Following the recent ATM hacks and the ‘Zeus’ malware affecting the public and financial institutions in Malaysia, Symantec is offering a list of preventive measures when making public transactions online and over ATMs.
For ATM transactions:
- Be on the lookout for suspicious items on the ATM Machine that could read your card or PIN
- If possible, try to cover the PIN pad when keying in your PIN to avoid reading from overhead cameras
- Avoid ATMs in isolated locations and be wary of who is around when making transactions
A number of measures could be taken by the financial institutions to make things more difficult for the criminals. These include:
- Upgrade to a supported operating system such as Windows 7 or 8 and ensure they are patched
- Providing adequate physical protection and considering CCTV monitoring for the ATM
- Lock down the BIOS to prevent booting from unauthorised media, such as CD ROMs or USB sticks
- Using full disk encryption to help prevent disk tampering
- Installing Antivirus to prevent malicious files being written
- Install Host Intrusion Prevention Systems to prevent unauthorised access to the operating system. This is especially necessary if running older, unsupported O/Ses (e.g. Win XP).
With all these measures in place, attackers would find it much harder to compromise an ATM without a complicit insider, Symantec said.
The leading online security company also gave the following advice for smartphone and PC users.
For online transactions:
- Avoid performing banking transactions using public WiFi networks
- Install security software on you smartphone and desktop computer, and make sure subscription for updates has not lapsed
- Update your desktop computer’s operating system and web browser with the latest security patches
- Turn on their operating system’s auto update feature. For manual updates, turn on the auto update, at least once a week.
- Check online banking site if genuine by double checking the web address; modern browsers can detect if a site is authentic but check the web address again to ensure you were not rerouted to a phishing site
- Do not share phone number and sensitive information online via email, IM or chat, even if you receive e-mails purportedly from your bank asking you for these information
Over the past week, a Latin American/West Asia gang is believed to be behind several incidents of Automated Teller Machine (ATM) hacking in Malaysia involving about RM3 million being stolen from banks in Kuala Lumpur, Selangor, Malacca and Johor Baru. The banks that were targeted are Affin bank, Al-Rajhi Bank and Bank Islam.