Comment by jgroome | Hacker News Reader

Comment by jgroome | Hacker News Reader

I hope nobody minds but I'd like to share what happened to me recently:

My father called me a few months ago to ask if I could go on our bank's online banking site and tell him if I noticed anything unusual. At the time, HSBC's online banking had the following flow: Enter your user ID as the first step, enter your DOB as the second, and finally enter three specified digits from your 6-figure security PIN.

It all seemed OK to me, nothing out of the ordinary, but he was telling me that when he was prompted to enter his security PIN, the site asked for the full number. This was a big no-no.

"So I thought I'd better call you before I do that, because it doesn't sound right and you know about this stuff."

I went to their house the next weekend to check it out. He fired up the ol' IE7, went to the HSBC page, completed the first step of logging in, and there it was, clear as day. A mysterious third box prompting the user to enter their full PIN.

I don't know exactly what put that input box there, and successive Googling has yielded nothing specific. I assumed the damn thing had picked up some nasty spyware, or some other malicious code with the potential to cost a lot of people an awful lot of money. I installed Chrome, deleted the "Internet" icon from the desktop, imported old bookmarks and the like, and let him have a go on his new browser.

I really think we, as the more technically-minded people in our families, have an obligation to do this for the people we care about, in a way that extends far beyond those clever CSS animations or native video support. I'm lucky enough that my folks know to keep their eyes open to anything fishy online, but I had no idea he was still using IE7. The idea of him (or indeed anyone) inadvertently giving their complete bank details to some cyber-criminals out of completely innocent ignorance terrifies me.

Very likely to be zeus or another related banking trojan, that's a trick that i know it can pull. You may want to watch as changing browser may not get rid of the underlying problem, and anti-virus is apparently somewhat spotty st detecting and removing this class of threat.

> I installed Chrome, deleted the "Internet" icon from the desktop, imported old bookmarks and the like, and let him have a go on his new browser.

Is this a joke? Your dad's computer is rooted, so you remove an icon from the desktop and install a different browser?

Jesus Christ.

Whoah, there. It's obviously not a joke. Dude, you made a good point but you completely lacked any tact. You could have just simply warned the guy that uninstalling the browser may be enough. And I believe he knows that deleting the shortcut icon is not the same as uninstalling. It's easy to tell it was just an important part of the story because to people who aren't tech savvy, deleting an icon is uninstalling as far as they're concerned and the deletion of the icon was probably very significant to his father.

So chill out, man. We may be a community of techies but we can't possibly know it all. What may seem a obvious to you may not be to another one of us. It doesn't mean we're stupid. For example, its like the back end web programmers who know little to nothing of front end stuff. It may seem like someone who knows that complicated back end stuff can easily figure out HTML and CSS in an hour but sometimes not. Just chill.

Just changing browsers here doesn't really solve the problem. Can't the Trojan target chrome as well?

Pherhaps there is a case for a minimal Linux (or even better OpenBSD) distro that contains only an up-to-date browser (automatically updated) with most plugins (flash,java etc) disabled. You could also set a firewall to block all but a whitelisted set of domains (to prevent CSRF etc). It could also be set to use a different DNS server to the main computer (or have DNS hardcoded into /etc/hosts).

This could then be run in a Virtual Machine transparently so that it appears to be just running as another application, could be called "Secure Browse" or something, that would be used specifically for things like banking websites etc. This wouldn't prevent things like keyloggers and some other attacks but would prevent allot of the more common stuff (malicious plugins, malicious proxies / software DNS redirecting etc).

Pherhaps this is unnecessary as many bank sites now require physical authentication via handheld keygens.

I do remember a UK banking site (that shall remain nameless) used to have online banking that didn't work unless you were running an IE with pretty much every plugin under the sun (activex included) installed.

What's even more terrifying is that for every person savvy enough to at least know when something's not right (new PIN box), there's several more that wouldn't give it a second thought.

Although having a more modern browser will help, this is the kind of stuff that only better education can truly protect against.

Highlights another reason to use small, local banks or credit unions instead of the big nationals. The big banks are targets for all kinds of phishing and trojan attacks.

My parents would have typed the number...

Reply on news.ycombinator.com