Feeds

Trojan intercepts bank tokens

TAN marks exposed

Beginner's guide to SSL certificates

A newly discovered Trojan is intercepting the TAN codes used as security tokens by customers of two major German banks, Postbank and Deutsche Bank, according to anti-virus experts.

Until now, TAN codes were pretty safe, in particular against phishing attacks, as these tokens are sent either through (snail) mail or by SMS. Phishing scammers would not only have to know a customer's login details and password to enter an online bank account, but also the token to enable transactions. For this reason, many European banks have adopted the system for online banking.

Trojan-Spy.Win32.Bancos.pw is changing the security landscape once again, as it is able to intercept HTTPS traffic and obtain the security token pass code. When the customer tries to enter a TAN code, an error message appears. Phishing scammers, if they are quick enough, can then enter the code themselves.

The Trojan isn't widespread yet, nor have there been any reports of victims, "but there is no doubt we are going to see more of this", an expert warns. "It could render the use of tokens useless." ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.