We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
‘Man in the browser’ is new security threat to online banking

‘Man in the browser’ is new security threat to online banking

New form of intercepting user access details

Article comments

Hackers infecting PCs with malware that is only triggered when they access their bank accounts, is the latest threat to online banking, according to security software supplier F-Secure.

Hackers are acting as a ‘man in the browser’ by intercepting HTML code in the web browser. As bank security measures are curbing more traditional threats such as keystroke logging, phishing and pharming, F-Secure warned the 'man in the browser' attack will increase.

Once a user's PC is infected, the malicious code is only triggered when the user visits an online bank. The 'man in the browser' attack then retrieves information, such as logins and passwords, entered on a legitimate bank site. This personal data is sent directly to an FTP site to be stored, where it is sold to the highest bidder.

Security products using behavioural analysis were the best solution against such attacks, because the malware was only distributed to the users of specific banking sites, said Mikko Hypponen, chief research officer at F-Secure. This meant anti-malware software vendors were unlikely to be able to quickly release codes to tackle all the new threats.

Following the enhancements that banks have made to authentication on their websites, “phishing attacks are becoming less and less effective and attacks of the 'Man in the Browser' are set to increase", he warned.

Now read:

Malware spammers pose as private eyes

UK is online banking laggard – Forrester

RSA 2007: Banks still struggling with IT security

Banks deny chancellor's claim that they delayed HMRC data announcement

Share:

Comments

Advertisement
Send to a friend

Email this article to a friend or colleague:


PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.


ComputerworldUK Knowledge Vault

ComputerworldUK
Share
x
Open
* *