(OT for uk.legal - but may be of interest) You may have seen the following article: A flaw in the way the Internet works has prompted the "largest security update" in the history of the web, and fears of millions of people remaining exposed to criminals and malicious hackers. NB : "Although there is no evidence of the bug being exploited by hackers," I am not convinced that the "no evidence" is correct - but I can understand why no-one would want to admit to being affected by it. Ten days before this article came out - the following happened: A relative uses a major bank. He noticed that after the first page of on-line banking (after he had input his account number and sort code) - he went to a page which was asking him for his security details in a different way from normal. He phoned me I asked if he had clicked on a link to go to the site - he hadn't. I asked him if he had the link as a favourite - he hasn't. He actually types in the url of the online bank in to his browser. I asked him to take a screen capture and send to me. I told him to run his (up to date) virus checker - and other mal-ware applications. He did - nothing found I told him to speak to his bank and tell them. The online help desk just told him that he must have a virus - he told them he had run his up to date virus checker - they said not their problem. I phoned up help desk and said that this problem had happened to me - they gave me the same story. I insisted that they escalated the call - this they did - the supervisor said that they knew of no problem. I insisted on escalating call to someone in "security" - they said they couldn't. I told them I was not going to go away - and I would close my account if they did not do so. Eventually I was escalated to "security" which I think was a technical rather than security department. I explained "my" problem. (I am quite IT literate so was able to discuss sensibly). Eventually the guy admitted that a "small" number of their customers in...

You've probably already tried this, but it's worth checking anyway. Have you, or has he checked his hosts and lmhosts files? As the problem is reproducable on his system, but not on every computer that accesses the banks site, it suggests that the problem is definitely on his computer somewhere. The Hosts files are usually to be cound in C:windowssystem32driversetc These files define where selected domains and IP addresses are redirected to. Changing these files won't flag anything up on an antivirus sweep. They need to be checked manually. Reallistically speaking, these files only need one line in them.... 127.0.0.1 localhost Anything other than that could potentially be causing the problem. Just reset the file to read "127.0.0.1 localhost" and check to see if the problem persists.

The problem still exists. Here is summary of what has been done - at either request of bank, me, or someone here. 1) No problems with Firefox 2) Panda Anti-Rootkit 1.08 - in depth scan 3) Panda Active Scan 2.0 4) Trend Micro Anti-rootkit 5) F-secure Anti-rootkit 6) Are these files on your machine?: ed47fa.$ fa56d7ec.$$$ bca4e2da.$$$ Answer: NO 7) Look in Hosts and IMhosts - they are both normal 8) Run DNS check Result : 195.188.152.62 appears to be safe He is on VirginMedia - it appears to be an old telewest DNS 9) fsecureblacklight 10) highhjackthis 11) The bank have said that there are a "number of Virgin media customers affected - but it is not limited to that ISP" (I am not expecting it to be solved by these groups - I will continue with updates for interest) But thanks for suggestions.

Major Bank On-line Security Problem?

J

judith 17 years ago

The problem still exists.

Here is summary of what has been done - at either request of bank, me, or someone here.

1) No problems with Firefox 2) Panda Anti-Rootkit 1.08 - in depth scan 3) Panda Active Scan 2.0 4) Trend Micro Anti-rootkit 5) F-secure Anti-rootkit 6) Are these files on your machine?: ed47fa.$ fa56d7ec.$$$ bca4e2da.$$$ Answer: NO 7) Look in Hosts and IMhosts - they are both normal 8) Run DNS check

formatting link

Result : 195.188.152.62 appears to be safe He is on VirginMedia - it appears to be an old telewest DNS 9) fsecureblacklight 10) highhjackthis 11) The bank have said that there are a "number of Virgin media customers affected - but it is not limited to that ISP"

(I am not expecting it to be solved by these groups - I will continue with updates for interest)

But thanks for suggestions.

Vote

C

Cynic 17 years ago

Fair comment - I was using the ter I thought would be better understood, though as you say it is not really the correct term to use.

Vote

(

(used to be) Fat Sam 17 years ago

Out of interest, does he know how to set up a proxy to connect through? Would be interesting to see if the problem persists when using a proxy server.

Did you say that the problem doesn't exist when using Firefox? If so, has he tried uninstalling and re-installing IE to see if that has any effect?

Presumably he has reported the issue to Virgin and they're looking into their DNS configuration?

Vote

J

judith 17 years ago

No - and to be honest he seems happy now that he is using Firefox - and the problem is definitely not there - as he wants to crack on with his work. I may ask him if I can do a remote access to his machine and try some things - but he uses it most of the time.

It doesn't - and he hasn't - I may try that.

Yes - they said that he had a virus!!

Vote

(

(used to be) Fat Sam 17 years ago

Fair play. The new Firefox is a fantastic browser. Far better than IE, so he'll no doubt enjoy his online eperience more now.

LOL. The last resort suggestion of technical helpdesks all around the world.

Vote

(

(used to be) Fat Sam 17 years ago

That's why I was so convinced it was an rogue entry in the hosts file. But that turned out to be clean, so my theory was wrong.

Hmmm. A bit extreme really. But having said that, I'm all out of ideas.

Vote

M

Mike 17 years ago

Although, in this case, it's hard to escape that conclusion. A DNS issue would affect Firefox as well as IE, so a compromise on the local PC seems the most likely explanation.

Personally, I'd wipe the hard disk and reinstall the OS.

Mike.

Vote

J

Jonathan Bryce 17 years ago

An entry in the hosts file would also affect Firefox. It is more likely to be a rouge BHO (Browser Helper Object), or something similar infecting Internet Explorer.

Vote

S

Simon Finnigan 17 years ago

I wouldn`t say it was extreme. There is a fair chance the PC has been compromised in some way, but nobody can identify how. If you can`t tell how it`s been compromised, how can you fix it and be sure it is no longer compromised? A few hours work to format and reinstall everything removes that worry.

Vote

J

Jethro 17 years ago

with a caveat that any programmer worth his salt will check for "Read only", before trying to update the file. Many years ago, when I wrote a virus as an acedemic exercise, I included a little bit of code which checked for read-only, unset it, updated the file, then reset it ... in this case, the safest bet is to make sure only the adminstrator

*account* has modify rights to the file, and never log in as administrator.

IIRC in *nix based systems, the hosts file can't be modified from a user account, read-only or not.

Vote

M

Mark 17 years ago

I thought that was reinstall Windows? Or is that the first resort for all "helpdesks"?

Vote

N

news 17 years ago

A trojan?

formatting link

07-060812-4 603-99

Vote

C

Colin Wilson 17 years ago

A variant of Vundo ?

Vundofix

formatting link

Vote

J

Jonathan Bryce 17 years ago

if you log on as root, or use sudo, and do chmod 666 /etc/hosts then everyone will be able to change it

You can use a standard account in Windows XP, then you won't be able to change the hosts file. You won't be able to do a lot of other useful things either though.

Vote

Major Bank On-line Security Problem?

Join the Discussion

Didn't find your answer?