September 2005 - NZNOG - lists.nznog.org

Re: [nznog] New phish - Westpac
by Nic Wise 20 Sep '05

20 Sep '05

> BNZ tried using certs in 2000 for IB for public - was a > nightmare - far too early for browser compatibility usual > portability of certs etc. Ah, I might have had my banks mixed up. > And of course, and this will come > as a surprise to some, certs aren't very good for > authentication remember - their power in is in persistently > marking transactions/data or whatever That BNZ system was > tried to get round key loggers but as you say anything that > needs specific machine setups/configs will fail for retail > banking. And there are screen grabbers now anyway. Oh, I found that even without the threat of phishers etc, the pain of using it (Even after I installed Java) was just too high. > 2-factor also does not solve the problem and can introduce > more. Netcode relies on a now-defunct, unsupported product > from RSA - it was dropped from the RSA product line due to > the issues with SMS delivery and security - ask yourself how > secure the SMS network is, would you know, do you know ? I Well, personally, I'd find it more secure that not having it at all. Without something like it, anyone can get in with my username + pwd. With it, atleast if they ALSO intercept my cell transmission, they can get it for what, 10 mins (assuming they have my UN+PW as well). That's a fairly small window, and better than the current situation. > would be more concerned about that than anything. Also, the > banks cannot control SMS delivery nor guarantee anything and > therefore don't like it. 2 factor is relatively complex to > manage in big deployments, expensive (relatively compared to > a password) and probably overkill for retail but spot on for > business - which of course you'll know has been used in for a > number of years now by most banks.... I think ASB got around that by having something in there saying "if you don't get the text within X mins, call us on 0800 WHATEVER, quote ID 123456 and we'll check your details like we normally do". > Remember though - you can use a computer - most people who > use retail Internet Banking can't - IB is the pinnacle of > their PC knowledge VERY good point. Smartcards + reader look interesting, but there again - hardware compatability. Does it works on a Mac? Does it work on my mothers old P166 without USB? Etc. > And anyway banks don;t make any money from retail banking so > until phishing and e-banking scams become sufficiently common > they still pale in comparison to manual frauds. The real > answer is to remove some functionality but of course we'd all > moan...Free beers for life for the person that cracks the > portability vs security conundrum ! Very true. As long as they keep refunding people when they get all their money nicked, it's not THAT huge a long-term problem. Short term, and for the person who's cash is (for a while) gone, it's a bit of a stresser. :) Good discussion to have, me thinks, especially given the types of people on this list. :) Now, lunch and Beer :) Is it Friday yet? N

1 0

Re: [nznog] New phish - Westpac
by Nic Wise 20 Sep '05

20 Sep '05

> I'm not a application Security expert, but why can the banks > issue a authentication Certificate, and only allow > connections to those who are authenticated? > Certs would help, but they are a PITA to get working reliably. I know of one place that does use them (www.vir.co.nz - only for dealers) - but Banks are very much mass-market, and mom-and-pop would have a lot of troulbe working it out. I think one of the banks (ANZ??) tried it a while back. Not sure what they use now tho. The worst I have used was BNZ - they had a Java applet, and you had to CLICK on your password, on a keyboard on the screen. Wow, how secure, if someone is shoulder surfing, or capturing mouse clicks. And, it was just crap to use, especially if you didn't have Java (you just couldn't get in without Java!) 2-factor authentication is one of the few ways they could tighten up on security. ASB already does this, to some extent, with NetCode (ditto BankDirect - same company tho). They send you a text to confirm (you have to enter the code in the text) if the amount is over a specific value ($2500 per day). Works great. Why not do it on ALL transactions under a certain value (eg, $50)? Want to log in and check accounts? Fine. Usename + password. Want to move money? You then MUST use 2-factor authentication. I'd say that 99% of people with computers, also have cellphones, so text messages is a good way. Going overseas? Get one of those fancy SecureID cards on loan. I'm SURE that a load of people on this list know those cards - credit card sized "random" number generators on their keyrings. Same idea could be implemented for LESS cost than the banks usually loose.... Of course, the banks have to be motivated to do it.... And they are not, really, at the moment. It might still give the phishermen entry, but only within a VERY small window (60 seconds to 5 mins, usually), which would solve most of the problems. Of course, you'd need to sync it up with the Beer Tap at the pub somehow..... Maybe give the "keys" away free with every pint sold? Righto. Back to work :) Nic -- Nic Wise - Senior Developer - Microsoft MVP (.NET) t. +64.21.676.418 w. http://www.aftermail.com/ e. nic.wise(a)aftermail.com b. http://www.fastchicken.co.nz/blog/

4 4

Re: [nznog] New phish - Westpac
by David Robb 20 Sep '05

20 Sep '05

On Mon, 19 Sep 2005, Jeremy Strachan wrote: > > Given the alternative is our users bank accounts being cleaned out - I'm > all for Telco and/or ISP's blocking access to the site. So you say it's ok for bank phishing. What about ebay/trademe/other auction/sales sites? What if it were for Live Journal? --David

15 20

Notification of NZRR Database changes
by NZRR Database Notifications 19 Sep '05

19 Sep '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS23655 descr: advertised to AS9439 by Snap Internet Limited - AS23655 members: 132.181.0.0/16^16-29, 202.124.96.0/19^19-29, 203.97.28.0/22^22-29, 202.27.186.0/23^23-29, 202.36.178.0/23^23-29, 202.36.218.0/23^23-29, 202.37.100.0/23^23-29, 202.37.124.0/23^23-29, 210.55.30.0/23^23-29, 210.55.206.0/23^23-29, 192.156.225.0/24^24-29, 202.50.117.0/24^24-29, 202.50.169.0/24^24-29, 210.54.15.0/24^24-29, 210.55.4.0/24^24-29, 210.55.7.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)snap.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050913 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS23655 descr: advertised to AS9439 by Snap Internet Limited - AS23655 members: 132.181.0.0/16^16-29, 202.124.96.0/20^20-29, 203.97.28.0/22^22-29, 202.27.186.0/23^23-29, 202.36.178.0/23^23-29, 202.36.218.0/23^23-29, 202.36.220.0/23^23-29, 202.37.100.0/23^23-29, 202.37.124.0/23^23-29, 202.49.120.0/23^23-29, 210.55.30.0/23^23-29, 210.55.206.0/23^23-29, 192.156.225.0/24^24-29, 202.49.115.0/24^24-29, 202.49.125.0/24^24-29, 202.50.117.0/24^24-29, 202.50.169.0/24^24-29, 203.96.112.0/24^24-29, 210.54.15.0/24^24-29, 210.55.4.0/24^24-29, 210.55.7.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)snap.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050920 source: NZRR

1 0

Price list from kevin
by Kevn Wong 18 Sep '05

18 Sep '05

Dear sir, How is your weekend? I'm kevin from Pcarcher data Technology Ltd. We are a manufacturer and Exporter from china, we make and sell the VGA Card and networking products. We have our own factory, the factory are with 4 STM product line, and all products go out the door of factory after double QA and QC, so we can deliever the goods to our client within 4 working day after we get client's payment, and we can supply 13 months warranty to our client, hope that we can do the business with you, I believe we will become your good supplier, and supply the best products and service to you. Enclosed is our price list of these products, please check it, hope that you can find some you products which you like, looking forward to hearing from you again, anyways thanks for your support. My msn is w_qifan(a)hotmail.com. Cisco 1721 US$300.00/Pcs WS-C2950-24 US$310.00/Pcs WS-C2950T-24 US$450.00/Pcs 2610XM US$700.00/Pcs 2620XM US$710.00/Pcs 2621XM US$710.00.Pcs BTW now we have the DI-524 and DI-624 in stock, they are original products, and our offer are follows, please check it. DI-524 US$29.0/Pcs 54Mbps http://www.dlink.com/products/?pid=316 DI-624 US$40.5/Pcs 108Mbps http://www.dlink.com/products/?pid=6 Have a nice day Best Regards Kevin Pcarcher Data Tehcnology Ltd Room 2106, BaoAn Plaza, ShenNan Road,Shen Zhen City,China Tel: +86 755 82818860 Fax: +86 755 82818640

2 1

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> > Phising is no different to putting a skimmer and camera onto an ATM > machine and stealing the card details and pin numbers. Infact, how many of you check for skimmers and cameras before putting your card into an ATM or make sure the clerk behind the desk doesn't skim your credit card before giving it back? I would say not many people would. How is that any different from an average internet person and a phising website?

1 0

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> > You will need to come into the branch and do it there. > > > > If you do follow links and get stung then we'll treat it along the same > lines > > as "so you met this guy in a pub and he said 'can I borrow your ATM card > and > > pin number for ten minutes'.....". You can't compare a Phising site to that. The user doesn't know they are entering details into a trojaned website. Phising is no different to putting a skimmer and camera onto an ATM machine and stealing the card details and pin numbers.

1 0

Re: [nznog] New phish - Westpac
by Joel Van Velden 18 Sep '05

18 Sep '05

> >> >> Wait until the phishers catchup with the normal spammers and make the > IP >> of their websites move every 10 minutes. Personally I'm surprised it >> hasn't happened already, certainly it will happen if people get > efficient >> at blocking single IPs. > > That's why it's better done at the ISP level. > > If they have web caches which transparently proxy everything. (dunno how > many isp's still do this). But the URL itself can be blocked rather than > the IP. > > Carriers shouldn't block IP's IMHO. Can't ISP's just intercept http traffic destined for phishers' sites (based on url matching, not ip) and display a nice html message to the user how their bank account would have been cleaned out if it hadn't been for their nice friendly isp? :) Certainly blatantly blocking ip's at carrier level is rather nasty. what happens if that IP is a large virtual host server? Replacing content (as above) at least allows you to make it obvious to all users whats happening. -Joel > > Simon Allard > ihug Limited > > P +64 9 962 9827 > M +64 21 456 412 > E simon.allard(a)staff.ihug.co.nz > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

2 1

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> I don't buy this line of reasoning any more. Don't open attachments > from people you don't know. Don't open attachments from people you do > know. Don't open attachments that have innocent looking icons like a > text file. Don't preview emails that have attachments. Now we're in an > arms race where trying to send any email attachments around the internet > is a sure fire way of getting someone to blackhole your entire email for > "malicious content"[1]. Even experienced users running around with all > the latest antivirus and ad zappers and everything can *still* > occasionally get infected with spyware.[2] How do you expect users to > keep up? I agree with this comment. If user education worked, ISP's wouldn't be hit with high call volumes when the big viruses hits. ISP's wouldn't need to have big virus/spam servers in front of their mail farms. Too many stupid users, and when those stupid users become educated, there are new stupid users who take their place. It's a never ending cycle. Every time a user rings the helpdesk, it hits the ISP's bottom line, hence why a lot of ISP's are in favour of blocking phising/virus ports etc. But I don't understand why carriers block stuff. Simon Allard ihug Limited P +64 9 962 9827 M +64 21 456 412 E simon.allard(a)staff.ihug.co.nz > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] New phish - Westpac
by Gordon Smith 18 Sep '05

18 Sep '05

It's a typical spammer setup that's using zombies to provide DNS. Makes it more difficult to shut them down. The web server is located in India. We've already notified them of the compromised host, and also asked joker.com to pull the domains. Both this domain, and the domains that the nameservers respond to, are bogus. I'm not going to hold my breath waiting for joker to act though :-) Cheers, Gordon

5 5