They shut down their whole Internet banking site because of a phishing email ! I would have thought that was somewhat of an over reaction. That would sure annoy me if I happened to be one of their customers. Simon Lyall wrote:

On Thu, 8 Dec 2005, Steven Heath wrote:

...

http://www.nzherald.co.nz/section/story.cfm?c_id=5&ObjectID=10359020

Another internet banking scam is doing the rounds.

This time Kiwibank customers are the target. Emails pretending to be from the bank were sent out early this morning. They contain a link to a site which looks official.

I note that the IPs ( 4 A records listed for www.thedomain.com [1] ) has changed at least twice this afternoon and appear to be hosted with Zombied machines. People who say we should just block the IPs please take note.

Actually I just noticed that "www.kiwibank.com" is owned by somebody who is currently forwarding it to the real kiwibank site.

Kiwibank have a note up:

http://www.kiwibank.co.nz/news/security_notice.asp

[1] - Domain not mentioned since some after filtering it.

On Thu, 08 Dec 2005 16:34, Tony Wicks wrote:

They shut down their whole Internet banking site because of a phishing email ! I would have thought that was somewhat of an over reaction. That would sure annoy me if I happened to be one of their customers. I agree, i thought it was somewhat of an over reaction. considering first reports of these emails was early this morning and they didnt take the banking down till mid afternoon or so.

And yes its really annoying, thank god for txt & phone banking :) Liz -- Cesarean Section: A historic district in Rome.

Jeremy Brake said:

Well.. actually.. Kiwibank's internet banking seems to often be down during the afternoon (*mumble*). Are you guys sure they took it down specifically for that? or was it just (an annoying) coincidence? Then again, the fact that its down at all, regardless of the reason is pretty lame. Someone should take to the admins with a mallet or something.

No, they took it down on purpose. The NBR has published a very detailed article on the event. From http://www.nbr.co.nz/home/column_article.asp?id=13760&cid=3&cname=Technology [url may wrap] : "This afternoon it became apparent about five customers may have followed the instructions from the scam and compromised their bank account details "Kiwibank is working directly with those known to have been affected and this afternoon shut down its Internet bank transaction site as a precaution. and you've really got to wonder why. The phishers could surely save the passwords and use them when the site comes up, so the bank annoyed their customers and has potentially given people the impression that the phishers/hackers had managed to take the site down. Maybe temporarily blocking access from international IP addresses would have been a better solution. -- Kerry Thompson, CCNA CISSP http://www.crypt.gen.nz

On 9 Dec 2005, at 9:27 AM, Kerry Thompson wrote:

"This afternoon it became apparent about five customers may have followed the instructions from the scam and compromised their bank account details

"Kiwibank is working directly with those known to have been affected and this afternoon shut down its Internet bank transaction site as a precaution.

and you've really got to wonder why. The phishers could surely save the passwords and use them when the site comes up,

Why? Bank discovers some customers have handed out their details to the phishers. Bank says "Hrm, some customers have given out their login details. We're not quite sure which customers, but we're know some have. How about we turn off the site so that aforementioned customers don't lose money, even if it inconveniences many customers in the short term, it could prevent us from being ripped off." So, now no one can login, bank finds out who's handed out their details, probably by sheepish customers calling and saying "My bad". Aforementioned customers' login details get changed. Bank turns site back on. Later, the phishers say "Ooh look, phished details! Ima be rich!" They try to login. Oh dear, the details have been changed. No more money for the phishers. _That_, is why. OK, so maybe if the bank knew immediately WHO had been affected, they could just turn off individual accounts, but I'd hazard a guess that this wasn't the case. Is it too early for a beer? Cheers Michael