The Federal Bureau of Investigation has warned of an elaborate spear-phishing campaign that wires money out of victims' accounts under the cover of a distributed denial-of-service attack against the bank.
The new spear-phishing campaign masquerades as emails from the National Automated Clearing House Assocation (NACHA) and downloads a variant of the Zeus banking Trojan onto the victim's computer, the FBI Denver Cyber Squad said in its warning issued Nov. 23.
The malware steals the user's online banking credentials and launches a DDoS attack on the financial institution to hide the fact that it is also transferring money out of user accounts. The DDoS attacks may also make it difficult for the financial institution to stop or reverse the transfers even if they are detected in time.
The email informs the recipient that there was a problem with a transaction at their bank and it was not processed. By clicking on the link in the email, the recipient is directed to a Website that downloads the Zeus variant called "Gameover" to the recipient’s computer, the FBI warned. Gameover is capable of keylogging to steal banking credentials as well as defeating several forms of two-factor authentication mechanisms the banks may be employing.
The new spear-phishing campaign involves "personal and business bank accounts, financial institutions, money mules and jewelry stores," according to the warning.
Attackers are becoming increasingly smart and stealthy in their DDoS methods, Mike Paquette, chief strategy officer at Corero Network Security, told eWEEK. While a brute-force or flooding type of DDoS attack can be relatively easy to identify, it requires high-performance and sophisticated real-time analysis to recognize and block attack traffic while simultaneously allowing legitimate traffic to pass, according to Paquette.
Application layer attacks, such as the one posed by the recent Apache Killer, are "more insidious" and require the financial institution to have a thorough understanding of the typical behaviors and actions of their actual customers, he said.
Paquette suggested that financial institutions should automate DDoS defense to create user profiles to identify suspicious traffic, much in the same way automated credit card fraud-detection technologies look for unusual spending activity.
A portion of the wire transfers is being transmitted directly to high-end jewelry stores, according to the warning. The criminals contact a jeweler looking for precious stones and luxury watches. They promise to wire the money directly to the jeweler's account and someone will come to pick up the merchandise.
Once the fraudulent wire transfers are complete, a money mule comes to the actual store to pick up thousands of dollars of goods, the FBI said. Even though the transaction is reversed when the fraud is discovered, the jeweler is unable to recover the goods.
DDoS attacks against high-profile targets are generally perpetuated by intelligent, determined and persistent adversaries, and this "new breed" of attackers will switch to different sources and methods as necessary, Paquette said. Therefore, advance preparation is key to being able to respond to these DDoS attacks effectively, Paquette said. A response plan lists the steps the institution should take during a DDoS attack.
Hiding malicious activity by distracting the defenders with a DDoS attack is not new. The perpetrators who breached Sony's PlayStation Network and Sony Online Entertainment services earlier this year appear to have taken advantage of the fact that the entertainment giant's IT staff was busy trying to contain the DDoS attacks that had been launched by the Anonymous hacktivists.
Institutions shouldn't rely on just the Internet service providers to be able to mitigate the DDoS attack, but should deploy technology in-house to serve as the front-line defense against both flooding type and application-layer DDoS attacks, according to Paquette. DDoS mitigation tools need to be deployed alongside monitoring services so that organizations can rapidly identify and react to sustained attacks.
"Continuous and automated monitoring is required in order to recognize an attack, sound the alarm and initiate the response plan," Paquette said.
When Did 7% Become a Threshold?
By Christopher Mistal
Using numbers supplied by our Commodity Trader’s Almanac 2012 data partner, Pinnacles Data Corp, (also available from the St. Louis Fed’s Fred database) the following chart of the 10-year Treasury bond yield was created back to 1962. Our Federal government has borrowed money at an average rate, over the last five decades, of 6.75%. During the same time period the 10-year Treasury bond yield was greater than or equal to 7%, a surprising 41.4% of the time. 10-year yields have briefly been above 7% as recently as July 1996.
Click to view full size in new window...
During roughly six years of the Reagan administration, one of the largest deficit spending administrations until 2001, rates remained well above 7% and actually peaked at 15.84%. And yet, there was no debt crisis then that threatened to topple the global financial system. In fact, one of the greatest economic booms in history began in 1982 that lasted until 2000 and the DJIA soared 1447%. The question is, when did 7% become a threshold that triggers a crisis and immediate action.
Obviously, comparing Italy or Spain now to the U.S. then is like comparing apples to pumpkins, but who is really seeking a bailout. Is it the banks holding the rapidly declining paper as an asset on its balance sheet or the sovereign that is issuing the paper?
I don't necessarily believe them but I do believe that the big european banks have enough money between them to effect the economy of any country on earth. Even the communist countries can be effected by a combination of the big european banks that are railing against the restrictive rules. They along with their American, and by that I mean the Americas, allies buy the bonds.
Is altogether too true. I live in a city that hosts Ft. Benning and I see the problems faced by our active duty, injured and retired soldiers on a daily basis. Seeing a young man or woman sporting a prostetic device instead of an arm or leg while waiting in line at the supermarket or in line at a restaurant is common. The sad part is that the ones we see are the ones who are in the best shape. We rarely see the bad cases.
The reserve troops were hurt most when Bush was president. They changed the bankruptcy laws and didn't exempt reservists on active duty. Active duty military is not well paid, many of the enlisted families qualify for food stamps. The reservists took high casualties in combat and lost their property because they couldn't keep up with their bills on a soldiers salary. They also lost their jobs when returning from serving our country because the employers filled their postions while they were gone.
Jobs was a rare case much like Henry Ford. This type of man comes along once in a generation or two. Their wealth was well earned and well deserved. I don't know if the small business accounts for 70% or 7% of the GDP and really that is not even important. Most small businessmen or businesswomen are not in the top 1% of earners. I was raised in a family of small businessmen and have been one myself and I like most small businessmen have never made near $1,000,000 a year. Those salaries are made by CEO's, CFO's, CIO's and the wall street elite.
Bill Gates, GE, and most of the international businesses want us to compete head on with India, Viet Nam, China, etc. They want us to compete at the wages that are paide in India, Viet Nam, China, etc. Are you willing to accept those wages? Should your grandchildren be forced to accept those wages?
They have lobbyists who insure that our children are under educated, our food is not accepted in most european countries because of growth hormones and genetic engineering.
I can go on and on about how life in the United States has been degraded over the last 30 to 50 years but you have eyes. If I was talking about statistics I'd be able to say that our stochastic events have been skewed.
"In other words, I don't blame them but I do." is a twisted interpetation. Celebrating the acquisition of wealth by any means is to celebrate people like Pablo Escobar, or hold Goldman Sachs up as an ideal orgaizational model. If you do that I feel sorry for you.
There is no taking despotic out of dictatorship. Dictatorship has always been despotic to some and beneficial to others. The questions are 1) who is it despotic to and 2) what proportion of the population benefits. Our republican form of democracy has similar problems but it can work to benefit the greatest portion of the population. The only problem with our present form of government is that it is Government of the people, by the Congress for the benefit of the Corporations.
The way to defeat the banking cabal is for the voters to turn out and replace the greatest offenders. That would require publication of voting records.
We don't blame the rich for being rich, we may on occasion blame them for the path they took to get rich. I would be among the first to fight against a dictatorship, benevolent or despotic because a dictatorship will inevetably end up as despotic. Anyone who would accept a dictatorship of any type cannot claim to follow "The American ideals."
"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
Benjamin Franklin (1706 - 1790), Historical Review of Pennsylvania, 1759
Anyone who has read Plato understands the flaws of democracy. I challenge you to find a system which provided as well as democracy has for the average man. Now that we find ourselves in a corprocracy I see all the gains that democracy has provided slipping away.
Some people don't understand that they are not always right. Liberal or Conservative are just labels that mean little and the right decision is not always the one I or you would make. Don't let them irritate you.
I agree with you on support of gay marriage. A persons sexuality has no effect on my life if it isn't my spouse. I only wish that there was a name or phrase that wasn't as emotionally charged as "marriage." Personally I think Fred would be perfect. "With this ring I thee do Fred."
I can't disagree with the fact that talent is important. Would you rather go to a brilliant intern with one successful brain tumor operation or an average surgeon with 1,000 successful brain tumor operations if (G-d forbid)you or your wife was having a brain tumor operation? Skill is great but experience (practice) and having seen and worked around the possible problems is more important in many situations.
California, can you tell me about the difference between supporting them on jobless benefits or supporting them on welfare? The only difference I can see is that welfare includes health benefits.
That's it.
If you throw great gobs of money at U.S. consumers you would make China richer. They would just buy consumer goods made overseas.
Planned economy is only one of the alternatives and an unacceptable one at that.
The Federal Bureau of Investigation has warned of an elaborate spear-phishing campaign that wires money out of victims' accounts under the cover of a distributed denial-of-service attack against the bank.
The new spear-phishing campaign masquerades as emails from the National Automated Clearing House Assocation (NACHA) and downloads a variant of the Zeus banking Trojan onto the victim's computer, the FBI Denver Cyber Squad said in its warning issued Nov. 23.
The malware steals the user's online banking credentials and launches a DDoS attack on the financial institution to hide the fact that it is also transferring money out of user accounts. The DDoS attacks may also make it difficult for the financial institution to stop or reverse the transfers even if they are detected in time.
The email informs the recipient that there was a problem with a transaction at their bank and it was not processed. By clicking on the link in the email, the recipient is directed to a Website that downloads the Zeus variant called "Gameover" to the recipient’s computer, the FBI warned. Gameover is capable of keylogging to steal banking credentials as well as defeating several forms of two-factor authentication mechanisms the banks may be employing.
The new spear-phishing campaign involves "personal and business bank accounts, financial institutions, money mules and jewelry stores," according to the warning.
Attackers are becoming increasingly smart and stealthy in their DDoS methods, Mike Paquette, chief strategy officer at Corero Network Security, told eWEEK. While a brute-force or flooding type of DDoS attack can be relatively easy to identify, it requires high-performance and sophisticated real-time analysis to recognize and block attack traffic while simultaneously allowing legitimate traffic to pass, according to Paquette.
Application layer attacks, such as the one posed by the recent Apache Killer, are "more insidious" and require the financial institution to have a thorough understanding of the typical behaviors and actions of their actual customers, he said.
Paquette suggested that financial institutions should automate DDoS defense to create user profiles to identify suspicious traffic, much in the same way automated credit card fraud-detection technologies look for unusual spending activity.
A portion of the wire transfers is being transmitted directly to high-end jewelry stores, according to the warning. The criminals contact a jeweler looking for precious stones and luxury watches. They promise to wire the money directly to the jeweler's account and someone will come to pick up the merchandise.
Once the fraudulent wire transfers are complete, a money mule comes to the actual store to pick up thousands of dollars of goods, the FBI said. Even though the transaction is reversed when the fraud is discovered, the jeweler is unable to recover the goods.
DDoS attacks against high-profile targets are generally perpetuated by intelligent, determined and persistent adversaries, and this "new breed" of attackers will switch to different sources and methods as necessary, Paquette said. Therefore, advance preparation is key to being able to respond to these DDoS attacks effectively, Paquette said. A response plan lists the steps the institution should take during a DDoS attack.
Hiding malicious activity by distracting the defenders with a DDoS attack is not new. The perpetrators who breached Sony's PlayStation Network and Sony Online Entertainment services earlier this year appear to have taken advantage of the fact that the entertainment giant's IT staff was busy trying to contain the DDoS attacks that had been launched by the Anonymous hacktivists.
Institutions shouldn't rely on just the Internet service providers to be able to mitigate the DDoS attack, but should deploy technology in-house to serve as the front-line defense against both flooding type and application-layer DDoS attacks, according to Paquette. DDoS mitigation tools need to be deployed alongside monitoring services so that organizations can rapidly identify and react to sustained attacks.
"Continuous and automated monitoring is required in order to recognize an attack, sound the alarm and initiate the response plan," Paquette said.
When Did 7% Become a Threshold?
By Christopher Mistal
Using numbers supplied by our Commodity Trader’s Almanac 2012 data partner, Pinnacles Data Corp, (also available from the St. Louis Fed’s Fred database) the following chart of the 10-year Treasury bond yield was created back to 1962. Our Federal government has borrowed money at an average rate, over the last five decades, of 6.75%. During the same time period the 10-year Treasury bond yield was greater than or equal to 7%, a surprising 41.4% of the time. 10-year yields have briefly been above 7% as recently as July 1996.
Click to view full size in new window...
During roughly six years of the Reagan administration, one of the largest deficit spending administrations until 2001, rates remained well above 7% and actually peaked at 15.84%. And yet, there was no debt crisis then that threatened to topple the global financial system. In fact, one of the greatest economic booms in history began in 1982 that lasted until 2000 and the DJIA soared 1447%. The question is, when did 7% become a threshold that triggers a crisis and immediate action.
Obviously, comparing Italy or Spain now to the U.S. then is like comparing apples to pumpkins, but who is really seeking a bailout. Is it the banks holding the rapidly declining paper as an asset on its balance sheet or the sovereign that is issuing the paper?
Bill,
I don't necessarily believe them but I do believe that the big european banks have enough money between them to effect the economy of any country on earth. Even the communist countries can be effected by a combination of the big european banks that are railing against the restrictive rules. They along with their American, and by that I mean the Americas, allies buy the bonds.
http://www.reuters.com/article/2011/11/14/us-usa-f...
Is altogether too true. I live in a city that hosts Ft. Benning and I see the problems faced by our active duty, injured and retired soldiers on a daily basis. Seeing a young man or woman sporting a prostetic device instead of an arm or leg while waiting in line at the supermarket or in line at a restaurant is common. The sad part is that the ones we see are the ones who are in the best shape. We rarely see the bad cases.
The reserve troops were hurt most when Bush was president. They changed the bankruptcy laws and didn't exempt reservists on active duty. Active duty military is not well paid, many of the enlisted families qualify for food stamps. The reservists took high casualties in combat and lost their property because they couldn't keep up with their bills on a soldiers salary. They also lost their jobs when returning from serving our country because the employers filled their postions while they were gone.
Do France and Germany have the resources to bail the rest of the EEOC out of trouble. We know about the PIIGS what about the rest?
I thought that they'd be calling for draw and quarter. That would be a much more appropriate reward for those actions.
Dr. Strange,
Jobs was a rare case much like Henry Ford. This type of man comes along once in a generation or two. Their wealth was well earned and well deserved. I don't know if the small business accounts for 70% or 7% of the GDP and really that is not even important. Most small businessmen or businesswomen are not in the top 1% of earners. I was raised in a family of small businessmen and have been one myself and I like most small businessmen have never made near $1,000,000 a year. Those salaries are made by CEO's, CFO's, CIO's and the wall street elite.
Bill Gates, GE, and most of the international businesses want us to compete head on with India, Viet Nam, China, etc. They want us to compete at the wages that are paide in India, Viet Nam, China, etc. Are you willing to accept those wages? Should your grandchildren be forced to accept those wages?
They have lobbyists who insure that our children are under educated, our food is not accepted in most european countries because of growth hormones and genetic engineering.
I can go on and on about how life in the United States has been degraded over the last 30 to 50 years but you have eyes. If I was talking about statistics I'd be able to say that our stochastic events have been skewed.
STrangelove,
"In other words, I don't blame them but I do." is a twisted interpetation. Celebrating the acquisition of wealth by any means is to celebrate people like Pablo Escobar, or hold Goldman Sachs up as an ideal orgaizational model. If you do that I feel sorry for you.
There is no taking despotic out of dictatorship. Dictatorship has always been despotic to some and beneficial to others. The questions are 1) who is it despotic to and 2) what proportion of the population benefits. Our republican form of democracy has similar problems but it can work to benefit the greatest portion of the population. The only problem with our present form of government is that it is Government of the people, by the Congress for the benefit of the Corporations.
The way to defeat the banking cabal is for the voters to turn out and replace the greatest offenders. That would require publication of voting records.
Good trading to all.
Strangelove,
We don't blame the rich for being rich, we may on occasion blame them for the path they took to get rich. I would be among the first to fight against a dictatorship, benevolent or despotic because a dictatorship will inevetably end up as despotic. Anyone who would accept a dictatorship of any type cannot claim to follow "The American ideals."
"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
Benjamin Franklin (1706 - 1790), Historical Review of Pennsylvania, 1759
Many among us have opted for safety over liberty.
Anyone who has read Plato understands the flaws of democracy. I challenge you to find a system which provided as well as democracy has for the average man. Now that we find ourselves in a corprocracy I see all the gains that democracy has provided slipping away.
Grym,
Some people don't understand that they are not always right. Liberal or Conservative are just labels that mean little and the right decision is not always the one I or you would make. Don't let them irritate you.
It's amazing what you can do with relational data bases. Thank you E.F. Codd.
Bill,
Take good care of yourself, rest and relax until you feel better.
Grym,
I agree with you on support of gay marriage. A persons sexuality has no effect on my life if it isn't my spouse. I only wish that there was a name or phrase that wasn't as emotionally charged as "marriage." Personally I think Fred would be perfect. "With this ring I thee do Fred."
I can't disagree with the fact that talent is important. Would you rather go to a brilliant intern with one successful brain tumor operation or an average surgeon with 1,000 successful brain tumor operations if (G-d forbid)you or your wife was having a brain tumor operation? Skill is great but experience (practice) and having seen and worked around the possible problems is more important in many situations.
California, can you tell me about the difference between supporting them on jobless benefits or supporting them on welfare? The only difference I can see is that welfare includes health benefits.