Banks Are the New Troy to Modern Trojan Horse Attacks

Trojan attacks hit the financial services industry harder than any other industry in 2005, according to a new study from Counterpane Internet security Inc. and MessageLabs.

Trojans are computer programs that are surreptitiously installed on an owner's computer that then have the ability to capture

The financial services industry suffered almost 40 percent of all Trojan attacks last year, topping all 15 industries studied, according to Attacks Trends & Analysis, released in March. The financial services sector also outranked its peer industries in 2005 as the most exposed to probes and enumeration attempts, at nearly 30 percent of total targeted scan attacks worldwide, said the study.

The report summarizes the attack trends observed by Counterpane and MessageLabs in 2005-including Trojans, spyware, e-mail viruses, and targeted attacks-across 15 industry sectors; discusses how these attacks affect organizations; and outlines the extent of potential damages.

"We have seen a Trojan program that did not have to trick victims out of revealing their password, but instead waited for the victim to check their bank balance and the Trojan then silently siphoned money out of the account," said Alex Shipp, senior anti-virus technologist, MessageLabs, a provider of messaging security and management services.

"Hackers are specifically crafting Trojan attacks and targeted scans to exploit weaknesses in the security posture of financial institutions. The FBI, the IMF, and the FTC all agree, the financial sector has become a lucrative target for the financially motivated hacker," said the report.

In October the federal banking agencies jointly released "Authentication in an Internet Banking Environment." The guidance was issued to reflect the growing need to protect customer information. It addressed the increasing incidents of identity theft and fraud and the introduction of improved authentication technologies and other risk mitigation strategies. The guidance also recommended that all banks institute multifactor authentication by yearend 2006 to help mitigate the risks involved with online banking.

"Good, strong, multifactor authentication will help prevent Trojan Horse attacks on the consumer side," said Lawrence T. Levine, managing director of securePipe, based in Lincolnshire, Ill.

"Cyber attacks will cause greater damage to corporations in the coming years," said Bruce Schneier, founder and chief technology officer of Counterpane, a provider of network information protection. The larger a company is, and the deeper an infection goes, the higher the costs$1 million or more. And these are just direct losses. Factor in intangibles, such as reputation and customer trust, and the damage is even more severe."

In 24 months, banks will no longer be able to allow their employees unlimited Internet access, Levine said. Trojans are picked up when employees visit Web sites that have been compromised, he said. -Nancy Feig