Slik stanser vi nettbanksvindel i Nordea

Transkript

1 Slik stanser vi nettbanksvindel i Nordea Andreas Havsberg Simon René Magnussen 12. November 2014

2 Vi er Andreas Havsberg Simon René Magnussen Authentication and Financial Anti-Crime dekker: Anti-Money-Laundering (AML) Sanction Screening and Counter Terrorism-Financing (CTF) Authentication and online fraud prevention 2 03/11/2014

3 Hva er egentlig problemet? 3 03/11/2014

4 Nettbanksvindel Trojanere og ondsinnet programvare Phishing ID tyveri Tjenestenektangrep (DDOS) Svindeltyper som berører nettbank: APT (Advanced Persistent Threats) Overlay -tjenester Reklame i nettbanken (=malware) Fakturasvindel Web, mobil nettbrett, etc. 4 03/11/2014

5 Source: Europol OSINT Dashboard

6 Stort tjenestenektangrep på norske nettsider Tirsdag 8 juli: En rekke norske nettsteder er utilgjengelige I kortere eller lengre perioder Rundt 5000 websider (WordPress) misbrukt i angrepet 10 juli: 17-årig tatt av politiet hjemme og tilstår. Media: FinansCert Dagens Næringsliv, Bergensavisen, Digi.no, E24.no, 1, 2 and 3 Teknisk: Sucuri, WordPress

7 NemID phishing people are easily fooled May: Phishing sent out to many Danish citizens. Victim is asked to submit all codes. If you happen to not have a camera or scanner at hand, you can manually enter all your codes! And if you don t comply within 24 hours, the e- mail threatens your codes will be blocked Source: CSIS and here

8

9 Source: CSIS

10 Phishing, phishing, phishing - Sweden

11 What is cybercrime in online channels 11

12 Trojan in Sweden Customer discovers a pop-up window when logging in from Komplett.se received. Pop-up asking for telephone number. Customer finds a unknown attempted transaction between accounts Cross border payment. Also got an from Komplett.se and a pop-up window asking for phone number. Corporate customer finds a created cross border payment to Spain. Observes the first page is updating abnormally, but payment not confirmed.

13 Infected user at Nordea.se Infected user at Swedbank.se Warning message from Nordea Warning message from Elgiganten.se 13 03/11/2014

14 Signature Phishing Phishing sites asking for more than online banking credentials. Personal information and a copy of the signature. Source: BFK

15 Android malware: New variants of svpeng Now supports inject asking for credit card details when starting Google playstore app (in German and English) Typical place were users are asked to enter such information The malware also triggers on launch of the Russian Alfabank app and Ukrainian Privat24 app. Source: BFK

16 From single cases to the Great Train Robbery scenario Today Tomorrow? 16

17 Løsningen 17 03/11/2014

18 Nordea Fraud Wheel Fraud incident analysis Threat intelligence Fraud intelligence Fraud detection Preventing fraud and ensuring trust in online banking Customer information & awareness Internal Nordea training & awareness Fraud management Fraud operations Fraud protection Authentication Customer handling Agreement & Authorisation Fraud defense & controls Online Fraud Prevention Strategy

19 Swiss cheeze model Source:

20 The security dilemma Nordea is facing a fraud attack No immediate risk of fraud attack 20

21 Combined overview identifies advanced threats 10% 10% 30% 45% 45% 55% 60% 100% 21 03/11/2014

22 Example: Retefe Emmentaler 22 03/11/2014

23 Can we fight back? Customer event 03/11/2014 May

24 Svartholm Warg convicted in Denmark Nov 31: Pirate Bay founder sentenced to 3 and ½ year in prison for hacking by Danish court. Warg is already serving a 2 year sentence in Sweden for similar crimes. Minutes from court Aftonbladet

25 What can you (customers) do to prevent online fraud? 1. Updated software OS, Office, Flash, Java, Acrobat Reader, etc. 2. Anti-virus software and firewall 3. Focus on confirm 2-together for payment transactions 4. Deactivate unused online services 5. Use common sense to avoid social engineering 6. Consider asking for technical advice from security firms 25

26 /11/2014

27 Simon René Magnussen Andreas Havsberg