Question

An advisory practice was the target of an attack, whereby the malware allowed the fraudster to gain access to an adviser’s login details for all systems he had used recently. The fraudster now had access to every website or account that required a login. This included personal banking, platform desktop software, Xplan software and Facebook. The next time the adviser tried to log in to his platform desktop software, he was locked out. He rang our account executive team to report his access was locked. He couldn’t login, even though he was using his correct user name and password. The platform reset his password. The next day when the adviser tried again to login, he was locked out of the system again. It became obvious that the adviser’s user ID had been compromised. At this point, the user ID was deleted.

1. Identify the malware attack experienced in the above scenario

2. What recommendations would you provide for preventing such type of attacks? The recommendations should be discussed individually for the scenario and should not be a general list of recommendations

Answer 1

1. Keylogger or Keystroke logger:

It records every keystroke entry made on a computer, without the permission or knowledge of the user.

Eventhough it has some legitimate uses, it is commonly used for criminal purposes.

It captures sensitive information like usernames, passwords, financial information, answers to security questions.

2. Prevention:

  Call the account executive team immediately if the platform access has been locked or you suspect fraud or malware on your system. They will suspend the login ID to ensure no fraudulent transaction can occur.

  Bring in a tech specialist immediately to run a security check and update security software and restore your systems back to normal.