Hacker News Reader

Comment by _-___________-_ | Hacker News Reader

> Burndown List >> Banking, especially in Asia

My bank in China requires Windows + IE + a custom ActiveX control to use their Internet banking. As a result, I don't use it. One of my accounts can be used via their mobile app (if you read Chinese or have another phone to use camera translation). My business account cannot be, and I am therefore required to visit a branch along with my official chop (seal / stamp) whenever I want to make a transaction.

In every bank branch I've been to, the computers are using ancient versions of Windows and IE. That actually applies to the PSB (a branch of the police) too. I think it might be a while before they get off IE.

View on HN

"My bank in China requires Windows + IE + a custom ActiveX control to use their Internet banking. As a result, I don't use it."

Why not have a VM just for internet banking? Surely that's easier than taking the chop out of the safe and waiting in line at the branch.

At least in South Korea some (but not all) rootkits actively check for the presence of VM.

How does once check for the presence of a VM from inside the VM? Doesn't that defeat the purpose of the VM to begin with?

Theoretically speaking you can make a VM that is indistinguishable to a real computer. In reality most VM solutions do not attempt to do so. For example, many install specialized drivers to communicate to the host that can be readily checked.

> How does once check for the presence of a VM from inside the VM

for example by enumerating the connected PCI devices and looking for common VM vendors virtual devices.

>Doesn't that defeat the purpose of the VM to begin with

that depends on your use-case. If it's about separating mostly trusted applications and/or servers, then absolutely not.

If it's about investigating known-bad code, then, yes, absolutely - malware is often intentionally disabling itself when it detects it's running in a VM.

Yeah, I thought about it. But I don't know how I could keep the VM secure, so I might end up doing my Internet banking on a malware-infested system.

I wouldn't trust myself to keep the latest version of Windows secure, given that I haven't used Windows in over a decade, so I'm pretty sure I can't be trusted to keep XP safe. (As far as I'm aware, the "security" software that the bank's ActiveX control communicates with only runs on XP.)

> But I don't know how I could keep the VM secure,

It's simple, really.

Set up the VM. Do a snapshot. Every time you need to use the shit website, launch the VM, open the site in IE and nothing else. When you're done, shut down the VM and reset it to the known good snapshot.

There. Secure.

Well, this assumes that it won't be compromised during an Internet banking session. Since I have a workaround (use the mobile app for personal banking, go to the bank for business stuff - which I don't need to do often) it doesn't seem worth the trouble and risk.

How would it be compromised if you only connect to the bank?

The bank requires their own ActiveX control and external software which the ActiveX control communicates with, both of questionable quality. Surely that's one of the more likely attack vectors you could have on a system?

Fifth Third Bank in the USA has check deposit software for business users which requires IE with ActiveX, .NET activation, and several security settings laxed in order to work. I've heard no mumblings of it being updated any time soon.

How do they not get infected with worms and ransomware the second they browse the internet?

The paranoid part of me would suspect that they've already been taken over, and the criminals behind them are actively preventing infection from visible forms of attack so they can maintain access to a valuable resource.

Ah yes, shadow IT, protecting the worlds computers from other criminals. A thankless job, really, but somebody has to do it

I'm surprised Microsoft doesn't just revoke people's licenses to use EOLed Windows, such that they're breaking the law by staying on that version. That'd get crufty corps and orgs moving, no?

> I'm surprised Microsoft doesn't just revoke people's licenses to use EOLed Windows, such that they're breaking the law by staying on that version. That'd get crufty corps and orgs moving, no?

I've heard it said that the official OS of mainland China is a pirated copy of Windows XP. IIRC, there are even 3rd-party vendors there that distribute security patches for it. I doubt those people will be fazed by the actions you suggest.

There was a joke that I hard from a friend at MS around the time of XP that people planning how many copies to produce for different regions would only produce one copy for China.

Because they could run nuclear reactors? Or are the only terminal to a ancient water pipe system?

There is a legal element which may allow them to do so, but it is incredible unresponsible to do so. Even the small Win10 migration process break people.

It would get them moving, but not necessarily in the direction MSFT would like. If they are forced to change OS, they might think twice about moving to yet another OS made by a company that just did the forcing in such a ruthless way.

Mind you, I would totally agree with such a decision, if MSFT decided to enforce it, but I dont think it will necessarily play out in a way that is advantageous to MSFT, hence why they haven’t done so yet.

Keep in mind, Microsoft already aren’t making any money from them. They aren’t quite “Microsoft customers” in any real sense, if they’re running WinXP and Office2007.

Those running WinXP/Office2007 are, in fact, pretty legit customers (assuming they run official registered versions of Windows and require security patches/support). MSFT even has a special payment plan for entities that refuse to update, so they charge them a hefty sum for custom security patches and support, with costs going up significantly every subsequent year.

It might seem like pedantry, but generally breaching a contract is not "breaking the law". Microsoft would have to also go to the effort of trying to enforce this, and for what?

Reply on news.ycombinator.com