AUGUST 1, 2014
Your regular source of security updates from TrendLabsSM
In This Issue

Security Spotlight
Cybercriminals Prove Two-Factor Authentication Can Be as Holey as Emmental

Security for Home Users
The Dawn of the Internet of Everything: Smart Meters

Security for Business
What Real Targeted Attacks Are Like



Security Spotlight

Cybercriminals Prove Two-Factor Authentication Can Be as Holey as Emmental

Operation Emmental—a well-thought-out attack with a lot of components—found an unexpected way around two-factor authentication means.”



Two-factor authentication is one of the most widely used online banking and e-commerce security measures. Users can only access their online accounts by providing two passwords—their online account passwords and an access code sent to their nominated authentication device, usually a smartphone.

The second password, also known as a “security token,” has been quite successfully preventing unauthorized access to accounts. Until, of course, a particular cybercriminal gang seemed to have found a way around its use. These bad guys targeted online bankers in Switzerland, Austria, Sweden, and Japan.

Operation Emmental Breaks Down

Operation Emmental—a well-thought-out attack with a lot of components—found an unexpected way around two-factor authentication means. From sending out socially engineered spam with a malicious attachment to creating and urging victims to download a fake mobile app that intercepts all text messages sent by issuing banks and steals session tokens, the attackers gained control of their victims’ online banking accounts.

How Can You Avoid Becoming a Victim?

While the entire operation seems complex, the fact that it needs to trick users into downloading a malicious spam attachment and mobile app means users can stay protected. As we always say, never open a suspicious email that asks you to download an attachment or click a link. If it looks important and says it’s from a bank or an organization you’re affiliated with, call the supposed sender up first to verify if they really did send you an email before doing anything else.

Here are some other best practices you can do to prevent becoming a victim of attacks like Emmental:

  • Only download mobile apps from official sites.

  • Install security solutions on your computer and mobile devices.

  • Stay up-to-date on malware news, especially those that focus on your locality.

Copyright ©2014 Trend Micro Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks of Trend Micro Incorporated. All other company and/or product names may be trademarks or registered trademarks of their respective owners. The information contained in this document is subject to change without prior notice.

www.trendmicro.com

  CONNECT WITH US ON: