Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


RSA Upgrades Malware Defenses For Bank Transactions

Latest adaptive authentication technology adds new Trojan and man-in-the-middle defenses, plus risk assessment for ATM machine transactions.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
RSA, a division of EMC, Tuesday announced the release of the latest version of its adaptive authentication technology, which is used by banks to help spot and block unauthorized transactions or account takeovers.

The new version of adaptive authentication is already available for users of the on-premises version, while the new cloud-based version is due out Jan. 20. According to Amy Blackshaw, senior product marketing manager for RSA's identity verification and protection products, RSA counts about 70 out of top 100 U.S. banks as adaptive authentication customers.

The goal of most financial malware is to take over a target's bank account, allowing the attackers to transfer the money it holds into an account they control. "Account takeover is currently the single most important issue for our customers," said Manoj Nair, general manager for RSA's identity and data protection group, in a statement.

[ Read Fast Flux Botnet Nets Fraudsters $78 Million. ]

That's because the quantity of account-takeover attacks -- meaning an attacker has cloned an ATM card or stolen related details, perhaps including account access codes and PINs -- continues to increase. According to a survey of 100 financial service institutions released by the Financial Services Information Sharing and Analysis Center (FSISAC) earlier this year, and conducted by the American Bankers Association, account takeover more than tripled between 2009 and 2011. Respondents said they've helped address account-takeover fraud by pursuing customer education (for 92% of respondents), changing their multi-factor authentication system (67%), freezing a customer's account whenever anomalous activity is detected (59%), and modifying an existing multifactor authentication system to make it work better (50%).

To help businesses better spot account takeover attempts, the RSA adaptive authentication revamp includes better Trojan-detection features -- for example, to detect proxy attacks in which an attacker logs onto a bank site from a proxy IP address, rather than a verified IP address for the customer. The updated software also has new techniques for detecting HTML injection attacks, which attempt to make surreptitious transactions when a user is logged onto a banking site, as well as attempt to harvest additional user credentials, such as social security numbers and website PIN codes.

The updated software also includes "man versus machine" technology to guard against attack scripts that can be used to automatically add payees to accounts and automatically disperse money to outside, attacker-owned accounts. The software detects this in part by literally assessing whether mouse movements and keystrokes are being used to enter data, or whether the information is being entered by a script.

Finally, the software also can watch for man-in-the-middle attacks, which involve eavesdropping or substituting communications; as well as man-in-the-browser exploits, in which a Trojan application is used to infect a browser and intercept application calls between the browser and its security mechanisms or libraries.

One of the new adaptive authentication features involves risk assessment for ATMs themselves, in part to help spot and block money mule operations. These involve teams of criminals who apply stolen account credentials to faked ATM or credit cards, and then attempt to withdraw lots of money at once, sometimes covering multiple states in a single day.

"Something we've heard loud and clear, specifically from a lot of developing countries, is that fraud has migrated into the ATM channel," said Blackshaw, speaking by phone.

RSA's product can watch for geographical anomalies -- for example, a user is attempting to withdraw money from an ATM in a location never before visited -- as well as odd withdrawal amounts and frequency, or unusual date and time access patterns. "The way we're getting that data is through the batch files of the ATM, so we'd be doing a risk analysis on the card, the account, and the user behavior," she said. This type of analysis is designed in part to stop attempts by a criminal gang that attempts to withdraw money from many different locations in a short period of time. "In many cases, fraudsters use mules to transfer the money into a mule's account, and then in many cases the mules will go to an ATM to withdraw those funds," Blackshaw said.

For now, the ATM security tools only offer monitoring. "There's no inline blocking mechanism at this point," said Blackshaw -- unlike when adaptive authentication is used to assess website, portal, or mobile transactions.

On the mobile front, finally, Blackshaw said financial services firms can use an adaptive authentication API to send transaction information from the mobile app to an adaptive authentication server, which analyzes the proposed transaction using RSA's risk analysis tools, and then can either approve the transaction, request additional authentication from the user, or block the transaction entirely.

Looking for anomalous types of transactions also now can be done via mobile applications, and using Wi-Fi hotspot, cell tower, as well as GPS data to identify the rough geographic location of a user. Interestingly, RSA said it can also watch for whether multiple transactions involving the same account are being made from geographic locations that a user wouldn't have been able to traverse in the intervening time.

Faster networks are coming, but security and monitoring systems aren't necessarily keeping up. Also in the new, all-digital Data Security At Full Speed special issue of InformationWeek: A look at what lawmakers around the world are doing to add to companies' security worries. (Free registration required.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file