ie8 fix
madison

Hardware 2.0

Adrian Kingsley-Hughes

Accessing online account from Windows just once cost Mac user $100,000

By | June 2, 2010, 6:53am PDT

Summary: Cut a long story short, there was a password stealing Trojan on the PC and criminals accessed the bank account and pulled out $100,000 in $5,000 and $10,000 chunks.

This is a pretty scary story:

David Green normally only accessed his company’s online bank account from his trusty Mac laptop. Then one day this April while he was home sick, Green found himself needing to authorize a transfer of money out of his firm’s account. Trouble was, he’d left his Mac at work. So he decided to log in to the company’s bank account using his wife’s Windows PC.

Cut a long story short, there was a password stealing Trojan on the PC and criminals accessed the bank account and pulled out $100,000 in $5,000 and $10,000 chunks.

Now, it’s easy to think that this guy would have been protected if he’d had proper, up-to-date antivirus installed on his PC. Well, as Brian Krebs points points out, maybe not …

What’s more, the tools these crooks are using — mainly the Zeus Trojan — almost always outpace anti-virus detection at least by a few days, and by then it’s usually too late.

The question is, who or what to blame? Is it user error? Is it the fault of Windows? Is it the bank’s fault?

Another question worth asking is this - Is Windows just far too big and juicy (and easy) a target for hackers that folks still using the platform for sensitive work as asking for trouble? After all, there’s absolutely no questioning the fact that this attack would not have worked on the Mac or Linux platform. This firm lost $100,000 due to using Windows. Period.

Oh, and if you do have good security practices in place, make sure you use them ALL THE TIME!!!

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Disclosure

Adrian Kingsley-Hughes

All opinions expressed on Hardware 2.0 are those of Adrian Kingsley-Hughes. Every effort is made to ensure that the information posted is accurate. If you have any comments, queries or corrections, please contact Adrian via the email link here. Any possible conflicts of interest will be posted below. [Updated: February 23, 2010] - Adrian Kingsley-Hughes has no business relationships, affiliations, investments, or other actual/potential conflicts of interest relating to the content posted so far on this blog.

Biography

Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.

Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs. His most recent books include "Build the Ultimate Custom PC", "Beginning Programming" and "The PC Doctor's Fix It Yourself Guide". He has also written training manuals that have been used by a number of Fortune 500 companies.

Adrian also runs a popular blog under the name The PC Doctor, where he covers a range of computer-related topics -- from security to repairing and upgrading.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
80
Comments

Join the conversation!

Just In

RE: Accessing online account from Windows just once cost Mac user $100,000
vamike999 30th Jun 2010
Ya this would not bother me at all. I got this little baby http://www.tapdrive.com/ , linux on a usb , with a read only os. Never have i been hacked since.
0 Votes
+ -
The timing of this is too delicious #1
NonZealot Updated - 2nd Jun 2010
I have your apology right here:
before the flame war begins. it is a trojan, people. something a user has to single handily download from a certain website and installing it on a computer by giving a password. one at a time. trojans have been available for the mac forever. viruses and worms don't. so nothing new here.

and please all those who don't know the difference between viruses and worms on one hand and trojans on the other, please don't apply.

so, now, i'll get some popcorn ...

Thanks banned from zdnet!!
http://www.zdnet.com/tb/1-82576-1578538?tag=talkback-river;1_82576_1578538
@NonZealot

Considering Windows is very vulnerable to drive by attacks where you don't have to explicitly install anything (especially XP) it's very likely the user didn't know this app was installed.

But then again you're pro Microsoft so they can do no harm.
0 Votes
+ -
2 things
NonZealot 2nd Jun 2010
@itguy08
it's very likely the user didn't know this app was installed

Read the article moron:
there was a password stealing Trojan

All the Apple apologists swear and stomp and scream and froth that no OS can protect a user from a trojan.

Second, I'll remind you that at PWN2OWN every year, OS X fell first, within seconds, to drive by attacks. It is actually OS X that is very vulnerable to drive bys. happy
0 Votes
+ -
Linux Live CD
davidr69 2nd Jun 2010
@NonZealot If you can point us to any version of Windows that runs from a CD as various Linux distros are able to do, then maybe there would be no flame war. For all the "this happens with every OS" claims that are ignorantly posted, no it doesn't. Although those Live CDs do require updates to patch apps which have since then been updated, I can always build an up-to-date ISO. Heck, I can boot from a USB key in read only mode, or even mount my partition as read-only.

Maybe Windows should only be used within a VM. Maybe after every shutdown, the image should be reverted, and the image should only be modified with security updates, but always revert to the saved version once shut down.
@davidr69 just an FYI, that is the system Microsoft uses with all of their websites... they run in VM's and there is no firewall/anti-virus protection running on the webservers, just an app that checks for "changes" if any file is modified the VM is brought down and reverted to a previous snapshot with 20-60 minutes of the change, also the account passwords on these VM's are changed everytime the VM is launched (so reverting to a snapshot of the system restarts the VM with new account passwords), this renders any attempted hacking obsolete within an hour. Sure you can hack a M$ website, but you only get a limited time to do it in before it is reverted and negated and they have UNLIMITED RESOURCES TO FIND YOU.

Very secure practice, all data that is changed is hosted on separate datastores with a much higher level of protection than is available to the public.
@davidr69
http://www.ubcd4win.org

Runs Windows XP from a PE CD or a USB flash drive, and you can do practically anything you'd need to while using it. Including surfing the web and email. I've used this program for a few years now, mostly for repairing computers, but it's quite possible to run your computer with it.
0 Votes
+ -
Windows running from Live CD is possible!
Computer_User_1024 29th Jun 2010
@davidr69 I also like Linux and the live CD's. But, there is the possibility to run Windows from a live CD. It can be done with Bart PE. I made such a CD sometime in the past and it is very handy to do so. You can download Barts PE builder at http://www.nu2.nu/pebuilder/
0 Votes
+ -
@NonZealot

Let's see how they spin this one.
@Adrian
"Free apps install spyware on Macs" is d title of an article i just finished reading on zdnet a moment before I saw this one!
I wonder what that malware does? Hmmm... steal passwords maybe??
@NonZealot
Even your pea brain can understand this....

"before the flame war begins. it is a trojan, people. something a user has to single handily download from a certain website and installing it on a computer by giving a password."

On Windows systems that are vulnerable to drive by attacks the user needs to do nothing to have this crap installed. This is not true for other OS's at this time.

"Second, I'll remind you that at PWN2OWN every year, OS X fell first, within seconds, to drive by attacks. It is actually OS X that is very vulnerable to drive bys."

Did it really? Funny here:
http://www.computerworld.com/s/article/9174101/Hacker_busts_IE8_on_Windows_7_in_2_minutes?source=rss_news

IE 8/Win 7 - 2 mins. And those guys won the prize.

Wake me when there are real drive by attacks for OS X.
0 Votes
+ -
Liar
NonZealot Updated - 2nd Jun 2010
@itguy08
This is not true for other OS's at this time.

This is a lie. A pure lie. OS X is more vulnerable to drive bys than Windows, as proven over and over again at PWN2OWN. In the first PWN2OWN, OS X was the only OS to get PWNED by a drive by with absolutely no 3rd party software installed on it. Windows and Linux both survived day 2. OS X was the only one that fell on day 2. When Windows fell on day 3, it was actually due to a vulnerability in Flash, something that is not installed by default on Windows .

So you are lying when you say other OSs are not vulnerable to drive bys.

Did it really? Funny here:

IE 8/Win 7 - 2 mins. And those guys won the prize.


So OS X didn't fall to a drive by and your proof of this is that Windows did? I hope you never get accused of murder because I can just see your defense: Your honor, I couldn't have murdered the victim because someone else committed a murder last month!

Are you seriously that stupid?
http://www.computerworld.com/s/article/9174078/iPhone_Safari_IE8_Firefox_all_fall_on_day_one_of_Pwn2Own?source=toc
Hackers took down Apple's iPhone and Safari browser , Microsoft's Internet Explore 8 (IE8) and Mozilla's Firefox within minutes at today's Pwn2Own contest, as expected.

So what were you saying about OS X being immune to drive bys?
  • Flagged
@itguy08: Wake me when there are real drive by attacks for OS X.

Is that what you're going to tell this guy? That it's OK he lost $100K because it wasn't a drive by attack? Seriously?
0 Votes
+ -
So, now, I'll get some popcorn...
buddhistMonkey Updated - 2nd Jun 2010
Hey, if popcorn is your snack of choice while you read about costly Windows vulnerabilities, enjoy.

"Is Windows just far too big and juicy (and easy) a target for hackers that folks still using the platform for sensitive work as asking for trouble?"

Sure looks like it... munch, munch...

"After all, theres absolutely no questioning the fact that this attack would not have worked on the Mac or Linux platform. This firm lost $100,000 due to using Windows. Period."

Mmm... crunch, crunch... delicious...
0 Votes
+ -
I'm grabbin some popcorn as well
Pete "athynz" Athens 2nd Jun 2010
@NonZealot Agreed. This is a case where the user - perhaps his wife as it was her PC that had the trojan - downloaded (unknowingly) the trojan. NOT a virus. User error.
0 Votes
+ -
Same Ol' bush league journalism
LBiege 2nd Jun 2010
If you leave the key in the car and lose it to a thief then let's blame the manufacture for not producing a more secured car. Just red herring all over again.
0 Votes
+ -
Bottom line
GoPower 2nd Jun 2010
If he had used his Mac laptop this wouldn't have happen to him, the exploit was Windows based.

Get over it zipper head, these are the facts of THIS story, not some other story.
@NonZealot
0 Votes
+ -
I have another apology right here:
No OS can protect users from themselves (or we wouldn't be able to install any software). Do not download and authorize the installation of applications (Trojans) from untrusted sources.

Thanks again, banned from zdnet!!
http://www.zdnet.com/tb/1-82576-1578611?tag=talkback-river;1_82576_1578611
@NonZealot Apparently being the underdog in overall PC market share has its advantages. Why go after a few million when you can just as easily reach out to several billion?

Windows Users
Preferred target for criminals around the world
0 Votes
+ -
This is an easy question
MLHACK 2nd Jun 2010
drum roll please.... the fault lies with the criminal that wrote the trojan. You do not need to be a rocket scientist to figure this out.
0 Votes
+ -
@MLHACK

drum roll please....

And if you leave your keys in your car, and it is stolen, the fault lies with the person that steals your car.

One would wonder however, why we even have car keys with logic like this.
@MLHACK I was with you until this: But it is no surpise that americans are fat lazy welfare losers that want everthing handed to them. Dude if you are going to insult Americans at least use proper spelling otherwise you look like a *********... In order the words are spelled: surprise, Americans, and everything. When in doubt look for the red lines underneath the misspelled words prior to hitting the "reply" button. Oh and for that insult thrown our way you can kiss my lazy welfare collecting wanting everything to be handed to me butt.
0 Votes
+ -
Did you believe the Mac vs PC ads when you thought they said that if you switched to a Mac, you'd be immune to all malware? Nope, turned out you aren't, and we have an apology for that one too:
Apple really doesn't give enough of a distinction in what they mean by "it doesn't get PC viruses. You and I know that it mean malware targeted for Windows, but the average user does not.

Thanks JM1981!!
http://www.zdnet.com/news/free-apps-install-spyware-on-macs/429788?tag=mantle_skin;content
0 Votes
+ -
The timing of this is too delicious #4
NonZealot Updated - 2nd Jun 2010
Some people believe it doesn't matter what platform you used, you could never protect yourself from this:
I don''t care what platform you use, if you download free screensavers, and other utilities from unknown companies, then you are just asking to get hit with spyware.

Thanks again JM1981!!!
http://www.zdnet.com/tb/1-82576-1578612?tag=talkback-river;1_82576_1578612
0 Votes
+ -
3 magic words: "Ubuntu Live CD"
OS Reload 2nd Jun 2010
Those 3 words have saved my ass so many times. Could have saved his too.
@OS Reload Two more words: Proper Precautions.
@athynz
Exactly, like my firewall/router would never allow a Trojan to communicate with the outside world, such as this past weekend when my fathers laptop was dropped from the network only to find a trojan running which came from my nephews flash drive... Proper precautions will properly protect.
I always have one of my trusty Ubuntu laptops nearby.

Also, just in case (hardware can fail) an Ubuntu bootable pendrive (equivalent to an Ubuntu Live CD) is always with me.

Thanks for the advice Adrian.
The articlke in itself is interesting.
Shows how a user(s) fails to take proper precautions and got bit.
For the responses so far:
Zzzzz......
0 Votes
+ -
wow adrian youve really lowered yourself.
Johnny Vegas 2nd Jun 2010
the last couple months youve really been throwing youre reputation away. unfortunately youve reached the point where youre starting to take zdnets down with you.

clearly if he'd had a mac at home and his wife had been using that instead, with her browsing habits she would have already had a trojan or two installed on it when he went to use it as well.
@Johnny Vegas
the last couple months youve really been throwing youre reputation away. unfortunately youve reached the point where youre starting to take zdnets down with you.

Good to see someone else noticed this. Seems like every time they do a website redesign the bloggers also change their attitudes as well.
OK, here's the evail flame of a reply.

Saying Windows is at fault here is like saying I was at fault when my debit card got skimmed when I made a purchase at a legitimate business outlet.

The PC had a trojan. Tough ****. Someone in his household got caught, AV wasn't up to date, whatever. And they happened to be one of the what, thousands daily that have their bank accounts drained because someone surfed a site they shouldn't & got infected.

The criminal(s) responsible are at fault. Period. You just look like a brainwashed apple fanboi Adrian spouting "I'm a PC" ******** like its gospel.

I LOVE apple overall, but this blog post is just more ******** FUD. What a waste of bandwidth.
0 Votes
+ -
More information...
rjohn05 2nd Jun 2010
What was the OS? This article fails to mention it and it's crappy posts like this that cause bad press for companies like Microsoft.
@rjohn05 It was probably Windows 98SE from the looks of it. happy (NT)
0 Votes
+ -
He used his wife's computer
Stan57 2nd Jun 2010
He used his wife's computer that his children play online with,? And that moron used it to get axcess to his companys bank account.
AHAHAHHAHAHHAHAH
The stories also made no mention if windows was up to date,that it even had an anti virus program on it. Very poor reporting,very poor.This could have been an inside job too.
@Stan57 This could have been an inside job too. I was thinking that as well... and perhaps the trojan was downloaded knowingly and after the fact... presuming of course it was an inside job.
My sister-in -law just got a Mac because her daughter thinks it is immune from malware and such. This mindset creates a brainless. sheep like notion among home pc users that they are safe from idetity theft and fraud.
It's not just Mac users either, as many kid's (win) pc's are so messed up with trojans that only a hard drive wipe and re-install will fix them. Updates? put them off, AV updates? Nah.. Public WAP's? why not just leave your purse or wallet on the sidewalk in Nigeria!
Stupid consumers!
0 Votes
+ -
Great Macs
john@... 2nd Jun 2010
Hey Adrian, how's that Mac you assembled working out?
0 Votes
+ -
Always wrong adrian!
Helio99000 2nd Jun 2010
>After all, there?s absolutely no questioning the fact that this attack would not have worked on the Mac

Do you mean this specific attack? Uh okay. But there are password stealing trojans for os x as well. So the "would not have worked. period." Is a lie.
Need more Info... "Windows" PC tells me nothing... Which Windows? 3.1? 95, 98? 98SE? ME? 2000? NT? XP? Vista? 7?

If not 7 or Vista....then the time to upgrade has come for said user. Because since the release of Vista, we have all acknowledged that XP and lower are FAR less secure...that horse has been beaten to a pulp.

Also, I have still never seen a Mac in an actual corporation running....other than at Apple.. So what fictional company uses only Macs?
@condelirios Also, I have still never seen a Mac in an actual corporation running....other than at Apple.. So what fictional company uses only Macs?

I've seen them in graphics design companies where they use solely macs. I've also seen them used in marketing departments to print flyers, brochures, and other marketing handouts... but that's not the entire company but a department.
0 Votes
+ -
Another Thought...
condelirios 2nd Jun 2010
Stealing a password and then stealing from a bank account is what is know as "Bank Robbery" and the FDIC insures all accounts up to $200,000...so I am guessing the firm will have lost a total of Zero at the end of the day.
0 Votes
+ -
Interesting point, but...
msalzberg Updated - 2nd Jun 2010
@condelirios

This is not considered bank robbery. The customer is responsible for the security of his/her online passwords. From the FDICs website: "If a third party somehow gains access to your account and transacts business that you would not approve of, you must contact the bank and your local law enforcement authorities, who have jurisdiction over this type of wrongdoing." Sounds like you're not insured against this type of loss by the FDIC.

http://www.fdic.gov/consumers/consumer/information/fdiciorn.html
Are these comments from the same people that complain about not being able to install anything they want on the iPad?
0 Votes
+ -
Bank is at fault
peltierd 2nd Jun 2010
Why would we blame the endpoint? It seems to me that any banking system that permits accounts to have $100,000 in them owes it to their customers to provide two-factor authentication. Users think it's a pain? Tough. Given a choice of banking services offering password vs. password+2f, I would always opt for the latter. You choose your 2f - SMS, email, phone call, FOB, whatever. That is the only thing that would have saved this chap.
Who's to blame?
In order:
1-The user: if he uses a computer (be it a Win PC or a Mac) regularly, he MUST be aware of the risks involved in any and all online transactions. He should have checked for malware with one or more online scanners as well as check for suspicious processes running in the background (especially when using a computer which is not his).
2-The developer of the malware
3-The bank: banks should implement additional security for online transactions.

This is just MHO.
Actually, he may or may not be out the money.
It all depends on the agreement that they have with the
bank regarding online transactions. Some are protected
against fraud, others are not. Sadly for him, it's likely
the business account will have less protection than the
basic consumer version.

In any case, likely the bank should have noticed the
activity as suspicious given the pattern and likely
destination of the money. Transactions of a type not
usual for that account should certainly raise red flags.
Gee, why are you transferring all that money to Poland/Russia/Somalia etc when you never did business
with those countries before.

Now this won't stop the transactions to another "local"
account which then transfers over seas, but it does stop
quite a bit of it. I would think the bank would likely be
able to act to recover a lot of the money too by
effectively reversing the transactions and possibly by
threatening to terminate relations with the other bank
networks that facilitate the fraud.
Yet another anti-Microsoft piece from AKH. Seriously dude, what happened to you? Why are the bosses at ZDNet making you do this and why are you falling for their tactics?

We can all agree that Microsoft Windows was not to blame here. It was his wife's fault for not using any antivirus software to begin with. Sure they may be a day or two behind but at least they'd have been alerted to this since it wasn't a 0-day. Like others said, she had to willingly accept the trojan as well. I bet she was looking at pr0n behind her husband's back and that's how she got the trojan. Anyway, Microsoft Windows is not at fault here since its doing what its supposed to do, and that is run applications. She installed the trojan, she suffers the consequences.
0 Votes
+ -
So?
Cylon Centurion 2nd Jun 2010
@Loverock Davidson

He is a tech blogger. He is simply reporting a story.

Second not all antivirus software works as advertised. I can almost bet money on the fact that this was an off the shelf crapware cluttered desktop PC most likely running an out of date free trial. User see the icon on the desktop and that is it, they pay no other attention to it. Second, McAffee and Norton almost always are the first victim in a malware attack, and do nothing to prevent an attack from taking place. Needless to say an anti-virus package isn't going to prevent malware from getting onto a system. An user ignorance only helps that problem.

I know he doesn't need me to stand up for him, but cut AKH a little slack, he is a tech blogger, not a Windows blogger.
Ya this would not bother me at all. I got this little baby http://www.tapdrive.com/ , linux on a usb , with a read only os. Never have i been hacked since.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix