The Fifth Column: The biggest security threats to financial institutions may come from within — whether employees cooperate or not
✍ Scribed by Rob Graham
- Publisher
- Elsevier Science
- Year
- 2001
- Tongue
- English
- Weight
- 389 KB
- Volume
- 2001
- Category
- Article
- ISSN
- 1353-4858
No coin nor oath required. For personal study only.
✦ Synopsis
How could I have accomplished this trick? Not through high-tech 'wizardry'. I was sitting in the branch manager's office, discussing a problem I was having with my ATM card.
During the informal 'chit-chat', I mentioned my personal website, and asked if she would like to see it. She said yes, I provided the URL and they typed it into her Web browser. Up came my site; we looked at my home page, closed the browser window, and we completed our business transaction, with the branch manager using a TN3270 session on her Windows-based PC to access the bank's mainframe and resolve the ATM card problem.
The minute or two that the browser was on my website would have been more than enough time for my website to have exploited security vulnerabilities in the manager's PC. With her browser running a tiny bit of JavaScript code, my home page could have forced her PC to download and install software that would provide me with complete remote control of her computer, including the ability to log her keystrokes and capture passwords, or even keep running her applications while her screen saver was activated.
I could have learned her mainframe account name and password, and with the proper understanding of the bank's software, could have wreaked significant financial damage on the institution.
I'm a good citizen, and my website did not launch an attack on her computer. But, had I wanted to make an attack it probably would have succeeded.
📜 SIMILAR VOLUMES