Defending Against the Zeus E-Banking Attacks

Brian Krebs wrote another article about the rising number of E-Banking funds transfer fraud incidents where the Zeus trojan/botnet is used to compromise end point systems. The man-in-the-browser (MITB) exploit is a version of the classic man-in-the-middle (MITM) attack where the user's bank credentials are stolen without the user realizing it. In fact, the Zeus trojan goes on "to control what the user sees on his or her browser."

One is left to ask, is there is no "inline" defense against the Zeus trojan? In other words, is there no end point anti-malware product that can successfully defend against morphing trojans/botnets like Zeus?

It appears that the best choices at present are:

• Use a dedicated PC, preferably one that boots from a CD, to do your online banking
• Depend on your bank to:
• • Use behavior anomaly detection systems to catch/stop fraudulent transactions
  • Refund fraudulent transactions after the fact

Alternatively from a bank process perspective, why not require a 48 hour waiting period between the time a new payee is created and the time a payment can be made to that new payee?

In addition, the bank could add another step to the "add a payee process" where the bank sends an email or even hard copy notification of the new payee to the user (payer) and the user has to call from a known home phone number to verify the new payee.

Clearly these steps would add a level of inconvenience to online banking, but that has to be weighed against the costs of reimbursing consumer and corporate customer losses. If the lawsuits in progress are adjudicated in favor of the corporations suing their banks, we may very well see these or other changes.

Comments

[Anonymous]

What "cost of reimbursing...corporate customer losses"? Krebs' angle on this is that this kind of thing is particularly horrible for small and medium-sized entities precisely because banks are not reimbursing them, except when they do so for customer goodwill. Consumer accounts, in contrast, have their losses limited by law (FDIC Regulation E).

[riskpundit]

Actually, a corporate customer will be reimbursed for a fraudulent transaction if it notifies its bank within two days of the transaction. After two days, the bank has no reimbursement obligation.