‘Tiny banker’ malware targets EU banks
iSpeech.org
IBM researchers have seen the ‘Tiny banker’ malware – also known as Tinba – target several European banks in the last month, including banks in Poland, Italy, the Netherlands and Germany.
Infamous for its small file size and focus on the financial sector, this malware is significantly more resilient than any of its predecessors and much harder to take down.
[adsense size='1']
Once the malware has infected a bank’s website, it presents customers with fake messages and web forms, asking for personal information, login credentials or requests to perform a funds transfer.
Criminal gangs refocus their attacks on Europe
While banks should be vigilant, researchers are seeing a wider issue develop: criminal gangs are refocusing their attacks from the US to Europe.
“This latest Tinba campaign is just one of many malware threats that have migrated to Europe after previously targeting US banks,” read the advisory from IBM.
Last year, Benjamin Lawsky, head of New York’s Department of Financial Services, asked New York banks to step up their cyber security procedures and view cyber security as a key part of their risk management strategy. The stricter rules covered corporate governance, login security, management of third-party vendors and cyber security insurance. Banks were even tasked to fill in a 96-question survey about their efforts.
The increased focus on online security in the US financial sector stemmed from the cyber attack on JPMorgan Chase, which affected sensitive information (names, addresses, telephone numbers and emails) relating to 83 million US households and small businesses.
While US banks may be stepping up their cyber security measures, banks throughout Europe still have some way to go in hardening their defences.
Identifying and fixing vulnerabilities within your website
It is strongly recommended that organisations test their network and web applications regularly to identify vulnerabilities and fix them before hackers are able exploit them. While it’s not always possible to do this yourself, there are penetration testing services available to take up the strain.
[adsense size='1']
Penetration testing involves simulating a malicious attack on an organisation’s information security arrangements, often using a combination of methods and tools. It has to be conducted by a certified ethical professional tester (such as CREST-qualified staff), and the findings will provide you with information about security measures your organisation can improve.
Gloss