Sicherheitsexperten warnen vor Banken-Trojaner

Sollte das Thema nicht mit dem iTAN-Verfahren erledigt sein? Zunächst müsste der "Man in the middle" eine gültige iTAN-Anforderung generieren, und selbst dann müsste bei einer späteren Transaktion des Angreifers auch die entsprechende iTAN von der Bank angefordert werden. Der Erfolg so einer Transaktion grenzt schon an homöopathisch kleine Wahrscheinlichkeiten. Oder gleich das HBCI-Verfahren - teurer aber sehr sicher.
Gruß
Christoph

This Symantec warning shows how banks are still open to man-in-the-middle attacks, as fraudsters constantly look for new ways to break in. However, there are solutions available to protect online banking users against these types of attacks. CAP (Chip Authentication Programme) devices can be used to secure not only the individual but also the transaction through two-factor authentication. The problem is that not all banks are using such mechanisms particularly for high risk transactions such as payments to new beneficiaries. These Trojans can be defeated as long as banks have in place sound prevention (such as CAP devices) and detection strategies (such as risk management solutions which can help bank quickly identify fraudulent activity).

This is not the first reported incident of this nature and will certainly not be the last. Consequently, banks need to ensure they remain one step ahead of the fraudsters by putting in place comprehensive anti-fraud strategies.

Johann Praschinger, Director Central Region, ACI Worldwide