BANKING TECHNOLOGY ADVISORY: Current and Past Technology Alerts and Tech Talk Issues

Tech-Related Regulatory Issuances
- Customer Authentication
- Identity Theft
- EFTs
- Gift Cards
- Spam, Do Not Call & Junk Faxes
Online Resources
- Resources for Bank Directors
- Research Data
- Information Security
- Fraud
- Payments

05/11/07

A new "death threat" internet scam
Forecasts of an impending internet security battle
Growing worries about portable storage devices
Yet another revelation from the TJX breach
A hidden cost of ID theft
Last Tuesday's Microsoft updates

05/04/07

A new scam using the ACH system
An alert on emails about reset passwords
Concerns about money laundering via digital cash services
Rootkit attacks that elude anti-virus applications
Risks affecting Web 2.0 portal deployment
ATMs with Windows
Microsoft's May Patch Tuesday plans
Personal concerns about data security

04/27/07

A class-action suit against TJX
An end-run around multi-factor authentication;
Security gaps in Nortel's VPN routers;
A flaw in Adobe's Photoshop;
Low demand for mobile device banking services

04/20/07

The return of the Storm email worm
A major internet server security gap
Attempts to exploit that vulnerability
More problems with a Microsoft patch
Another look at ATM skimming scams
Details on Oracle's patch release
This week's Apple update
RIM's Blackberry service outage

04/13/07

Malware lurking on legitimate websites
Possible IT roadblocks to effective marketing
Why mobile devices are more secure than PCs -- for now
What happened on April's Patch Tuesday
More security gaps in Microsoft products
Oracle's plan to release patches April 17
A reminder on the Animated Cursor patch
Symantec's fix for a critical gap

04/06/07

Security risks posed by multitasking employees
Troubles with an unscheduled Microsoft patch
Plans for April's Patch Tuesday
Emails offering bogus Internet Explorer upgrades
A threat to wireless networks
The threat of higher metals prices, and
The future of mobile payments.

03/30/07

TJX's data breach was the largest ever
Microsoft's animated cursor flaw
A Windows proxy server protocol problem
Big increases in ID theft
Surprising sources for phishing emails

03/23/07

A perception that U.S. institutions choose customer service over security
Where most cyber attacks originate
The cost of unrecovered backups and the value of paper
Arrest in TJX stolen data
Increase in Bot Net controlled PCs
Greatest risk of data loss
Must-read documents for security professionals

03/16/07

an Al-Qaeda plot against the Internet
A Fed Agency Vista Ban
The StickyKeys weak spot in Vista
A Service Pack for Windows Server 2003
A big patch from Apple
An attack on GoDaddy
Copiers as security gaps
A warning on emailed resumes
Another flaw in IE7
Craftier cybercrooks
A role for government in internet safety
Task force ID theft recommendations

03/09/07

An anti-virus software test
A Patch Tuesday without security patches;
An important update for Apple's QuickTime;
Microsoft's beta release of a new VoIP application

03/02/07

March is the Month of PHP Bugs
Adding to the list of MS Office 2003 flaws
Mozilla's patch for Firefox holes
Another ActiveX control concern
A worm attack on a Sun Solaris daemon
A concern for Google Desktop users
Weak Vista user controls
An Oracle security alert
Research on bacterial backups
Renewed interest in CRM software

02/23/07

Potential Chinese hackers
Problems with Cisco IP phones
A successful pharming attack on banks
Zero-day exploits on Microsoft Office
Alternatives to the MS Office suite
More Internet Explorer and Firefox bugs
New information on the TJX breach
A critical intrusion detection system flaw
Tips on shutting IT ports and doors
Last week's US-CERT vulnerability list
New NIST security guides

02/16/07

Massive cyber-testing by Homeland Security
Continuing MS Word worries
The latest US-CERT vulnerabilities list
Gaps in Cisco's IPS
A new IT security tool
Unsecure Treo handheld phones
Holes in wireless router security
Another pandemic planning concern
Cheaper cybercrime

02/09/07

Hackers targeting key internet servers
Copper cable thefts
Next Tuesday's Microsoft patch list
Flaws discovered in Firefox
Trend Micro product vulnerabilties;

02/02/07

The effects of this year's earlier change to Daylight Saving Time
The wide reach of malicious botnets
New information on the TJX data breach
Virus-infected GPS devices
Audio attacks on Vista PCs
More phish in your email
112 new vulnerabilities on the US-CERT list
Increases in attacks on mobile phones
The Road to Microsoft Windows Vista in 20 Questions

01/26/07

a STORM WORM attack update
The dangers from hacker development kits
Continued MS Word worries
Patches from Cisco and Apple
A Trojan scam against a Swedish bank
A keylogging attack on government employees
140 new vulnerabilities on the US-CERT list
A "heads up" on desktop gadgets and widgets
Plans for a Vista update.

01/19/07

ATTACK ALERT on today's Storm Worm e-mail
A new phishing tool for hackers
Increases in ID theft
Strategies for attracting "Gen Y" employees
The big data breach at TJX
The latest US-CERT vulnerabilities list
A re-released Excel patch
Sun's Java update
A threat to MS Office passwords
Entrust's use of extended website validation
A new manual from the Justice Department

01/12/07

Miscrosoft's delay of four critical patches;
US CERT's latest Vulnerability Summary;
Opera's Update Oversight;
Problems with Sun's Java Runtime Environment;
A need to upgrade or patch Adobe's free Acrobat Reader;
A warning for Acer computer owners;
A critical patch for OpenOffice users;
Worries about Web 2.0;
Disaster planning concerns;
When to upgrade to Vista (or not);
Password plans for PayPal protection, and more

01/05/07

A busy 2007 for your IT and Info Security staff;
The kickoff of Apple Bug Month;
US CERT's latest Vulnerability Summary;
Unpatched Microsoft weaknesses;
Plans for January's Microsoft Patch Tuesday;
More reasons to upgrade Acrobat Reader installations;
Google's fix for a Gmail gap;
An attack on Amazon.com; and
New threats to Bluetooth users.

12/29/06

growing concerns about Microsoft Windows Vista;
The Department of Defense's ban on HTML email;
Communications challenges in Asia;
Forecasts of increased cybercrime;
The threat from botnets; and more.

12/22/06

A new worm is raising havoc with computers running unpatched versions of Symantec AntiVirus
Mozilla patches several security flaws
Researchers want to prove that Apple is no more secure than Windows by making January the "Month of Apple Bugs"

12/15/06

System administrators have a busy week with patches from Microsoft
Three un-patched Microsoft Word flaws lead many institutions to block Word documents at the email gateway
Phishing and identity theft continue to increase
A new ransomware attack targets Hotmail users
A new paper on protecting wireless networks

12/08/06

Apple and MySpace get together to demonstrate how not to release a security patch
Updates for Adobe Acrobat Reader
Two new vulnerabilities for Microsoft products, including a Word flaw that is being actively exploited
A new online tool to check systems for vulnerabilities

12/01/06

A threatened cyber attack against financial institutions
Apple patches thirty-one security flaws
New vulnerabilities in Adobe Acrobat
New hacks for Blackberries
Warnings about preparing for pandemic flu
Will mobile phones be the next consumer banking tool?
Will social banking steal business from brick and mortar banks?

11/24/06

A new type of attack puts your passwords at risk
US-CERT issues two alerts for critical bugs in Mac OS X and CA's BrightStor backup software
McAfee retracts claims that its SiteAdvisor software will detect phishing
Are the solutions being implemented to meet the FFIEC's multifactor authentication guidance real security, or just a panacea to make consumers feel safer?

11/17/06

The SANS Top-20 is out and users are among the top targets for attackers
Additional vulnerabilities are discovered in WinZip and a widely distributed wireless device driver
Microsoft releases six patches for nine flaws and hackers already have exploits out for at least one of them

11/10/06

Two new articles every IT manager and executive should read
Microsoft releases Vista to manufacturing
A new "supercert" SSL certificate is in the works
Two new malware applications cause a dramatic increase in spam
Google emails a virus to over 50,000 subscribers
A new flaw is discovered in a Microsoft ActiveX control.

11/03/06

A new resource in the fight against spam
Attacks on technologies designed to comply with the FFIEC's MFA guidance
A new hard drive that encrypts data
The 8th anniversary of the first Internet worm

10/27/06

Online brokerages lost over $22 million in the last three months due to cyber crime
The number of batteries included in Sony's battery recall tops 8 million
Firefox 2 is officially released
Another bug is discovered in IE 7
The FBI says that cyber crime is one of their priorities
New voice biometric technology is available for telephone banking systems

10/20/06

Oracle releases patches for 101 security vulnerabilities
Apple ships iPods with a Windows virus on them
Microsoft releases Internet Explorer 7
Mozilla announces Firefox 2 Release Candidate 3
New research shows that many banking web sites are still scaring away customers

10/13/06

Another record setting slew of patches from Microsoft, along with a glitch in their delivery and a new exploit published two days later left Microsoft users wondering "What's next?"
HSN publishes the top ten attack vectors against Web 2.0 apps
Google releases a new search tool that could be of more help to hackers than to legitimate users

10/06/06

Apple released an update for fifteen security vulnerabilities
Microsoft has announced that next week's monthly update will include patches for eleven security flaws
A fake flaw was announced in Firefox by researchers seeking publicity
Fujitsu laptops join the great Sony battery recall
Hacking-for-dummy kits are on the increase
UK banks are wary of smart card authentication
Women may be the biggest target market for online banking

09/29/06

Additional vulnerabilities are discovered in Internet Explorer and Microsoft PowerPoint just after Microsoft released an out-of-cycle patch for one of last week's bugs.
Sony's problems continue to pile up as IBM/Lenovo and Toshiba announce more battery recalls
Dell expands its own recall effort
Browser bugs and phishing emails are on the rise
Identity thieves are targeting smaller businesses
A new class-action lawsuit arises against a bank that is alleged not to have done enough to protect the identities of its customers

09/22/06

Two new flaws in Internet Explorer
An update to Firefox to fix several critical security vulnerabilities
A marked increase in cross-site scripting vulnerabilities spell trouble for online applications
Barclays Bank leads all others in phishing attacks directed against their customers
More Sony batteries are recalled and another laptop bursts into flames.

09/15/06

Microsoft released three new patches
Adobe updated the Flash Player
Apple released a new version of QuickTime
Two banks were in the news for losing confidential data

09/08/06

A new zero-day vulnerability for Microsoft Word 2000
A virus definition update that took several servers down
NIST releases three new draft special publications for public comment
OpenID may be the future of identity management
A new article suggests how to develop an encryption strategy

09/01/06

First phishing, then vishing, and now SMiShing?
A warning about an increase in phishing sites
Sun admits there is a major flaw in the method that Java updates are installed
A serious security hole is found in Cisco firewalls
Ten open source companies and products to watch
A new study shows attacks that use stolen login credentials are much more damaging than other types of attacks

08/25/06

Microsoft experiences more patch problems
Apple recalls 1.8 million notebook batteries
Microsoft and Mozilla agree to work together
A software upgrade at the Department of Education goes wrong
How using metrics can help your institution's security function.

08/18/06

Delays in installing a patch to Microsoft's Windows Server Service are being exploited
Another patch from Microsoft is being re-patched to fix an issue it caused
Dell is recalling 4.1 million notebook batteries
Two new stories may make the security professional's job even more difficult

08/11/06

Microsoft set a new record by releasing more patches so far in 2006 than it did in the last two years combined
Both US-CERT and the Department of Homeland Security are now warning users to install patches
Apple releases new patches for the Mac Pro
A new Trojan is on the loose
Google warns users about dangerous websites
Barclays is providing card readers to its online banking customers
Several new warnings about mobile phones and PDAs are released

08/04/06

Security researchers released several new methods to exploit information systems security vulnerabilities at this week's BlackHat security conference
Apple, Mozilla and McAfee all released security patches this week
A new credit card with the capability to generate one-time passwords was announced

07/28/06

Attacks against Microsoft PowerPoint: One of the new attacks leads experts to believe the motive is corporate espionage.
Kaiser joins the list of companies that have lost laptops with personal information on them
GlaxoSmithKline announces a breakthrough in the development of a vaccine against bird flu

07/21/06

Following a large patch release from Microsoft last week, Oracle releases sixty-five security patches
Reports of SQL injection attacks against web applications are on the rise
MySpace users are hit hard by at least two attacks
A new search engine that allows you to search for malicious software on websites has been released.

07/14/06

A two-factor authentication web site was spoofed this week
A new phrase was introduced into the IT vocabulary - "vishing" - phishing through VoIP
It's time to update those electronic banking risk assessments
Microsoft released seven patches to address eighteen vulnerabilities and officially ended support for Windows 98 and Windows ME
Adobe and Cisco both released critical patches aimed at High severity vulnerabilities
A new report shows a disturbing trend toward selling newly discovered vulnerabilities to the highest bidder.

07/07/06

A security researcher has dubbed July "The Month of Browser Bugs" and promises to post a new browser vulnerability every day of the month
Another Excel flaw is discovered
A worm posing as Windows Genuine Advantage is on the loose
Advice on preparing for a malware attack and on correctly using SAS 70 reports

06/30/06

Microsoft patches affecting Excel and Internet Explorer
Apple was on the mend
Several arrests of those involved in malware distribution and even insider abuse at HSBC leading to a data breach
McAfee and Symantec working to help improve protections
How government guidance is working to shore up vulnerabilities in the IT security system

06/23/06

Patch and Vulnerability Groups met to decide whether three new attacks against Microsoft Office products warranted blocking those files until patches can be released.
A new booklet on disaster recovery and lessons learned from Hurricane Katrina was released by the FFIEC member agencies.
Several data breaches
A new attack against PayPal users

06/16/06

Microsoft released the most patches in a single cycle since February 2005
Windows 98 and Windows ME support comes up short
A new ransomware variant
Two new worms are discovered
The FDIC wants you to know how XBRL can help your bank

06/09/06

Three large data breaches insured a busy week for information technology and security professionals
The Government Accountability Office released new data this week on tsunamis and the areas most likely to be affected - are you in one?
Are spreadsheets and USB drives among the new enemies to the corporate network?

06/02/06

Barclays Bank in the UK buys 1.6 million protection licenses.
The Cybersecurity Enhancement and Data Protection Act of 2006 gets approval from the House Judiciary Committee
Symantec works over the weekend to patch a High severity vulnerability
The first macro virus to target OpenOffice is released
Microsoft releases OneCare

05/26/06

How virtual money is being used and how at least one bank is participating in on-line gaming
The latest debate on bird flu
Five of the most wanted cybercriminals in the world

05/19/06

Anti-spammers suffered a casualty in the ongoing war on spam: Security firm Blue Security Inc. was forced to close its doors
Apple released several patches
A database of stolen identities was discovered
Lloyds TSB admits to security weaknesses in their new 'chip and PIN' cards
Another data breach bill is introduced in Congress

05/12/06

Microsoft released two critical patches and one moderate-severity patch on Patch Tuesday.
A failure in the United Kingdom's 'chip-and-pin' credit card systems leads to the theft of over a million pounds
Reports from Germany indicate that the operating system that runs many of the security appliances protecting network infrastructures is overly buggy
Two industry experts warn of the complete failure of information security
A new tool that's been posted on BankersOnline

05/05/06

A rather busy week for reported information technology security incidents
Information about new vulnerabilities
A phishing mutation
Ransomware
Security log management
A Firefox update
SSL evasion

Archived Tech Alerts:
3/10/06 Internet Security Vulnerabilities, Trends and Predictions
1/27/06 Kama Sutra Worm, Top Trends Impacting Bank Technology
12/01/05 2005's Top Security Vulnerabilities
8/12/05 Spyware Threats, ID Thieves Use Spyware, Pharming, New Phishing Center
8/10/05Microsoft Reports Download Problem
8/20/04 Avoiding Problems with the latest Microsoft Service Pack
7/2/04 "Can you bank on IE Security?" -- Use of Internet Explorer browser; precautions
6/29/04 FDIC Guidance on virus protection; JS.Scob.Trojan update; Phishing Advice
5/03/04 IT Exam Guidance - Retail Payment Systems
5/03/04 Email from IRS? Nope, Just More Phishing"
5/03/04 Sasser Worm Strikes Thousands of PCs
3/8/04 Blog Update: BankersOnline.com is Spoofed!
2/25/04 Newest Variant of MyDoom Virus Packs a Punch
2/11/04 Critical Windows Security Flaw
1/26/04 New Mass Mailing Worm
1/15/04 New Vulnerabilities Affecting Antivirus Products
1/15/04 Critical Update for Microsoft Firewall Product
1/15/04 Phishing Scams on the Rise

10/15/03 Microsoft warns of critical flaw in Windows XP and 2000
10/15/03 Top 20 Internet Security Vulnerabilities
09/19/03 Gibe Virus Spreading Quickly
09/19/03 Phishing Scams Continue Around the Globe
09/10/03 Patch Issued for Serious Windows Flaws
09/04/03 New Security Warnings Issued by Microsoft
08/22/03 From Blaster to Nachi to Sobig -- More Havoc Predicted
08/19/03 New Strain of Sobig VirusSpreading Rapidly Across the Net
08/17/03 Blaster Worm email Hoax Provides New Threat
08/14/03 What the Blaster Worm Teaches Us
07/23/03 Kinko's Keystroke Caper Underscores Need for Diligence
06/09/03 Bug Bear Targets Banks
06/05/03 Rapidly Spreading Bugbear Virus Cause for Concern
05/29/03 Constructing an Effective Patch Management Program
05/20/03 Greetings From Microsoft Support! May We Infect Your System?
05/12/03 New Fizzer Worm Racing Throughout The Internet
04/07/03 New Report Details Efforts to Address Cyber Threats
04/02/03 Time to Step Up IT Security and Sendmail Vulnerability
03/18/03 Windows 2000 WebDAV Buffer Overflow Exploit Against IIS 5.0 - CRITICAL
03/03/03 Critical Vulnerability Discovered in Sendmail
02/06/03 Microsoft Releases Cumulative Patch for Internet Explorer Flaws It Lists as Critical
01/26/03 The Importance of Applying Patches
01/23/03 Microsoft and SUN release slew of Patches
01/14/03 New Worms Spreading through Email
12/09/02 Microsoft Issues Updated Cumulative Patch for IE
11/13/02 New e-greeting tactics pose serious threat
11/01/02 Critical patch released for Windows 2000, Windows XP
10/21/02 Microsoft Fixes Vulnerabilities: Releases Patches for SQL, Word and Excel
10/03/02 Bugbear Worm Gains Strength
10/02/02 Top 20 List of Internet Security Vulnerabilities Released
09/02/02 Microsoft Warns SysAdmins To Immediately Patch Identity Spoofing Flaw
08/21/02 Microsoft releases patch to fix "critical" vulnerability in Windows 2000 systems that allow unprivileged users to log onto them interactively
08/09/02 Is Confidential Bank Information Walking Out Your Door?
07/30/02 Microsoft Continues to Patch Flawed Software
07/23/02 CERT advisory on PHP
07/15/02 Outlook Users Employing PGP Encryption Program Vulnerable to Hacking
07/11/02 Researchers Report Serious Flaw in IE
06/27/02 Microsoft Releases Critical Patch for Windows Media Player
06/18/02 CERT Warns of Critical Vulnerability in Apache Web Server
06/12/02 Sports Fans Beware: World Cup Virus Bounces Around the Net
06/07/02 Dead Man Tell No Passwords
05/31/02 Microsoft Issues Critical Warning Regarding Exchange Server
05/22/02 Microsoft SQL Spida Worm Slows Network Traffic
05/15/02 Virus Hoax 'JDBGMGR.EXE' Spreading Rapidly Throughout Net
04/25/02 Klez Worm Reels in Banks with its Bait
04/11/02 Ten New Vulnerabilities Discovered in Microsoft IIS Server
04/09/02 New Virus Hoax Circulating Around Net
03/22/02 MyLife.B Virus Makes Its Way Around the Net
03/21/02 Microsoft Updates Its Warning on Critical Windows Vulnerability
03/14/02 New Virus (W32/Fbound-C) Spreading Rapidly in the Wild
03/08/02 Unauthorized E-Mail Scam Attempts to Steer Unwitting Customers to Fraudulent Bank Web Site
03/06/02 Klez-E Worm and W32.Gibe Virus Warnings
03/01/02 CERT Issues Warning on PHP Scripting Language Flaw
02/27/02 CERT Issues Warning on Internet Explorer and Outlook Flaw
02/22/02 SNMP Patches and Detection Tools Available
02/20/02 Email Address Belonging to Legitimate Security Site Hijacked to Deliver Dangerous Yarner Worm
02/15/02 Mass Mailing Email Worm Compromises Word 2000 Security Settings
02/13/02 SNMP VULNERABILITY
02/07/02 Bloodhound Mass Mailing Worm and Managing Risks in Wireless Networks
02/04/02 Microsoft Issues Collection of Security Fixes for Windows 2000
01/31/02 Copycat Virus Unleashed
01/30/02 Netscape Browser Vulnerable to Cookie Theft
01/28/02 "My Party" Mass Mailing Worm
01/18/02 IT Contingency Planning Guide, Information Security Checklist and Solaris Vulnerability
01/15/02 Trojan.StartPage Alters Web Browsers
01/12/02 New Internet Worm Gigger Masquerades as Microsoft Outlook Upgrade
01/08/02 Microsoft Universal Plug and Play Vulnerability
12/20/01 Holiday Themed Computer Virus Unleashed

First published on BankersOnline 5/20/03

Privacy Policy Disclaimer Recommend This Site ! Contact Us

BankersOnline is a free service made possible by the generous support of our advertisers and sponsors. Advertisers and sponsors are not responsible for site content. Please help us keep BankersOnline FREE to all banking professionals. Support our advertisers and sponsors by clicking through to learn more about their products and services.