Live on Bloomberg TV

00:00Hi welcome to Digital Defense. My name is Jordan Robertson . I'm a cybersecurity reporter with Bloomberg News in Washington D.C.. This is our weekly cybersecurity webcast. And as always this is an interactive show so we encourage you to write in with any of your questions either about this week's topic or any topic on your mind about cyber security. This week we're going to be talking about online banking you know specifically with all the news of of hacks going around you know how safe is it really to to access your money online. I have a couple of pretty simple answers but also some tips and tricks you know to make that make accessing your money online even easier. And again we're broadcasting live from Facebook and Periscope. And if you have any questions please feel free to write him in the comments section below or you can tweet to us at technology. That's the Bloomberg Technology Twitter account and we'd love to hear from you there . So I want to get into this topic by way of anecdote. You know a couple of years back a cyber security firm named Kaspersky came out with a really interesting report about a you know a very advanced group of cyber criminals. And you know the possibility that they had stolen a billion dollars a billion U.S. dollars you know from banks around the world. That figure was subsequently disputed the cyber security community some in the community. Question whether that was an accurate number . But for the purposes of this discussion let's leave that to the side. I mean you know at the very least what Kaspersky disclosed and discovered was a highly advanced bank hacking operation that really shows the future of you know what are the threats that banks face. And you know and by extension you know what are the threats that you as a consumer and a user of thanks . You know what kind of threats do you face what kind of threats to your money face. So I want to walk you through with that example was to give you a sense of what really the state of the art looks like these days in terms of you know what banks need to be worried about and again by extension what you need to be worried about. So the group that Kaspersky identified was called Carbon act this is a worldwide hacker group. But the reason I'm bringing them up is you know what they did was so interesting because the way we tend to think about bank cyber attacks is that they attack individuals accounts. So somebody is going to attack my account drain the money get somebody to cash it out somewhere and then you're left you know you're left with a drained account. That's typically the way you know bank hacking has been understood what these groups you know where their primary innovations was you know they found many different ways to drain money from banks. And that's why according to two Kaspersky you know they were able to amass you know as much as potentially a billion dollars from these thefts. And the way they did it is this again the way we typically this is a graphic that Kaspersky produce a very good marketing division and PR division that produces these things and it's pretty helpful . What you're seeing here is the most important thing here is what's on the right side there four different ways that this group drained money from. From victim banks and only one of them was you know targeting individual account holders what they were really after was the banks money not individuals money that's a lot of work to compromise individual accounts. They wanted the banks money. So what they did you know was the first one is the most basic online banking taking money from somebodies account and transferring it to accounts held by the criminals. But the other three of the most interesting and what I really think is relevant for viewers of the show in terms of understanding how the state of the art hackers think about attacking banks these days. And again any questions you have feel free to leave them in the comments section or tweet to us at technology will happy to answer questions about this or other topics as we go along. So here are the three other ways that attackers in this case you know drain money from banks. One of them was payment systems so they compromise kind of the bill pay systems of these banks and they transfer money the banks money from one place to the other because you know banks of course have you know have have constituents and clients as well not just individual consumers but banks banks pay other banks lots of money all the time. So the attackers compromised that's that those systems to transfer money to accounts they control. This one I think is really interesting. They would you know by attacking the underlying databases the banks underlying accounting systems one of the things they were able to do is falsely inflate people's accounts. So if you've got one dollar in your account they would say you've got ten thousand dollars in your account. They would skim off the difference and transfer that to an account that they control. So the individual account holders never know that something's happened unless you were you know it gets unfortunate enough to be logged into your account when something's adding adding money to it which most people wouldn't find a big problem with. However again what the attackers would do is they would check they would tinker with the bank's actual accounting systems at money to people's accounts and trick the banks into believing that these were legitimate transfers to accounts under the best hackers control. It's a very clever system and one that the individual consumer would never catch. But it's the bank's responsibility to catch. And then you know the thing that got the most headlines which is kind of the most visual is the attackers figured out how to compromise certain A.T.M. machines. Now these were not by creating skimmer devices and creating fake debit cards which is the common way that attackers have hacked ATF machines what they would do again is these attackers are very high level. They were after the underlying databases that controlled these systems including HCM. So one of the things that they would do is they would trick the atoms into thinking that that it was that that what need to happen was a withdrawal . So they would basically tell the atoms you know in cybersecurity the rule of thumb tends to be that if you can if you could trick a system into introducing an error any error basically if you can control where that error is and how that error occurs you can command computers to do all kinds of things that they shouldn't normally do and in this case with a command of the computers to do was to spit out cash literally spit out money you know at the at the whim of the of the attackers. So you know with all of these with all of these different types of attacks you know that gives you kind of a sense of this is again this is a state of the art in terms of how attackers think about hacking banks. It's not just I want access to your account . It's I want all of these different things to happen and I'll show you a map here as well. I mean this this particular group and again this report is you know a year and a half. But I think it's really illustrative of the threat. You know these are where all the banks were that this that this group targeted we're getting some good questions so I will I'll get to these and again you can leave your questions in the comments section or tweet to us at technology. The question here is when I'm travelling and I log into my online banking app on someone to watch someone's Wi-Fi. Is that safe. We're going to hear me say this a lot. I'd envy anybody who's viewed this shows before knows the answer to this. There are a couple of different answers to this one if you have what's called two factor authentication on your bank account which you should know that means you'll get a text message anytime somebody tries to log into your account just as a general principle. That's a really good safeguard to making sure that somebody doesn't log into your account as you if they steal your password. You know that being said that's just a good kind of Internet hygiene principle to follow. But the question here is specifically referring to someone else's Wi-Fi. You know the thinking has evolved and practices have evolved around this issue of using public Wi-Fi public Wi-Fi is still dangerous. You know public Wi-Fi is a public space on the Internet and you know that means if you connect to the if you connect your computer your phone to a public Wi-Fi network there is a possibility of hacking. But I like to tend not to think in terms of you know isn't advanced attack are going to be sitting there waiting for you to log on . You know in most cases most banking apps these days do have good encryption you know on those connections. So what you're really concerned about is if somebody is sitting on that Wi-Fi hotspot you know can they see me typing my password into the banking banking Web site or the banking app in this case you know chances are your bank app as long as it's kind of a you know a modern bank that you're with is going to have encryption so you don't need to worry about somebody stealing your password that way in most cases. And also if you have to factor authentication even if someone does steal your password if they try to log onto the Web site you'll get an alert and you'll be able to deny deny them that ability. So don't necessarily assume that public Wi-Fi you need to stay away from it which is what we kind of you know caution people to do. Years ago the thinking has evolved as encryption has evolved as well. IBEX question here is is it safe to close your banking app without logging out. Or should we be logging out every time. Well as luck would have it you know most most banks and most sophisticated technology operations banking operations they're logging out automatically you know and that's for this very reason it's not so much because they're concerned that somebody will pick up your phone or log onto your computer and log into that app. They're more concerned about something called Cookie hijacking and what that means is actually to the previous year question. If somebody can steal the cookie that authenticates you to your banking app or your banking Web sites say from a public Wi-Fi hotspot you know in theory they could go back after you've you've left the machine and log in as you. It's a kind of complicated attack but one that we saw actually used against Yahoo when they lost a billion user records one of the ways those attackers worked was they were able to manufacture their own cookies to kind of pre authenticate themselves into people's accounts. So most banks are going to lock you out you know kind of on on your own. So it's not something you should generally worry about . But you know good security good internet security hygiene is to log yourself out just in case of find your phone or in case somebody has stolen that authentication credential that gets you into that account. It's just a good practice but it's not. It doesn't necessarily need to be top of your list because of those precautions that are put in there. Next question is what about Venmo is that safe. I haven't looked specifically at that app but I know it's a it's a popular one and a lot of people use it . I would say this in general in general you know part of the issue with some of these peer to peer systems is that you have to link them to your bank account. In most cases on its own it's not terrible. I mean PayPal you know many people have their bank accounts linked to their PayPal PayPal has been around a long time. They have what the industry has generally regarded as very good security. So the only thing I would caution you about in regard to these new apps is you know linking something to your bank account is always potentially a risky thing because you know the app security the third party app security you know may not be and probably isn't as secure as the actual bank itself. App banks spend even more money than almost any other industry on cybersecurity. They're not perfect but they get hack a lot and they get attacked a lot and they're used to deflecting some of these attacks. So whether it's vendors or others again I haven't looked specifically at the security of them or I would just be wary a little bit leery of linking those to your bank accounts directly. If there are ways to add money to those those accounts and those services without looking at your bank account. I think in general that's usually the safer bet the safer way to go until the apps get pretty mature. Next question is a lot of apps ask for your credit card info now ahead of time like Uber. Is that safe. Well again this is another area and one of the benefits I think of the show in highlighting is that it used to be if somebody stole your credit card you were in for months of hurt and discomfort because it would just take you know countless hours to call retailers and call your bank and call anywhere that somebody misused that credit card. Now you know credit cards are one of the least impactful things that a hacker could steal from you . So again there's been this switch and I think a big reason for that is because you know banks and retailers and others have gotten really good at detecting fraud and even more than that you know they've gotten really good about reimbursing people very quickly when they've been the victims of fraud. So you know in terms of giving a credit card to an app like Uber again I would say like it doesn't need to be the highest thing on your list in terms of something you need to be concerned about because we've all been contacted by banks you know saying hey your credit card number has been compromised by some retailer some gas station you use it at you know 10 years ago or whatever we're sending you a new card. I mean it can happen within a day . So I really wouldn't worry about that too much but you do need to pay attention to your credit card account. I mean that's one of the responsibilities of having you know any of these any of these devices in any of those those tools like a credit card as long as you stay on top of your account and you watch for suspicious activity that's always going to be your best defense . Next question is what about depositing checks via a mobile banking. I am actually a big fan of this technology because if it saves you the risk the physical real world risk of actually going to a bank with a check in a bank account and a card and logging into the account. So I think you know sparing yourself the risk of actually having to go to an A.T.M. where many crimes do occur because people are people even if they don't go there with the intention of withdrawing money you know the ability of yourself to to put your card in the machine and then authenticate yourself via opinion or fingerprint whatever it is that's really valuable to the criminals so there are lots of cases where people are assaulted at 80 ends. And I think you know eliminating any of that risk. Again it's not a hacking risk versus it's a physical world risk. I think it's actually a really great thing. But you do need to keep on top of the banks you need to make sure that they've registered the amounts correctly but the machine learning that machine vision computer vision technology that does it is really simple and it's really good it's not like it's trying to detect faces it's just detecting numbers on a piece of paper. So that's actually not the hardest technology problem in the world. So generally they're pretty good. So yes I'm an advocate of depositing checks via mobile banking where you take the picture. I think it's a good I think it's a it's a good practice. How secure is PayPal. Well I address this a little bit earlier. You know I don't have any special insight into whether PayPal is more or less secure than the banks that you know that you connect to your accounts to. But what I do know is this that PayPal have been around a long time. PayPal has close ties to the U.S. government. It works very closely with law enforcement you know and it's it's just seen so many attacks over the years. So just by nature of being around as long as it has you know any company that's been around a decade or longer and any company has been around a decade or longer and exists in the financial services sector you know it's gonna get really good at figuring out what the hackers are after and how they get into their systems so it doesn't mean they're perfect. I mean tomorrow we could see some major paper CAC that you know that nobody else saw coming but I would say it just in general. Organizations like that at that scale and size they have they tend to have very good security protocols built in. But again I'd say and I say this all the time. You can't depend solely on the company to protect you or your data 100 percent. You've got to set up the two factor authentication. You know I know I sound like a broken record on it but it's impossible to overstate how important that is because what that does is it is it makes it a lot harder for anyone to log in as you and transfer money from one place to the other because hackers can get into these systems and and and it just it's really helpful for you to have some measure of control and two factor authentication does get you that next question here is it safe to use eBay or Alibaba on your phone. Know I don't really draw a distinction between some of these services again you know not about the business of recommending a specific service. Know one over the other but what I will say is this again established longstanding companies like like eBay you know Ali Baba. You know they just they just tend to be more mature of these things and they have more budget. You know one of the concerns is you're talking about startups of your earlier asked Buck Venmo and other apps. One of the concerns with a startup is just that the technology may be great. Technology may be really cool but startups are in the business of building a startup. They're not necessarily in the business of security . Now some certainly do a better job than others at it but you have to think of what the business priorities are for a startup and in general it's not security in general it is just building the company and getting customers. So when you talk about established companies they do have budgets they do have lots of I.T. security professionals and most importantly they have relationships with law enforcement you know to where they can get good insights and good intelligence about you know ongoing threats and ways to protect themselves and by extension their their users in terms of whether it's safer or not to use it on your phone versus your computer. You know the technology is there such that to me it's kind of a distinction without a difference these days. You know mobile networks in some cases are actually more secure than your home router. It's not something I would really worry about too much though especially if you're doing it over a cellular connection which is like it's just harder to hack. So let's see here is the next question here is when we allow any applications such as games to access browser cookies and an Android phone and we have bank apps and the same phone. Is there a security issue. What's the what the viewer is asking I think is essentially you know when you if you allow an application to access or to place cookies on your phone for one service you know is that a potential hacking risk for another. And I hope I'm understanding the question correctly . And I think there's some value in this question. You know in general my kind of layman's understanding of how this works is that you know the cookie the authentication token as it were that any site sets you know is going to be unique to that site and that's service. So you know in theory a cookie for one service you know it's not going to get you in to a different service is not going to transfer from one service to another . So let's say a cookie for you know Gmail is not going to log you into your Yahoo account you know and hackers are always finding ways around these things. But in general I you know this does tug touch on the topic and I am very interested in that which is you know apps require you in many cases to give more permissions than you're necessarily would be comfortable with. And most of us we click through because you want to download the app you want to just get to it. So you don't really have a choice. So it's kind of like a false choice that you know these apps are telling you you know do you allow this app to access this data like if you download the app you obviously want it. So I would love to see statistics on the number of people who actually say no I don't I don't approve of those positions those those permissions and I'm not going to I'm not going install this app . My guess is that the vast majority people just click all the way through. And the problem with that is not so much that a hacker can bounce from one app to another which again I think is what the viewer is asking the bigger question for security and for privacy is that many of these apps collect data that they don't even know they're collecting. So these startups which again are focused on building a company and creating interesting technologies in many of these cases and we've seen this we've talked to founders of startups who say you know I design the technology to collect collect X Y and Z data but I wound up collecting all kinds of things like G.P.S. location like you know browser cookies like search histories like all of these other things that they didn't necessarily know that they were they were collecting. So to me that's almost a bigger issue because you just need to be aware if you've got a million apps on your phone that's great. Hopefully enjoy the technology you know but many of these apps can collect data that even the owners of those companies are not aware of which is crazy as it sounds it does happen and it happens a lot. And the result of that is if those companies get hacked and again these tend to be smaller companies or individuals that data such as location and things like that such as search history. It could look that way . So just something to be aware of. We're getting a lot of great questions. Thank you for for sending these in again you can leave him in the comments section or tweet to us at technology and we'll get to all these. A lot of people are commenting that Bitcoin is a solution to all of this. What are your thoughts. So Bitcoin is a really interesting technology . I mean you'll hear lots of people talk about Bitcoin being the future of banking period. And you know one of the reasons for that is that there is what's considered a public ledger in Bitcoin. You can see you know there's a finite amount of bitcoin in the world right now. And you know bitcoin mining operations as they're called you know it takes a lot of computing power and a lot of advanced mathematics to create more bitcoin. So there is not only a finite supply of the. Of the digital currency but also most importantly from a security perspective. Is this idea of a public ledger and what that does is it allows any entities exchanging bitcoin you know to assure some degree of authentication about the transaction. Now there's a big asterisk here is that you know some viewers many viewers may recall the big one to cry ransomware you know of a week or so ago. And I've talked to a lot of security experts about it and they say one of the reasons we're seeing these really big ransomware attacks where hackers you know infect your computer encrypt your data and demand usually some kind of small payment of one hundred dollars or two hundred dollars whatever to decrypt your data. The reason we're seeing many more of those is because of the rise of digital currencies such as Bitcoin. So while there is quote unquote a public ledger if you're a criminal and you're registering accounts that are not in your name they're not on computers that you actually have associated your personal identity with. There are many many advantages for criminals in the anonymity that digital currency can't afford as well. So really it's a double edged sword. I'm very interested in the technology because of this idea of the public ledger. Many banks are as well you know because one of the hardest parts about financial services when it comes to preventing hacking attacks and things like that is authenticating that the people receive sending and receiving money you know are legitimate legitimate individuals and not criminals. Bitcoin is a potentially interesting way around that problem. But again you know with any technology especially security related technologies there are often it's often a double edged sword and I say this to people all the time. You know many defensive cybersecurity technologies can also be used for offense because the best defense in cybersecurity is a good offense you've got to know where the holes in your network are . Same is true with digital currencies and things like that. So there's no apologies. There's not a clean easy answer to that question. But I do think there's a lot of promise and the technology was designed in such a way that you know all the major banks are very interested in it for that reason. It's a really great questions here. So many people rely on online shopping now rather than going to a physical store. Do you have any safety tips for online shopping on your phone. Again I'll sound like a broken record. Two factor authentication you know because online shopping is so easy and because some criminals have decided it's just far easier to traffic in to fence illicitly illicitly purchased goods such as you know I break into your Amazon account and I order myself 10 flat screen TV and then go sell them you know into the into the criminal underworld you know it really does benefit you to have the same protections that you would on your online banking accounts in your e-commerce accounts as well because criminals are not just interested in money they're also also interested in expensive electronics and other goods that they can sell. Next question here is it possible to completely erase my digital footprint when terminating accounts with apps like Venmo. Well when you delete those services if I think I'm understanding the question correctly Neal there's always going to be these companies will always have your data and companies you know have different policies regarding data retention especially girls here's the trick when it comes to financial services and things like money transfers. I don't care what app you are. Any company is going to be very very afraid of getting a word from the Federal Government for information related to potential money laundering using your service. So by default these services are going to keep lots and lots of records unless they're designed for security or privacy. But again that raises potential issues for them because if the U.S. or some other government slaps them with a warrant for information and they believe criminals or worse terrorists are using these services to transfer money. And again this is not a commentary I'm Ben or any other app specifically. These these organizations tend to keep very good records in some cases they keep good records because the government has demanded that they do so. So just because you're racist doesn't mean you've eliminated any record of your transactions but again apps do you record data differently. But when you when it deals with when it comes to financial services there's just going to be lots and lots of record keeping because companies need to protect themselves . And that's just a reality of the world that they live in. So one to thank everybody for. For writing in. We've gotten some really interesting questions are this a topic that I think is really valuable broadly and one that we're going to be revisiting. Because you know we all of these apps we all have these smartphones and there are lots a lot of questions about you know should I feel secure entering my social security number you know into this app or my bank account number and things like that and hopefully one of the value some of the value of this show is is is letting you know when you're thinking or when the conventional wisdom has changed on some of these practices such as Wi-Fi and credit card numbers and things like that. So we're always happy to take your questions offline as well. Please feel free to tweet to us at technology. You know my Twitter account is at Jordan are 1000 general RDA n the are 1000 and please do feel free to log onto our Web site which is Bloomberg commodities edge technology where we've got a great podcast called decrypted you know my colleague Mark Gurman has a great site webcast as well called gadgets with German and and we're gonna be we're gonna be back here next week at noon Eastern. So thanks for watching. And you know look forward to doing again next week .

No schedule data available.

Is Mobile Banking a Good Idea?

Digital Defense is a live webcast featuring Bloomberg Technology cybercrimes reporter Jordan Robertson. This week, Jordan takes a look at mobile banking and how safe it really is for us to access our accounts and make transactions from our smartphones. Jordan will take questions from the audience. Watch every Thursday on Bloomberg.com, Facebook and YouTube. (Source: Bloomberg)