Online Banking Criminals Sentenced in UK

U.K. police are hailing the sentencing of four people who used a sophisticated Trojan horse program to siphon money out of online bank accounts. The men used a Trojan horse program called PSP2-BBB that executed a so-called man-in-the-browser attack when potential victims logged into online bank...

Citing Cybercrime, FBI Director Doesn't Bank Online

The head of the U.S. Federal Bureau of Investigation has stopped banking online after nearly falling for a phishing attempt. FBI Director Robert Mueller said he recently came “just a few clicks away from falling into a classic Internet phishing scam” after receiving an e-mail that appeared to be...

Online Banking Threats, Circa 1999

In this Dateline NBC video from 1999, experts, including an unnamed Chris Wysopal, then of the L0pht, now of Veracode, discuss the dangers of online banking and the use of Trojans to steal data. Everything old is new again...

Researcher Publishes Valid Wildcard SSL Certificate

In the wake of Moxie Marlinspike’s SSL talk at Black Hat this summer, another security researcher has used the technique described in the talk to create and publish a valid wildcard certificate and private key that could be used to fool browsers into believing a site is legitimate when it is in...

Hackers Using Custom Trojans to Hide Online Bank Thefts

Online criminal gangs have begun using special malware that enables them to hide the amount of money that they’re stealing from victims’ online banking accounts, helping them evade detection for longer periods of time and extend the effectiveness of their crime sprees. Using a banking Trojan call...

Modern Banker Malware Undermines Two-Factor Authentication

Once pitched as an additional layer of security for E-banking transactions, two-factor authentication is slowly becoming an easy to bypass authentication process, to which cybercriminals have successfully adapted throughout the last couple of years. Read the full story zdnet.com. Also see this MI...

New Security Standards for Mobile Payments Coming

From SC Magazine Angela Moscaritolo A financial services technology group is developing standards for making secure mobile payment transactions. The goal of the project, an effort of the Financial Services Technology Consortium FSTC, is to develop standards and processes so that banking customers...

New fake banking cert attacks in play

From eWEEK Matt Hines Researchers with security training experts SANS Institute have reported the emergence of a new wave of attacks seeking to take advantage of trust in online banking sites and digital certificate e-banking security programs. The involved attacks target customers of Bank of...

Frontline in phishing and online fraud still expanding

As some consumers play a growing role in the fight against online fraud and phishing, others need more education on the problem. That’s the bottom line from a panel discussion that included risk managers from Bank of America, JP Morgan Chase, and PayPal. Consider the experience of Bank of America...

Cambridge researchers slam banking card readers

The Register is reporting on a new study by Cambridge security researchers that show that card readers for online banking are inherently insecure. Researchers Saar Drimer, Steven J Murdoch and Ross Anderson found a number of serious security shortcomings after reverse engineering the underlying...

CVE-2009-0741

SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter...

Sql injection

SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter...

CVE-2009-0741

SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter...

CVE-2009-0741

An active CVE entry (CVE-2009-0741) describes an SQL injection vulnerability in Craft Silicon Banking@Home 2.1 and earlier. The affected component is Login.asp, and the vulnerability is exploitable via the LoginName parameter to allow remote attackers to execute arbitrary SQL commands. This is th...

CVE-2009-0741: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter...

Craft Silicon Banking@Home SQL Injection

Craft Silicon Banking@Home SQL Injection Author: Francesco Bianchino Email: f.bianchino at gmail.com Title: Craft Silicon Banking@Home SQL Injection Product: Banking@Home - Net Banking Versions Vulnerable: 2.1 and below Vendor: Craft Silicon www.craftsilicon.com Summary Banking@Home is an home...

Banking@Home 2.1 - 'login.asp' Multiple SQL Injections

source: https://www.securityfocus.com/bid/33721/info Banking@Home is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access ...

Banking@Home 2.1 - login.asp Multiple SQL Injections

Banking@Home 2.1 - login.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/33721/info Banking@Home is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could all...

SAP GUI 7.1 WebViewer3D ActiveX — Insecure Methods

Application: EnjoySAP, SAP GUI for Windows 6.4 and 7.1 Versions Affected: Tested on 7100.2.7.1038 PL 7 Vendor URL: Bugs: Insecure method, File owervriting Exploits: YES Reported: 02.07.2009 Vendor response: 02.07.2009 Date of Public Advisory: 28.09.2009 Author: Alexandr Polyakov Description SAP G...

CVE-2008-6006

Multiple PHP remote file inclusion vulnerabilities in Micronation Banking System minba 1.5.0 allow remote attackers to execute arbitrary PHP code via a URL in the minsoftpath parameter to 1 utdbaccess.php and 2 utgnmessage.php in utility/...