Sophisticated Attacks on Community Financial Institutions Increasing!

By Gale Yocom

Copyright2007

In today's' high tech world, maintaining the privacy and protection of customers and employees' information grows more and more difficult particularly for many financial institutions. These days' scammers are getting bolder and more brazen in their abilities to get personal information from banking customers as they aggressively target the smaller locally owned community financial institutions. In fact, a recent customer reported a complex, malicious, and targeted attack took place on their institution's customers and employees. A well-recognized phishing activity trends website reported that financial institutions saw a continuing rise in phishing activities with 92.5% of attacks targeted on financial institutions. On average, a phishing site stays online for 3.8 days. The relevance to the number of days online is that the longer it remains online, the more possibilities for the scammer to gather personal information. It is imperative that we are prepared for this type of incident and the response that is needed.

Phishing and Pharming Attacks

There was a time when only the larger financial institutions such as Wells Fargo bank were targeted for phishing and pharming scams, but that's no longer the case. The increase in phishing attacks on community financial institutions stems from the fact that smaller financial institutions are simply more profitable and are usually less protected from fraudulent activities. As mentioned above, one of our local community financial institutions was hit with a complex and sophisticated vishing/pharming/phishing telephone scam that focused on customers as well as on the bank's employees. Fortunately, we have been preparing our client for years for these types of attacks, and therefore they were on the alert, so the attack caused minimum disruption. Sharp customers and employees recognized that the e-mail messages were a scam because of poor grammar and content in addition to the salutation being addressed to "member" or some other non-descript person. A genuine message from a financial institution always addresses the customer by their full name. Furthermore, the scams did not provide a means for contacting the institution if there were any questions, but instead told the customers and employees in the e-mail message not to reply. No legitimate institution would ever tell you not to reply. But even with preparation and after years of working in the Internet security arena, we were surprised at the combination of attack vectors used.

Combination of Attack Vectors

The scammers' used a variety of strategies starting with a mass email and pharming scam as an attempt to steal personal information using a Do-IT-Yourself Phishing kit. The initial attack was then followed up with telephone calls to certain area codes with spoofed numbers and using a technique called Vishing. Besides, using pharming, phishing, and vishing tactics aimed at stealing valuable information such as credit cards, social security numbers, IDs and passwords, the attackers didn't stop there. The scammers also included Spear Phishing, an email spoofing fraud that targets financial institution employees in an attempt to gain unauthorized access to confidential data. Because of the banks watchful eye, they caught it in time, but these types of attacks are getting bolder and more commonplace and require a great deal more vigilance in keeping personal information away from scammers.

Why Customers Are Fooled

Approximately 19% of recipients respond to Spear-Phishing, which today is one of the most menacing threats to Internet users. Unfortunately, users do not clearly understand the importance of checking for authenticity, which should include specific indications that the site they are being sent to is secure. As a busy society, we are so focused on getting the job done quickly and efficiently, we often don't check for important clues, which is why many users receiving messages or paying bills online don't watch out for the clues that indicate whether an e-mail message or site is fraudulent.

An Incident Response Plan

As these scams are on the rise in financial institutions, if a financial institution is prepared, and in today's world, they have to be, the consequences will be minimal. In the event of phishing and pharming scams, staff members in a financial institution should know how to deal with this type of situation effectively. To ensure the customer's safety and privacy, an incident response plan should be in place and is required by examiners to be in place. Included in the plan should be an organized approach as to how the problem is going to be handled as well as having a clearly laid out plan to address the situation.

The following should be considered in regard to an Incident Response Plan:

• Start by assessing the situation so that you know exactly what your bank is dealing with; if an incident has occurred, it's usually up to the CEO and CIO to handle the overall incident response along with members of a CSIRT.
  

• Fight the attacker
  
  • Educating the end user
    
  • Redirecting pharming clicks to an education page (most attacks are pulling images from your site)
    
  • Attempt to shut down the phishing site yourself
    
  • If needed have a competent vendor to respond to the situation for counter attack; this helps identify who will take down the website as well as which agencies to contact.
    
  • Exploit the phising website
    
  • Communicate with customers
    
    • Post Bulletins on Website to ensure customers are aware of the situation
      
    • Have employees assure customers that security controls are in place for the institution.
      
  • Contact authorities such as Secret Service, FBI; in addition, contact Financial Service Vendors for support on abnormal activity on customer accounts.
    
  • Feed bogus information to the pharmed sites.
    
  • Review abnormal activities on Customer Accounts and bogus accounts
    
  • Implement 3^rd party monitoring companies
    

This is not intended to be a complete incident response plan, but trigger the thought process on items to be covered.

Preventative Actions

At one time or another your institution will be affected by a fraud scam, therefore being prepared with a good response plan for employees as well as providing customer education, in addition to having the resources (either in-house or outsourced) to handle the problem efficiently and effectively are the most effective preventive actions. Prevention of course is primary insofar as keeping phishing and pharming scams at bay, and therefore as a preventive measure, customers who use online banking in any financial institution should be warned to use caution when opening any type of email with links that appear to come from their financial institution. Even if the message looks legitimate, prudence is always best. Educate customers to be proactive rather than reactive. Alert customers not to click any links that come in emails, especially if they appear somewhat suspicious. In addition, if the customer has any doubt about the e-mail message, alert the customer to call their financial institution directly to determine whether it could potentially be a phishing or pharming scam.

Provide customers with Security Awareness Training by developing a web page about information disclosure in addition to providing
a closely monitored email address for this activity should be set up by your institution where customers can send suspicious activities.

About the Author

Mr. Gale Yocom is a recognized technology expert and President of the Dallas-based security specialist company Covetrix. For the past ten years his company has provided full service networking and security solutions to government entitities, financial institutions, and commercial businesses across the U.S. Performing security audits, penetration testing and implementation of security controls, he brings a wealth of knowledge and information to Internet security. Mr. Yocom is known for effectively uncovering weaknesses in institution's security practices and has impressively strengthened the security posture of many financial institutions. Mr. Yocom can be reached by contacting him at gale(at)covetrix.com or by visiting him on the web at www.covetrix.com