Trend Micro calls for stronger banking authentication

Banks need to invest in more advanced authentication technology

Security vendor Trend Micro has warned of a new botnet doing the rounds in Belgium, which is being used to steal the log-in credentials of online share trading platforms in order to manipulate stock prices.

Referencing an article in Belgian newspaper De Tijd, Trend Micro's senior security advisor Rik Ferguson explained that the bot infected the PCs of customers of the the Dexia, KBC and Argenta banks between April and May 2007.

Having stolen the usernames and passwords of the online trade sharing platforms, the highly targeted attack was then able to "automate stock trades across the botnet", he wrote.

"Of course the criminals behind the enterprise went on to profit from the sharp changes in stock price of the penny stocks that were being manipulated by buying and selling their own shares at exactly the right moments in classic pump-and-dump tactics."

Ferguson went on to call for banks to invest in more advanced authentication technology for customers aimed at verifying the transaction.

"It is vital that any improvment in online banking security should verify individual transactions rather than simply authenticate the user," he said.

"The authentication token itself must be capable of accepting direct input relating to the content or the value of the transaction. This can then be verified by both parties and cannot be modified by the malicious 'man in the browser'."