This may hev allready been discussed but....

HT~ this thread was about the article and the assertions made by a supposed expert in the security field.

"Clueless" is alleged to have said:

Quote:

---

"Because there are so many poorly protected home computers out there running Windows, the hackers haven't had to write Mac versions of their viruses," said Graham Cluely, senior technology consultant at Sophos.

---

I can only interpret that as "obscurity theory". He did NOT imply that it was more difficult, or that malware writers couldn't do it..........................only that they didn't because Windows users presented a more profitable target.....................he was quite clear about the financial motivation though.

Gore, I think that these guys assume that behind every IIS server there is a potentially vulnerable Windows network? As soon as you start using other software, the situation becomes potentially far more complex.

Quote:

---

Or, why aren't there more Linux virii? Linux is starting to boom and a lot of servers run UNIX and Linux. That would include the Stock Market which as I heard, runs Solaris and Oracle.... So why no UNIX virii or worms to try these high end targets?

---

That one is easy :D It is because they don't want to do serious Bubba time. Financial Institutions have staff who are trained not to fall for what home users do. They also employ quite a few security professionals, and many of them are NOT in the IT profession.

Even if you manage to scam a bank employee out of $5 million, you just try getting your hands on the money without getting caught. Also remember that the objective is to hit as many little people as you can for small amounts............... they know that the FEDs aren't interested in anything less than $5000. Hey it is as easy to forge a TJ as it is a $50......................but how would you manage to offload the TJs? ;)

Banks are easy, you don't attack over the network at all.

A book I have here has a story in it about a guy who's GF worked in a bank and he told her how it would be a funny joke for her to "place about 3 Million Dollars" into his account to show his friend.

After finally agreeing to it, she was told to do it at an exact moment, and then wait 10 minutes or 20 minutes and take it back.

Well, the time came for it, and when she transferred the cash, he was waiting and withdrew it all and left. The Genius of the simplicity kind of grabbed me for a minute.

So that tells me it has at least happened once.

Quote:

---

I wonder how much of a kickback sophos is making from these statements.

---

About as much as the FBI is getting for their incredible statements on the VA laptop.


To sum this up, BSD with a pretty skin can be targeted the same as anyone else. Anybody here remember some slick little browser that came along in the wake of IE vulnerabilities? Yep, amazingly Firefox too had some dirty laundry of their own. Is this really a surprise to anyone here? I mean, has Sophos tricked anyone?

Sophos has just been added to my "Video Professor Credibility" list as in they have as much as the good fellow does at 2am when hucking those awful CDs.

--TH13

WHAT?????? YOU didn't buy his product or try it free to learn Windows ME?? But it works just like a movie!

Quote:

---

Originally posted here by gore
Banks are easy, you don't attack over the network at all.

A book I have here has a story in it about a guy who's GF worked in a bank and he told her how it would be a funny joke for her to "place about 3 Million Dollars" into his account to show his friend.

After finally agreeing to it, she was told to do it at an exact moment, and then wait 10 minutes or 20 minutes and take it back.

Well, the time came for it, and when she transferred the cash, he was waiting and withdrew it all and left. The Genius of the simplicity kind of grabbed me for a minute.

So that tells me it has at least happened once.

---

Sorry bro but you example here is invalid. That had nothing to do with the OS. It was plain simple social engineering.

Quote:

---

Sophos hasn't been a real company in quite a while.... They are media-whores... I used to avidly read their AV Newsletters... now they just suck... They just wanted attention..

---

You know that, I know that, but someones 80 year old grandmother reading the news before todling off to play her pogo games dont know that. As most of you know I am a former geek squad agent. Now I understand that doesnt give me a lot of credibility because the GS has gotten some negative feelings towards it. But everyday I interacted with people who had read some article just like the one we are discussing here. Suddenly they are experts. Oh and I will admit MOST of the agents I met were idiots. there were a few good ones but for the most part my 6 year old could secure a computer better.

Yea I know :( I just woke up after finally getting to bed at like 12 PM.

Quote:

---

Originally posted here by gore
Banks are easy, you don't attack over the network at all.

A book I have here has a story in it about a guy who's GF worked in a bank and he told her how it would be a funny joke for her to "place about 3 Million Dollars" into his account to show his friend.

After finally agreeing to it, she was told to do it at an exact moment, and then wait 10 minutes or 20 minutes and take it back.

Well, the time came for it, and when she transferred the cash, he was waiting and withdrew it all and left. The Genius of the simplicity kind of grabbed me for a minute.

So that tells me it has at least happened once.

---

Banks are easy??????? Ya with a mask and a gun.

Dude is it a comic book?

No bank would ever allow any one person, let alone someones girlfriend to transfer 3 Million let alone 3 grand to an account without serious scrutiny of the transaction. Anyone as apparently ignorant as this guys alleged G/F would never be given the power to do so. Not even the C.E.0. could perform that type of transfer without a second party being involved.

hehe

Ya man And I have the Bat Boy from the Weekly World News in my garage next to the U.F.O. from Area-51...................




:p

Hey Galdron I have to agree with that, banks have pretty tight internal audit and control. I know that because I audited quite a few when I was with Price Waterhouse. I doubt if an EVP could authorise such a transaction...................I was at the same hotel in Malta a couple of years back, as an EVP of AMEX IBC and he told me he couldn't go above $250,000; and the transaction would have to have been initiated by someone else within the bank.

When I audited AMEX IBC down in the City of London "back then" I had to get the EVP to countersign the backs of my personal cheques I wanted cashing...................like 50 bucks beer money! :D Mind you, my local hicksville bank thought I must be the cat's pyjamas after that!............. like "this guy can get the EVP of a major international banking corporation to authorise his personal cheques" ;)

Where the gap was, was the money market trading:

http://www.bbc.co.uk/crime/caseclosed/nickleeson.shtml

That was the last big one over here (although it was in the Hong Kong branch). Prior to that it was Lloyd's Bank Lugano.................... another case of "rogue trading" on the money markets.

An interesting one was when we went over to decimal currency. This guy in a bank's IT wrote a little subroutine to pick up the extra decimal places from the conversion calculations and skim them into a bogus account he had set up. He was caught by an audit proggy that looked for "impossible transactions" of course all these £0.009876 or watevers showed up like a sore thumb :eek: