×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Hacked Bank of India Site Labeled Trustworthy

kdawson posted more than 6 years ago | from the punching-a-hole-in-the-web-of-trust dept.

Security 54

SkiifGeek writes "When the team at Sunbelt Software picked up on a sneaky hack present on the Bank of India website, it became a unique opportunity to see how anti-phishing and website trust verification tools were handling a legitimate site that had been attacked. Unfortunately, not one of the sites or tools identified that the Bank of India website was compromised and serving malware to all visitors The refresh time on a trust-brokering site is too long to be useful when a surf-by attack on a trusted site can take place in a matter of seconds, with a lifetime of hours, and with a victim base of thousands or greater."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

54 comments

Whoopdeedoo (-1)

packetmon (977047) | more than 6 years ago | (#20434649)

Via my blog... Big deal. I don't bank with them so I really don't care. When Akamai, Doubleclick or some other cache provider get's Pwnd then I'll worry. Actually, with my email box ringing just now, I think I will retire now that I'm rich. "I am Mr. James Morgan, chief auditor Ministry of Economics, Cotonou Benin Republic .I got your information when I was searching for a reliable, honest and trustworthy person to entrust this business with. I was simply inspired and motivated to pick your contact from the many names and lists in the website. I wish to transfer the sum of $14,300,000.00 USD (Fourteen Million Three Hundred Thousand United States Dollars only.)Into your personal or company's bank account.

As stated, when someone like Doubleclick, Akamai or some other cache serving company gets compromised, then I will worry about things more.

Re:Whoopdeedoo (5, Insightful)

garcia (6573) | more than 6 years ago | (#20434793)

As stated, when someone like Doubleclick, Akamai or some other cache serving company gets compromised, then I will worry about things more.

For some unknown reason, I hoped that financial institutions would have more online security than Doubleclick or Akamai.

Re:Whoopdeedoo (1)

MrAnnoyanceToYou (654053) | more than 6 years ago | (#20434945)

Why's that? Akamai probably handles multiple foundational financial systems' networking, so if they got compromised it could be a much bigger deal.

Having worked for a bank, I'd be floored if financial systems' defenses ever caught up with technical systems'. The problem is that in a financial organization financial skills are valued on a cultural level rather than technical skills. This is quite different from a technical company, at least one in its early to mid life. (in, of course, my experience and readings. Perhaps this is not completely true)

Re:Whoopdeedoo (1)

mlts (1038732) | more than 6 years ago | (#20435289)

Akamai not just does the networking for banks, but I'm pretty sure they handle a lot of high volume services that if tampered with would mean a lot of damage. Microsoft Update/Windows update is hosted on their network, for example.

Most banks pay attention to their IT infrastructure, and if a compromise happened, heads would roll. However, almost always, there would be some way of showing due diligence [1] so nobody goes to prison or major lawsuits don't get filed. On the other hand Akamai's whole line of business is dependent on how secure their servers are, so I'm pretty sure they have a lot more manpower and resources dedicated to that (as a percentage), compared to a bank or credit union. Security is Akamai's reputation, where a breach with them would be as catastrophic and company destroying as having Verisign end up with its root signing private keys for anyone to download on a FTP server.

From what I read, Akamai does a very good job of keeping their stuff locked down.

[1]: HIPAA/SOX/other regs are another can of worms, and are almost as daunting (if not more so) for IT departments as keeping the infrastructure maintained.

Banks are notoriously technically ignorant. (1)

Futurepower(R) (558542) | more than 6 years ago | (#20435291)

We did some consulting work involving two large banks. The managers at one said that their bank had NO technically knowledgeable people who worked for the bank, on contractors. I talked to one of the contractors, and he had very little technical knowledge, also. (How would a bank with no technical knowledge choose which contractors were technically knowledgeable.)

The other bank seemed to have very, very little interest in technical issues, also.

We have accounts with several online banks, including an extremely large international bank. All have web sites with major design problems.

I suppose that is one of the reasons that bank web sites are often IE only.

BankRate.com [bankrate.com] is terrible, in my opinion, but it seems to be the best bank information web site available.

Re:Banks are notoriously technically ignorant. (1)

Futurepower(R) (558542) | more than 6 years ago | (#20435311)

Corrections: "only contractors." Also, "How would a bank with no technical knowledge choose which contractors were technically knowledgeable?"

Re:Whoopdeedoo (1)

chaosite (930734) | more than 6 years ago | (#20435221)

Serious?

Akamai is a tech company. They know their networks extremely well. I would expect that they were more competent with regards to security threats to their servers than a financial institution, whose main business is not running a computer network...

How common a problem? (3, Insightful)

mordors9 (665662) | more than 6 years ago | (#20434655)

That's the problem, how many consumers are sophisticated enough to even ask the right questions. They simply trust that their financial organization or any major web retailer has a secured site. Obviously there should be strict standards but who is going to enforce it. What authority would the agency actually have. As I have said before, there is still a lot to be said to walking into your local bank and being helped by a clerk that you see every week that you can shoot the shit with as they handle your transaction.

Re:How common a problem? (3, Insightful)

Ash Vince (602485) | more than 6 years ago | (#20435001)

That's the problem, how many consumers are sophisticated enough to even ask the right questions.
On a similar note I just went to the Site Advisor page for bank of india. (http://www.siteadvisor.com/sites/bankofindia.com)

Especially amusing is the comment some moron has posted complaining about when Bank of India was getting a red rating. Basically he is saying how he used the site for three years and it must be a site advisor problem not a problem with the Bank of India website.

How on earth do you come up with a technological solution that copes with people who even when they get a warning saying that the site they about to visit is dangerous carry on and visit the site anyway. I know that he should now have learnt his lesson (assuming he visited the site and got all that crap installed on his PC) but there must be alot more morons out there just like him.

Re:How common a problem? (1)

allanw (842185) | more than 6 years ago | (#20435945)

Check the posting date of that comment:

Posted at 12/23/2006-02:16:06 PM by Mehli B Mulla, Reviewer , View profile [ Reputation score: 1 / 9 ]

Google Desktop would block this (0)

Anonymous Coward | more than 6 years ago | (#20437723)

Google Desktop 5 would in fact block the iframe from loading, since it's in the Google blacklist.
http://www.google.com/search?q=site%3Agoodtraff.bi z&btnG=Search [google.com]

Google search did not flag the site itself; As suggested by others, the site was probably compromised and cleaned up between Google's indexing cycle.

Google does expose an API (search for 'safe browsing API') that contains these known bad hosts (goodtraff, etc), so incidents like these can still be prevented even before Google checks the compromised sites themselves. Google Desktop 5 uses this API, and mozilla developers blogged about possibly including this in Firefox 3.

There still remains a problem with relying on blacklists (what if the attackers did not use an iframe and instead hosted all the exploits on the site itself), but I am just stating that the article did not cover Google Desktop, which in fact protected its users in this case.

Re:How common a problem? (1)

DemonXstreeM (1150043) | more than 6 years ago | (#20438935)

it is true that you can do your part to lessen the risk by going into your local branch to complete transactions, however once you have completed your transaction the bank stores that information electronically and it then becomes subject to attack.

Banks: Please Stop Using ActiveX ! (5, Insightful)

Gopal.V (532678) | more than 6 years ago | (#20434693)

There are very few instances when I actually need to rdesktop in and use a Windows machine.

One of those is when I've actually got to visit one of my online banking sites, which requires some obscure activex "security" extension to work. For someone who uses FF, noscript and occasional peeks at firebug, it really pisses me off when I have to disable all my own security checks to enable a site to "secure" itself.

This is just another instance where I'd have been hit if I had been a user of the said bank (and had to use IE to browse it).

Re:Banks: Please Stop Using ActiveX ! (5, Interesting)

Anonymous Coward | more than 6 years ago | (#20434821)

The main problem is that the Indian technical institutes rarely teach anything besides Microsoft products. So each year they produce many thousands of students who know of nothing but Windows, VB.NET, SQL Server, and ActiveX. When you only really know about one particular set of technologies, and virtually nothing about the alternatives, you'll usually make poor choices regarding which technologies to use. In the case of ActiveX, its use can easily lead to compromised systems and data.

Re:Banks: Please Stop Using ActiveX ! (2, Interesting)

Shados (741919) | more than 6 years ago | (#20434985)

Ironicaly, I went to a very Windows-heavy college (it did show unix, linux, intel assembly, and other non-MS centric stuff, but overall it was more than 50% windows), and they didn't show us ActiveX especially becuase of all its issues (and that was before .NET, too, back when ActiveX were sortoff relevent).

So not only those institutes may be Windows-only, but they're behind the time and pretty bad too. At least from what I read, not -all- of em are like that...

Re:Banks: Please Stop Using ActiveX ! (1)

b1ufox (987621) | more than 6 years ago | (#20434991)

You can't teach ability to choose a different solution. That said nobody taught me kernel programming, rather discouraged me but still i work as a kernel developer full time. That said teaching is not the problem, mindset is.

Re:Banks: Please Stop Using ActiveX ! (0, Troll)

ScrewMaster (602015) | more than 6 years ago | (#20435277)

The main problem is that the Indian technical institutes rarely teach anything besides Microsoft products.

Good.

Re:Banks: Please Stop Using ActiveX ! (1)

Mathinker (909784) | more than 6 years ago | (#20438169)

Sorry, didn't quite understand that reply, especially considering your other posts....

You're just happy that the use of ActiveX isn't dogma of major Indian religions?
You're glad you won't have to compete in the job market against outsourcing to Indian Linux/BSD gurus?

Re:Banks: Please Stop Using ActiveX ! (1)

ScrewMaster (602015) | more than 6 years ago | (#20438257)

I perceive Indian tech workers as competing in the same job market that I do, and if they deliberately choose to use second-rate development tools that's fine by me. Not picking on Indians per se: it's just that I'm always happy to see my competition make potentially poor decisions.

Re:Banks: Please Stop Using ActiveX ! (3, Insightful)

ScrewMaster (602015) | more than 6 years ago | (#20434981)

For someone who uses FF, noscript and occasional peeks at firebug,

Don't forget Privoxy.

But yeah, the only thing I deliberately use Internet Exploiter for is Windowsupdate. Requiring an ActiveX control (ActiveX!) on a financial site is unacceptable, as is forcing visitors to use Explorer. Personally, I have the same setup you do, and the occasional site that requires Explorer doesn't get visited again. I also have several sites that I use for financial purposes, and they all support Firefox. If they didn't, I'd either switch institutions, or not use their site.

One of those is when I've actually got to visit one of my online banking sites, which requires some obscure activex "security" extension to work.

That's insane. I mean, the bank is assuming that their own security is perfect and will never be cracked, which is not realistic. When you get right down to it, you'd think that banks (of all organizations) would require the use of a more secure medium. Nothing would please me more than to navigate to my bank's Web site in Explorer and see a message "We're sorry, but due to ongoing security issues with Microsoft Internet Explorer, this site requires the use of a more capable browser" and see links to Firefox, Opera and others. When I first signed up at my current bank, it was the exact opposite, but fortunately I could just change the browser ID and it worked fine, no ActiveX crap.

Re:Banks: Please Stop Using ActiveX ! (1)

140Mandak262Jamuna (970587) | more than 6 years ago | (#20435187)

I also have several sites that I use for financial purposes, and they all support Firefox. If they didn't, I'd either switch institutions, or not use their site

I can personally vouch that the following financial institutions support Firefox, and I did not have to chew anyone's ears or fiddle with agent strings. Vanguard, Schwab, Dollar Bank, Citizens Bank, Smith Barney, Fidelity, MFS, Ameritrade, NDB (might be defunct now). And if an Financial institution does not support FireFox, it does not get my business.

Re:Banks: Please Stop Using ActiveX ! (0)

Anonymous Coward | more than 6 years ago | (#20436297)

USAA also does. No stupid activex or anything.

Re:Banks: Please Stop Using ActiveX ! (1)

dave_h_in_philly (955521) | more than 6 years ago | (#20437877)

Here in Korea (I'm no longer in_philly), most of the financial sites and numerous government sites such as Korea Post [koreapost.co.kr], use "obscure 'security' extension" ActiveX controls. But in Korea it has to do with Korea's adoption of the SEED cipher back in the 90s [kanai.net], and the inability to get 128-bit encryption from the Americans until 1999. Needless to say, it is a significant concern for me (an expat) as well as for regular Koreans. For my own part, I try to avoid such sites and do as much banking as possible in the US, but for most Koreans that's not an option. At least according to the article I linked above, Koreans are suing their government over the whole mess.

Re:Banks: Please Stop Using ActiveX ! (1)

ScrewMaster (602015) | more than 6 years ago | (#20438271)

Yes, I remember reading a couple of articles about that here on Slashdot. I hadn't realized that Koreans are sufficiently upset about it that they're taking on their own government. Hopefully that will result in some positive changes.

dont trust sites that crosslinks (0)

Anonymous Coward | more than 6 years ago | (#20434713)

never trust sites that use different domains to show pictures, provide logins, tracker pixels etc...

Oh (-1)

Anonymous Coward | more than 6 years ago | (#20434739)

Oh deary deary me. This is being jolly bad!

iframes... (1)

ls -la (937805) | more than 6 years ago | (#20434791)

... seem to be nothing but trouble. Does anyone know of a legitimate use for them (especially cross-server) that could not be done with a bit of easy server-side including? On a related note, does anyone know of a firefox addon that can warn you if any page you visit contains an iframe tag?

Re:iframes... (3, Informative)

ubernostrum (219442) | more than 6 years ago | (#20434911)

They're useful for doing in-place file uploads without refreshing the page (e.g., in a web app like Gmail where you'd want to add an attachment to a message), because that's the only way to do that.

Re:iframes... (1)

vux984 (928602) | more than 6 years ago | (#20434931)

Does anyone know of a legitimate use for them (especially cross-server) that could not be done with a bit of easy server-side including?

They are efficent; they let you change the content of part of your page without reloading the whole thing. I use them frequently with venture capital company websites to display slightly delayed stock charts and share price information for example. They can update themselves every couple minutes without reloading the whole page.

Additionally, because the chart and share information is provided by 3rd party company, the iframe is cross-server. I suppose one could write a proxy layer to make the iframe appear to come from the same server, but I don't see any real benefit to that.

And it goes without saying that they are heavily used for advertising; again because they don't reload the whole page the ads can be roated.

You could use ajax style programming to get the same effect I suppose, but that would be more work; and again I'm not sure how it would make it more secure.

Re:iframes... (0)

Anonymous Coward | more than 6 years ago | (#20435029)

yes. frame redirecting sites. see joker.com and other providers which give frame redirects for legit websites.

Re:iframes... (1)

Ant P. (974313) | more than 6 years ago | (#20435301)

You could try sticking something in the user CSS to make iframes stand out. Not too hard to force them all to have a big red border.

Re:iframes... (1)

JacksBrokenCode (921041) | more than 6 years ago | (#20435991)

Would it then require some hack to make sure that the inline style doesn't override any stylesheets you've created? The iframe used on bankofindia.com had "style='visibility:hidden;'". Unless I'm mistaken, even if you had custom stylesheets applied to every page you visit the inline CSS would still rule... right?

Re:iframes... (0)

Anonymous Coward | more than 6 years ago | (#20437581)

Would it then require some hack to make sure that the inline style doesn't override any stylesheets you've created?
No, not a hack, just good use of the cascading order [w3.org].

The iframe used on bankofindia.com had "style='visibility:hidden;'".
I'd rather eliminate it with display: none!important;, although getting rid of it entirely with a filtering proxy is much more secure.

Unless I'm mistaken, even if you had custom stylesheets applied to every page you visit the inline CSS would still rule... right?
That's right--unless you use !important rules [w3.org] which (applied in a user style sheet) always take precedence.

in Soviet India... (1, Funny)

Anonymous Coward | more than 6 years ago | (#20434917)

hacked site labels YOU trustworthy.

Anti-phishing tools shouldn't be used to determine (4, Interesting)

Glowing Fish (155236) | more than 6 years ago | (#20434957)

Anti-phishing tools shouldn't be used to determine which sites are good, they should be used to determine which sites are bad.
These tools might have picked up thousands of shoddily done, fly by night phishing scams. It doesn't reflect badly on them if one well done, sophisticated cracked server can fool them. There is still going to be errors. These tools allow people to discount the most obvious hacks, and use their time on the 1% of most dangerous hacks.

Re:Anti-phishing tools shouldn't be used to determ (2, Informative)

blowdart (31458) | more than 6 years ago | (#20435375)

But that's not what anti-phishing tools are they for. They should flag fake sites, not legit sites serving spyware. Regardless of the hack, the site itself was still the Bank of India site, and not a phished site. An iframe embedded in legit source is not a phishing scam. A toolbar that only checks for URL legitimacy would be correct in not flagging the site.

Re:Anti-phishing tools shouldn't be used to determ (0)

Anonymous Coward | more than 6 years ago | (#20437407)

LinkScanner from Exploit Prevention Labs protected against this. http://explabs.blogspot.com/ [blogspot.com] How? It looks only for known exploits, and it stops the driveby download from occuring. Solutions like this are the only way to reliably stop driveby downloads from sites like Bank of India, because a trusted site can be clean one minute and dirty the next. Reputation filters can't react in real time. You need an anti-exploit scanner.

Re:Anti-phishing tools shouldn't be used to determ (1)

(Score.5, Interestin (865513) | more than 6 years ago | (#20437621)

Anti-phishing tools shouldn't be used to determine which sites are good, they should be used to determine which sites are bad.
Maybe I'm misreading this, but it looks like you're advocating "Enumerating Badness", which is No.2 in the Six Dumbest Ideas in Computer Security [ranum.com] (it's actually a special case of the No.1 dumbest idea, "Default Allow"). Or did you mean something different?

Looks to me..... (1)

TW Atwater (1145245) | more than 6 years ago | (#20434969)

..like it only affects Windows users.

Re:Looks to me..... (2, Interesting)

jimicus (737525) | more than 6 years ago | (#20435521)

Maybe the malware it dishes out only affects Windows users. But if that part of the site has been compromised, what's to say there isn't also some surreptitious logging of user credentials going on?

now if it were me... (2, Interesting)

oblonski (1077335) | more than 6 years ago | (#20435007)

... I would implement the one-time password sent to mobile phone which is the method my internet banking site uses: you log in with card number, customer selcted pin and password

the login page also has BIG warnings: do not click on any links (relating to your banking or purporting to be) or give your banking details to anyone on the internet or in an e-mail since the bank or it's employees will never ask for it

then when you are on your profile page, before you can do any transaction at all, the site sends an SMS to your mobile with a one-time password only after entering this password are you allowed into your main account and can start banking i.e verifying your physical presence as well as being good security measure for online banking sessions

of course you need to set all this up with your bank beforehand, but with new financial regulations in south africa you go through a long process of verifying your identity and proof of address in person in a bank each year, so from the beginning this type of scheme has robust security

this has worked very well and i need to hear of an instance of it being circumvented other than criminals holding a gun to your head while you do your banking, which puts the whole thing in another category altogether

people who get scammed by clicking on links and falling for Nigerian type fund relocation schemes only has their own stupidity and greed to blame

only my 0.02

Re:now if it were me... (3, Informative)

mlts (1038732) | more than 6 years ago | (#20435183)

Banks, especially in the US, need a system like above for authentication, where its not just a single username and password protecting someone's accounts from total destruction. Some banks now use a system where you type in your username, it asks one of several personal questions, then your password, but that doesn't protect much against a keylogger, as an attacker can keep trying the questions until he/she finds the one that gets presented with an answer in the keysniffer's output.

PayPal, eBay, and Verisign offer a rebranded Vasco keyfob that one can use. Enter in username, tab to the password field, enter in your password, then append the six digit number from the Digipass Go 3 (the OEM name), and you are in. Though this is not as well engineered as a SecurID system, it still forces a would-be thief to have physical custody of the keyfob and the password to the account.

Some European banks use a system similar to the age-old one time password system found in BSD (S/Key or OPIE). You obtain a list of one time passwords on a piece of paper that you scratch off in the mail, and every time you log in, you scratch off the next one on the list. This can be attacked (there are some targeted phishing attacks to try to get users to type in multiple lines off the OTP paper), but it keeps a compromised user PC from becoming an entry point for an attacker.

Lastly, there are always Aladdin eTokens that store a private client certificate. This is one of the more secure ways, because there are zero passwords used. The server asks the client (any web browser pretty much) for a certificate similar to how a SSL enabled web browser asks the web server for its cert, the web browser passes the signing request to the eToken, the eToken signs it on the physical card (the private key never leaves the eToken), and the server checks the validated cert against the user list and lets the user in. For academic places (universities), this is one of the absolute best ways to do things.

All and all, probably the best solution would likely be a hybrid system, similar to an eToken NG-OTP keyfob, that allows a user to plug the token in and use it online with client certificates, or offline, typing the six digit number off the LCD screen.

Disclaimer: I don't work for Aladdin, RSA, or Vasco, but like their products.

Re:now if it were me... (0)

Anonymous Coward | more than 6 years ago | (#20435613)

One thing my bank does that is a little different variation on that:

When you sign up with online banking, you type in a phrase and select an image from a list, as well as setting up a username, password, and a group of security questions. When you log in you are asked one of you security questions, and then they present you with a page that has the image and phrase you typed in. The logic, I assume, is that nobody else will know what phrase you told them, or know what image you selected. *shrug*

Re:now if it were me... (1)

MMC Monster (602931) | more than 6 years ago | (#20437137)

Interstingly enough, when I created an HSBC direct savings account a couple months ago, it asked for two passwords. One I would type in after my user name. The other I had to click in using my mouse on a virtual keyboard on their website.

I have to do this every single time I want to access my account online. The second password sounds like it should be resistant to the average keylogger.

Re:now if it were me... (1)

mlts (1038732) | more than 6 years ago | (#20437605)

I thought a virtual keyboard would be the thing too, until I read on the anti-malware lists that almost all modern keyloggers also take compressed screenshots of when and where you click your mouse. Maybe a virtual keyboard that would work with mouseovers (hover the mouse for a couple seconds above each key) would be the ticket, as that would require FRAPS-like video monitoring by spyware (which would be a noticable bandwidth hit), and did not generate keypresses, but sent the mouseovers directly to the server.

A lot of on screen keyboard utilities generate keypresses that go through the keyboard buffer, where the OS, and malware can scoop them up, so having a utility that was directly connected to either an application, or just shipped the mouse locations directly to the server for parsing would be best.

How aggressive do you want rating systems to be? (1)

Animats (122034) | more than 6 years ago | (#20435149)

How aggressive should systems be about downgrading ratings for web sites? We've been struggling with this for SiteTruth. [sitetruth.com] In addition to SiteTruth's main function, checking business identity, we have some basic phishing checks. We download the PhishTank database every few hours. PhishTank has lists of bad URLs, but now that the smarter phishing sites change URL and even subdomain in each spam e-mail, blocking by URL is no longer effective. So we now flag the entire base domain.

This can have broad effects. Right now, we're blacklisting all of AOL (SiteTruth report) [sitetruth.com] and all of "live.com" (SiteTruth report). [sitetruth.com] Both AOL and Microsoft Live have redirectors which are being actively exploited [phishtank.com] by phishing sites. We can't tell their safe URLs from their unsafe URLs, so we have to blacklist the whole domain.

When a site with an open redirector plugs the hole, PhishTank will downgrade those "active phishes" to inactive. We'll then pick that up and rerate them within hours. But until they do, they're in the tank. The whole site.

Too harsh? Realistic? Evolution in action? Comments?

site under temporary maintenance (0)

Anonymous Coward | more than 6 years ago | (#20435397)

This message is posted on the BoI website: "This site is under temporary maintenance till further notice. Kindly bear with us."

Nearly all links have been removed.

I also noticed that it's "best viewed with IE 4.01 at 800x600. Who the hell is still using that crummy browser?

Re:site under temporary maintenance (1)

140Mandak262Jamuna (970587) | more than 6 years ago | (#20435935)

er, may be, the Indians?

Though many Indians now own PCs, they [I mean the PCs, not the Indians ;-)] are still considered a luxury items. Further the replacement time is quite large in India. Most people use internet cafes on a regular basis to access the net. So, yeah, there are plenty of old computers running old OSes in India, Pakistan, Bangladesh etc. So a bank site would still target a 800x600 screen. And then clueless managers will waste the screen real estate with useless stuff and links.

Bank of India? (1)

yams (637038) | more than 6 years ago | (#20438653)

Could someone please tell me about this bank? I had not heard of it until now. Is it really a bank? What would be the estimated customer base?

Re:Bank of India? (0)

Anonymous Coward | more than 6 years ago | (#20440733)

I don't know about details for this bank. May be you can visit their website to find more details :)
I know for sure that it's a legit bank, but not THE official 'bank of India' aka regulatory bank for the country. THE bank in India is Reserve Bank of India (www.rbi.org.in)

Someone made a big boo-boo!!! (0)

Anonymous Coward | more than 6 years ago | (#20440409)

Looks like these guys at Sunnet Berkerming didn't do their homework right... This http://blogs.zdnet.com/security/?p=487 [zdnet.com] article at ZDNet (who I have at least heard of before) mention the same incident, with a pretty screenshot showing how the plugin from Finjan correctly detected the malicious code on the website.

Sounds to me a bit far from providing "accurate, non-biased synopsis of security-focussed technology trends" as they claim on their site...

Re:Someone made a big boo-boo!!! (1)

CodeMaster (28069) | more than 6 years ago | (#20440571)

Ouch.

That must have hurt. Having a real journalist post actual facts that contradict your product pitch article.

Shame on you guys. BTW - anyone heard of these Beskerming before?
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...