure web site directly. Also try not to save your password. In addition, if possible, clean up your track and close the browser once you are done. "Log out" is better than "time out". Therefore, we should also try not to leave the bank account's information open for hours for no reasons.
For those of you who have a lot of passwords to various sites, you can get a thumb reader that you just press your thumb against and it will automatically log you into a site. This is more for convenience than security since it still has to transmit that information across the net. However, there is a laptop with a built in thumb reader that is especially cool if you are out in pubic and do not like typing passwords in front of others. You merely rub your thumb against it and it will log you into the site. Cameras and prying eyes cannot get any sensitive information this way. Any other questions -- bring 'em on.
Aphexcoil, Here's another. Would a malicious keylogger necessarily require a .exe extension in order to operate on the taget computer? Also would a malicious keylogger require a change to the registry in order to operate and gather data? If the answer is yes to either, would it be possible to detect either case prior to its operating on the target computer?
The short answer -- no. I'll assume we're speaking strictly of Microsoft PC's here. There are several types of files that are executable or contain executable code -- an .exe file is only one of them. A *.dll file could also be executed and run malicious code. There are many file extensions that can be the first domino that allows for the really malicious code to execute. Yes and no. A program does not need to make a registry change in order to run. HOWEVER, most illegitimate programs will make a registry change in order to execute automatically upon bootup. Most spyware programs, if they are programmed to be a real pain in the ass, will make multiple registry changes and run programs that are completely hidden from the task manager. You can also get into rootkits which can totally corrupt your operating system. The problem with Microsoft Windows and the way it operates is that it generally gives administrative rights to the default account. Generally, you do not want your account to have administrative rights. You want to run under an account that has standard user rights so that malicious code cannot promote itself to administrator and run as root system code. I believe this was a decision on Microsoft's part to make the system as easy to use as possible but this was definitely at the expense of security. You see, if you run under standard user access rights and try to install programs, it will either deny you that ability or prompt you for an administrator password. This would be confusing to your average computer user -- but is definitely the way to go in terms of security. By detection, I assume you mean being able to recognize a program as malicious before it infects your computer? Well, following up on my previous comment, once malicious code executes under an account with administrative rights (which is a common setup for MSFT OS), it is next to impossible to remove it cleanly because it can elevate itself to the highest level and, in the process, actually demote your rights to below its own rights. In essence, you won't be able to see it because it has demoted your ability to do so. This is what makes it so bad. To give you an idea, I've had machines that were infected so bad at my work, that I had to remove the hard-drive from the system and add it as a secondary drive to a clean system. I then had to scan that drive under a clean OS in order to see the hidden files and malicious code. It is an ugly, time consuming process. Apple computers are actually growing rapidly in popularity due to the fact that there are far less virii and trojans written for the Mac operating system. If you really wanted to run a clean, bullet-proof system, you could purchase a cheap Mac and use that, along with a few tools to constantly monitor your system. There is a balance between price and security -- but the curve is exponential in my opinion. The first few hundred dollars will solve 99.9% of the most common problems and the other .1% would cost thousands more and require far more time. For the average user, you don't need 100% security. E*Trade needs 100% security. I used to have an E*Trade account as one of my first trading accounts and I was completely blown away at their horrible level of security. In my opinion, a responsible corporation needs to meet their client halfway when it comes to security. Having a customer lose $4k due to lack of forward thinking on the corporation's behalf is unacceptable in my opinion. If it were me, I'd raise a huge stink over it and become a thorn in their corporate foot. Going head to head through arbitration and/or law suits is a losing proposition for David, but showing how bad Goliath's shit can stick will generally make them waiver enough to throw some money at you so that you will shut up -- assuming that you have lost money due to a scam that even E*Trade admits has been a problem. The individual who originally lost around $174k would probably not have recouped a penny of it had it not been for the media picking up on the story and causing bad publicity for E*Trade. It might cost E*Trade a couple of hundred thousand to replace what they would consider nickle and dime losses -- but one stinging review that shows their security in a poor light would cost them millions upon millions and perhaps serve as the catalyst to eventually put them under. If I were E*Trade, I'd rather risk losing customers by restricting ACH withdrawals than leave my system wide open to my client's getting shafted by a phishing scam.
Look at this ... http://www.tgdaily.com/2005/11/28/scottrade-hackersgainaccess/index.html Hackers gain access to millions of Scottrade's accounts Scotttrade, a brokerage firm known for their $7 commission for online orders, has been hacked. Company officials say that someone illegally gained access to the company's E-secure system which contains names, addresses and social security numbers as well as bank account information. While the breach happened on October 25, customers are only being informed now. For the last 25 years, Scottrade has offered brokerage services to millions of customers. Customers use the E-secure system to transfer money from banking accounts to the investment account. Active traders will move money often to cover margin calls or transfer profits from successful stock sales. While the one month lag between the system breech and customer notification may seem too long, companies often extensively investigate these incidents to make sure that there was no false alarm. A few states, including California, have enacted legislation that requires companies to inform customers of data breeches. Company officials say that they are not sure if the hacker actually stole any of the account information.
aphie, How about starting something like a "Computer Security" thread in the Software forum? You could respond to questions and post advice there when you had time. I've sure a lot of people would find it useful. Just an idea. Good luck and safe computing to all. C
I have been following stories of a similar nature and know that Etrade offers an rsa Security Key FOR FREE, since the 1st quarter of last year, with those who have over $50K in account assets. For those who have not obtained one of these, you are using a computer at your own peril. I would suggest getting someone with computer expertise in the area of viruses and spyware to "identify and clean" the machine. I also strongly suggest the installation of a firewall to help prevent the release of unauthorized information to the "not-so-nice" people. I wish I could be of more help. Regards, Steven moshlak www.computerlegalexperts.com
ok, well this thread has been dead for a while, but smosh revived it and it was an interesting read. i agree with the wifi sentiments. WiFi is very insecure, even when encrypted. You used to need a lot of packets to figure out the info you needed, and this would take forever, but with packet injection you can generate zillions of packets in seconds, and poof, there you go. although i still use my financial transactions over WiFi because I trust SSL encrypted, not the WiFi encryption, but thats just me. I also have a seperate computer i use for financial stuff. Hands down the most secure operating system in the world is OpenBSD, although it may be cumbuersome to use for non computer geeks, any unix derivative like MEPIS linux would be a fantastic security improvement and still provide all the desktop useability you could want. The transmitting end, and receiving ends of the transaction are the least secure by far. Improving youre home computer security is a pretty easy thing to do now a days for anyone who isnt entirely opposed to trying something new and who has an extra hour to work with it. Change your OS - its free, more secure, more stable, better support, and supports any application you run on windows except video games and high end audio recording applications. No reason not to except to resist change.
http://www.nytimes.com/2006/01/18/technology/18data.html I wonder if the OP's problem has been resolved.