Bank account fraud

[clearedforlanding]

Performing any form of authentication based on the ICCID of a SIM (technically a UICC these days) card (other than pairing of an MSISDN with it for authentication with a mobile operator as they bear the risk) is a very silly idea.

Many sims are still using DES and as demonstrated by SRlabs around 3 years ago. Additionally cards using 3DES manufactured by Gemalto have been shown to have been revealed to be compromised, their Si's were stolen by the usual suspects, namely GCHQ & the NSA.

Any OTT application should implement it's own security based on open standards. Relying on ITUT & ETSI standards is a no go. The Natwest implementation was shoddy and built on technology they did not understand.

A 4G BTS, BSC through to HLR & full BSS/OSS can be assembled in a backpack, just like an 802.11 BSS can be assembled to spoof BSSIDs & ESSIDs.

(The entire point of this post is acronyms to irritate Darmstadt)

[NickFitz]

Its a 2014 article but I doubt much has improved and for those of you that like to use secure ultra long passwords using password1 the sodding thing uses clear text over the loop back interface because they couldn't figure out how to do key exchange/storage properly

https://medium.com/@rosshosman/1pass...389#.bl1lwht3y

If somebody has access to your computer's loopback interface, they've already pwned you and your computer. You might as well complain that your keyboard sends your password keystrokes in cleartext across the USB interface.

And it's not as simple as "how to do key exchange/storage". The company that make 1password have already addressed this subject in a detailed blog post from last June: https://blog.agilebits.com/2015/06/1...on-discussion/

But that's not quite as trendy as a clickbait headline on Medium

[DimPrawn]

Can someone please summarise all the crap in this thread?

In terms a Daily Mail () reader could understand, how do they nick the phone details, hijack the phone, gain access to the bank account etc?

Nationwide has a security dongle you have to put you debit card in + pin to generate a secure number if you want to move money out. I don't have or use a phone for banking (sounds like a bad idea to me).

[BrilloPad]

Email scam costs couple £25,000 – but no one will help | Money | The Guardian

[SueEllen]

Email scam costs couple £25,000 – but no one will help | Money | The Guardian

Nope that wasn't his scam.

[bobspud]

If somebody has access to your computer's loopback interface, they've already pwned you and your computer. You might as well complain that your keyboard sends your password keystrokes in cleartext across the USB interface.

And it's not as simple as "how to do key exchange/storage". The company that make 1password have already addressed this subject in a detailed blog post from last June: https://blog.agilebits.com/2015/06/1...on-discussion/

But that's not quite as trendy as a clickbait headline on Medium

The difference is when they get at your machine Rapport (if you are using it will prevent a key logger recording your strokes) but now if they get on all they need to do is tcpdump your loopback and all the data will float past at some point in time...

[OnceStonedRose]

Missus noticed a few payments from her account for ITunes billing, she doesn't have ichewnz so rang the bank, RBS, and no questions asked, as soon as she said that just said we'll refund immediately. This sets alarm bells off with me, for them to not even question must mean they have been done many many times recently, made me windrr if they've misplaced customers details or something.

[Dactylion]

Can someone please summarise all the crap in this thread?

Suity is a muppet.
Suity is a well meaning and well intention muppet.
Suity was out of his depth.
Suity had heard of some trendy stuff so posted that he'd done some trendy things.
It was pointed out that Suity was a muppet - and because he didn't really understand the trendy stuff he had done, he hadn't really done what he thought.


Just a typical Suity tale of woe
hth

[DimPrawn]

Suity is a muppet.
Suity is a well meaning and well intention muppet.
Suity was out of his depth.
Suity had heard of some trendy stuff so posted that he'd done some trendy things.
It was pointed out that Suity was a muppet - and because he didn't really understand the trendy stuff he had done, he hadn't really done what he thought.


Just a typical Suity tale of woe
hth

Thought so.

Next week, Suity finds a cure for cancer on his humble Raspberry Pi.

[cojak]

And more crappiest bank Natwest security news If NatWest texts you about online banking fraud, don't click the link • The Register

How the feck did they obtain those mobile numbers?