WTF would ANYONE buy a WIn 7 PC?

You left out 'Gilligan's Island'. ;-)

Nice. ;-)

That's also why banks have nice new brick buildings. Who would put money in a run-down tenement building? I'm amazed at the buildings CUs have, too.

On a sunny day (Fri, 30 Dec 2011 14:11:58 -0800) it happened Joerg wrote in :

Well, I can make a login site that *I* cannot even tell from the real thing. Then add a text like: "For enhanced security against cyber attacks we regret to have to ask your an extra time for the TAN. Please enter TAN 4"

Sometimes the spelling so so bad that it sets of alert with people... but some are better than the original perhaps. You may think: Oh 1 TAN, and I already used 4, maybe. Now consider 1 million people hitting that site, logging in with their user name and password, entering TAN 4. Some will be a hit... Ten minutes later that account is empty, and worst: YOU have dunnit.

Hey I should not teach script kiddies here ...

DNS .. it means if you type '

If somebody can send you the right virus it can make your system go anywhere they like upon you entering a URL. In Linux it would modify /etc/hosts, in MS windows probably some other file that does local translation. Those files are read first before the PC goes asking the name servers.

From this follows that perhaps you are safer hardcoding the banks IP, but that may also cause problems.

Actually, all the transactions they called me about where indeed somewhat unusual for my pattern. So they are definitely watching stuff.

My bank is in a wood frame building. The safe deposit box safe is right behind a wall, close to the street. Sometimes I wonder how fae it is if a tanker truck ...

That's where some stuff is that can be hard to replace, like birth certificates, masters degree, data backups and so on.

extra time for the TAN.

Again, how does this rogue site know the balance in my account?

Can they hack into an https site?

network.

If you have a trojan on your PC then it can make you go where they want. However, they still need your account details, such as the balance in the account (at least roughly).

Nope. There are trojans that WATCH what you do on your PC INCLUDING visiting your bank account, then they can clean it out because YOUR activity is what they observe.

They do not have to "make you go where they want". Nor can they. What a dumb remark.

On a sunny day (Sat, 31 Dec 2011 08:16:44 -0800) it happened Joerg wrote in :

No, its the 'man in the middle' attack. OK I think it is common knowledge here it goes:

Its simple, it a classic, its been done, it will be done. That TAN system is not secure against man in the middle attacks.

There are no 100% secure sytsms, but this one is really insecure.

trojan or whatever

address, but to 110.11.112.113

copy).

script running

pasword,

alien place.

please enter TAN NN"

other account.

Ok, but how is the trojan going to do that with a https link? It can probably be done somehow but is a lot harder. Plus my antivirus would probably catch a redirect. It even stops sites that do that internally.

Explain how they'd do that for a bank that requires TAN entry if the hackers do not have the TAN sheet.

trojan or whatever

address, but to 110.11.112.113

copy).

script running

pasword,

alien place.

please enter TAN NN"

other account.

I operate a little util I wrote that can scan the list of hooks present on the system that can view your screen and keyboard activities.

I've never had banking issues however, I have had some software that did try to install a hook. And most of this software had nothing to do with needing to install a keyboard hook, let alone attempt to hook into some DLL's that get used system wide. I also watch for that too.

It seems that not all virus tools capture that because these programs normally pass the user test as being accepted.

I've found most of this behavior in shareware programs and open source projects where some DLL code is used but no source code supplied for some functions. Hence the reason of being careful when using uncontrolled third party libs.

It is always good to pop up your network and resource monitor tools to take status on your PC.

The latest trick was that "Shop to Win" shop ware tool bar that got installed on my new PC, because I accepted to install a open source 7z tool. These little qute programs were packaged together with the installer for the 7z program.. I don't do any banking on my new PC yet.

Something to be aware of when down loading items from high volume add sites. This one came from a site with heavy CNET on it.

jamie

risk,

All but the data is fairly easily replaced (I may even have a copy of my diploma in a box somewhere). Data should be spread across several locations, if you're that worried about it.

Don't count on it.

risk,

Kind of tough with a birth certificate :-)

Of course not 100%. It's like safety belts, airbags, anti-lock brakes and so on. Together they provide quite a lot of safety but they cannot be a 100% guarantee that you will never be harmed in a crash.

Things like TAN provide a pretty strong extra safety layer onto an otherwise rather shallow "safety" net.

te:

te:

t of risk,

draft

dunnit

redit

rd

ay

the

le

ery

they

en I

nows,

money in a

too.

cations,

How much *does* Germany charge for a replacement birth certificate, anyhow?

risk,

in a

No idea, generally such things are not very expensive over there. However, for those who had been born in the former East Germany this could turn into a major hassle.

It's mostly the hassle factor. Government agencies are not known for speed. I've have had cases where a rather simple act, maybe 5-10 mins of work, was estimated at "It'll take 6-9 months". Sometimes years. That was here in the US.

risk,

in a

Nope. They're available where you were born. You were born? ;-)

risk,

dunnit

in a

locations,

More like two minutes.