How To Rob An Online Bank And Get Away With It

Ambitious!

"The subject of our dissection is an online bank robbery. 

Not the all-too-common attack against an online banking user, his computer and his identity, but an attack against the bank itself - or more precisely, against the bank's online banking application.

An online banking attack has four distinct phases:

1. Vulnerability Finding Phase
2. Vulnerability Exploitation Phase
3. Buying Time Phase
4. Extraction Phase..."

via ACROS Security Blog: Anatomy Of An Online Bank Robbery 

Account hijackers

If a message originates from a familiar name or email address, its likelihood of making it through spam filters is greater.

Google described their efforts to minimize harm to users due to email account hijacking:

"Our security team...saw a trend of spammers hijacking legitimate accounts to send their messages. [We developed] a system that uses 120+ signals to...detect whether a log-in is legitimate, beyond just a password."

Less than 1% of spam emails make it into a Gmail inbox.

Legitimate Gmail accounts blocked for sending spam versus time

The number of compromised accounts decreased by 99.7% since 2011. That's impressive, for a sustained reduction! How does Google avoid false positives? I am so curious about the specific details of their filtering rules!

The blog post was written in March 2013. It is remarkable that the same methods continue to be effective, as Gmail spam-attackers would perceive this as a new challenge to be overcome.

120 Signals

I suspect that Google's methods are analogous to those used by the U.S. Department of Health & Human Services' Centers for Medicare & Medicaid Services (CMS) in detecting medically unlikely edits (MUEs). MUEs can be accidental, due to claim coding or data entry errors. MUEs can also be deliberate, when there is fraudulent intent, e.g. by filing for more services, or for more expensive services. Regardless of intent, MUE identification reduces paid claims error rates.

How will the Affordable Care Act impact existing processes for detecting MUEs, and for setting benchmarks? CMS does not disclose its MUE criteria for the same reasons that Google will not reveal details about their 120 signals.

Continuous improvement is a part of life, for email-spam account hijackers, Google and the fraud detection team at the Centers for Medicare and Medicaid Services.

I wrote a post about health care, with a much more Ellie-centric theme, a few years ago. That was when I worked as statistician for ACCCHS, Arizona's state-administered Medicaid/Medicare program, monitoring program performance and quality of care.

FeedBurner Security and Sensibility

Universal Feed Symbol

Feed Security

For any blogger or creator of syndicated content who might happen to pass by The Annex, I'd like to pass on this tip about the importance of keeping your Feed Bulletin feed private.

Feed Function

Confirm that your feed is working correctly and captures the intended content, whether headlines only, headlines plus content etc.

The best way to accomplish this is with a periodic feed check-up. Once every month or every other month is usually adequate.

Two reputable sites offering secure feed validation are:

• World Wide Web Consortium Feed Validation Service, a free service that checks the syntax of Atom or RSS feeds,
• FeedValidator dot org, a validator for syndicated feeds. It works for RSS feeds, versions 0.90 through 2.0. It also validates Atom feeds. 

To use either, simply enter the address of your feed and click Validate. Any errors are listed, with suggested remedies for repair.

Feed Sense and Faux-pas Avoidance

Problem: Why is the Posterous website overstating my subscription count? I only subscribed to ten blogs. Yet my profile indicates that I have 20 subscriptions! See image below.

Root-Cause: Carelessness by the blog owner or administrator! Note that the blogs written by journalists, who earn their living through digital publishing, have but a single entry on the list. The Laughing Squid is the only exception. He has two entries. One is a link recommendation list. The other is the actual publication. It is possible that I am at fault for selecting both rather than the blog (publication) alone.

Screen Shot of my blog subscriptions.  Click on image to enlarge.

The other websites are run by experienced bloggers or website developers. They are not journalists, nor earn the majority of their income from writing. Yet they should know better than to make this mistake. But it is a very easy mistake to make, even for the savvy.

How did this happen?

This can occur if burning multiple feeds for the same blog, but forgetting to delete the old feeds. Or creating new blogs, and not tracking carefully enough which blogs have feeds already. It can be avoided by taking care to keep track of the names and resources used for one's feeds.

Glance again at the example image. Despite my fondness for Adam Rifkin's wit, I don't need four versions of his blog. Some are very puzzling e.g. who is "Trout Girl"?

The same can be said for Dustin Curtis's design and usability insights. One subscription is sufficient. This is how an unintentional spam-like duplication (or quadruplication) effect can occur, sometimes exacerbated for those who choose to subscribe by email rather than RSS feed. Such effect is one of the fastest ways of alienating readers. I have first hand experience, inflicting this (accidentally) on my own subscribers!

Note that all individuals mentioned by name are prominent in their fields of expertise. I did not disclose information, nor negatively impact professional reputations. All are well-established.

Better to learn from their mistakes. It is far more damaging for a novice to commit feed faux-pas!