The soul-destroying consequence of losing a business payroll account

Part 2


There's no Hurricane Katrina fund, no 9/11 trust for business banking victims. Instead of the sudden shocking yet galvanizing crash of a jet into a building, this malware-based attack comes as a slow, stealthy shadow creeping into the already bleak landscape of the jobless.

If a business owner lost their funds overnight, I imagine it might go something like:

■Day one: Shock. Could this really be happening?

■Day two: Fight the bank. And lose. Again, is this really happening?

■Day three: Find a new job so your family can sustain itself. And good luck with that task if you were part of the IT team who missed the malware which stole the banking funds!

Brian Krebs has interviewed many victims whose stories are similar:

“Since the incident, [Michelle Marsico] has had to take out a $395,000 loan at 12 percent to cover the loss (she managed to get $70,000 in wires reversed).

“I'm working for nothing right now, and can't afford to pay myself,” Marisco / [Marsico] said in a phone interview.

Without small business providing new job growth it's arguably a nuclear winter for our economy.

This must stop

1.Business owners are completely in the dark about this threat.

2.The critical priority must become identifying the threat of cybercrimes that soul-kill our communities: FinCEN and other aggregators of financial crime reporting need to step it up and show the data more transparently.

3.There are no laws which require protection for payroll accounts and the ABA, after saying how safe online banking has been for years now doesn't seem to want to budge from their position of the business' sole responsibility for compromise.

A recent interview was held with American Banking Association Vice President and Senior Advisor of Risk Management Policy Doug Johnson who, after agreeing that the threat of corporate account takeover was “very large”, pushes responsibility right back at the business, not with the banking community for prevention and risk.

““Banks have a tremendous responsibility to protect their small businesses and municipal customers just as they have that responsibility to protect their retail customers.

But the retail customer protections of Reg E would essentially absolve the small businesses of any responsibility or liability for not properly protecting themselves, and you can certainly appreciate that in a community bank market it is very difficult for a financial institution, through no fault of its own, to really make a corporate customer whole for a loss which could be upwards toward a half of million dollars.

“And there would be less incentive on the part of the corporate customer to protect themselves if they knew that they were going to be made whole in that fashion, even if they didn't protect themselves.”

Five years ago, Doug Johnson was saying something very different:

“"Online banking is safe and getting safer," says Doug Johnson, senior policy analyst at the American Bankers Association.” (USA Today, 2005)

2009 APWG Thought Leader Dr. Laura Mather states that dual control for small business accounts is a good practice for businesses to follow since it raises the bar for criminals, however she feels that it is unlikely that all businesses will implement dual controls and worse, that the tactic has a limited shelf life against faster cybercriminals.

““Banks should be educating their business customers to use this technique,” Dr. Mather adds, “and possibly implement measures that enforce the requirements for dual control. The next obvious step for cybercriminals will be multiple infections within a business such that the criminal has access to both of the dual control accounts.”

“As for the ABA party line – I think with the litigation that is moving forward there will soon be legislation around the SMB accounts. Of course, when that happens, all banking organizations will likely have to change their stance on these issues.”

Her words are prophetic: I found a story about the banking trojan compromise of the ABA-recommended dual control method right in our own SoCal backyard which Brian Krebs wrote about a few weeks ago:

http://krebsonsecurity.com/2010/06/e-banking-bandits-stole-465000-from-calif-escrow-firm/

““Owner Michelle Marisco said her financial institution at the time — Professional Business Bank of Pasadena, Calif. – normally notified her by email each time a new wire was sent out of the company's escrow account. But the attackers apparently disabled that feature before initiating the fraudulent wires.”

“The thieves also defeated another anti-fraud measure: A requirement that two employees sign off on any wire requests. Marisco said that a few days before the theft, she opened an email informing her that a UPS package she had been sent was lost, and urging her to open the attached invoice. Nothing happened when she opened the attached file, so she forwarded it on to her assistant who also tried to view it. The invoice was in fact a trojan horse program that let the thieves break in and set up shop and plant a password-stealing virus on both Marisco's computer and the PC belonging to her assistant, the second person needed to approve transfers.”

Steps you can take:

In keeping with how to protect yourselves and your business here are the top things to do today to harden your business target:

1.Update your endpoint malware protection and ensure you have an antispam solution which will block phishing attacks which use spam tactics to reach their victims.

2.Plan and complete a US-CERT risk assessment,

3.Plan to audit your business accounts DAILY from a secure computer. Don't rely too heavily on email alerts – the latest malware disables them.

4.Raise awareness in your own back yard. Start the discussion.

One final step would be to sit down and have a formal review with your bank of the responsibilities involved with an account hijacking and quite frankly, if you don't like what you hear, vote with your feet and consider changing your approach to online banking or changing your bank.

We're still on the search for definative bank account hijacking statistics. Once we get them, you'll be the first to know.

Loma Linda University Medical Center

Loma Linda, CA May 3, 2010 - A thief has stolen personal information regarding more than 500 surgical patients of Loma Linda University Medical Center, according to hospital officials. A desktop computer containing the information disappeared April 5 from the department of surgery's administrative office on Campus Street. The missing information includes each patient's name, medical record number, diagnosis, surgery date, and the type of procedure.

Computer theft raises fraud concern at Cal State L.A.

Cal State Los Angeles has notified 232 former students that a computer stolen from the mathematics department office last month may have contained personal information such as their Social Security numbers and grades.

While officials said they did not know whether the information has been used for any attempted fraud or identity theft, they said they told the former students to notify credit bureaus and law enforcement about any suspicious activity. A toll free number, (800) 883-4029, has been established to provide additional information. latimesblogs

Computer containing students' Social Security numbers taken from Bloomsburg University office

Bloomsburg University is notifying students and alumni who were enrolled in Julie Kontos' psychology classes from 2004 to 2006 about the possible theft of their Social Security numbers after a laptop was stolen from a campus office.

On Nov. 1, several computers and small digital devices were stolen from offices in Centennial Hall. One of the missing devices is a laptop used by Kontos, interim dean of the College of Liberal Arts. University police are investigating the theft.

On Nov. 4, it was determined the laptop's hard drive contained student rosters for psychology classes Kontos taught from spring 2004 through summer 2006. The rosters included student grades and Social Security numbers which, at that time, were used as student identification numbers. The university replaced Social Security numbers with alternate student ID numbers in fall 2006.

"We have identified and are in the process of contacting all of the 574 students who were enrolled in Professor Kontos' classes during that time period and alerting them to what has taken place," said Wayne Mohr, assistant vice president for technology. "We are encouraging them to sign up for free credit monitoring with one of the three major credit bureaus to watch for any suspicious activity." Citizens Voice