We have been warned many times, advised to hide the hand while dialing our secret number when withdrawing money from an ATM. However, cloning credit cards or phishing is a criminal offense that doesn’t require the cybercriminal’s physical presence to access numbering scheme, expiration date and CVC number.

The methods used by criminals include, fake emails from the alleged entity asking to change the passwords or enter the pin, or hacked POS terminals which transfer the customers banking information. Once duplicated, card can also become a commodity between criminals, dealing with them in an online black market.

Neither the traditional magnetic stripe nor the latest chip installations have managed to slow down cloning. This latest technology seemed promising: it generates a unique code for each transaction, which hinders fraud.

Nevertheless, security experts at Cambridge University demonstrated that data phones and ATMs fail when producing random numbers. Actually, it can be predicted applying the needed methods.

Banks are looking for alternatives to protect their customers from possible attacks. The latest idea is eliminate credit cards (if something creates problems, what a better solution than to wipe it away) and replace them with mobile phones. If we are already able make transactions with our smartphone, why wouldn’t we be able to withdraw money?

BMO Harris Bank, one of the subsidiaries of Bank of Montreal Canadian, has launched the biggest ATMs network that uses this new system. In order to use them you don’t need to remember any password, or cover your hand while dialing the pin with the other one.

The entity’s customers only have to take out their mobile phone, download and register in to the banking application Mobile Cash. What follows it is nothing like the traditional method, of pressing the machine’s keys or the screen.

The app asks the user the amount he wants to withdraw and only saves the banking details during the communication with the ATM, where he must select the option Mobile Cash.

Then the machine generates a QR code, like the ones airlines or concerts halls use. Simply hold the smartphone so it reads the QR code and automatically orders the withdrawal.

Those who are for this system, maintain that it will speed up transactions and it ensures safety, since the mobile tool doesn’t store any banking information on your phone permanently.

A cybercriminal has to access your mobile phone and get the password you use in the banking application to freely manage the money in your account. Although some banks believe this is not an easy process, the issue may raise a number of concerns.

Every day we discover new cases of apps that without the user’s permission access certain personal data, information stored on other features and smartphones vulnerabilities and backdoors. How can an application guarantee complete security?

Withdrawing money through our smartphone is still not available worldwide. But when the possibility arrives we will have to analyze the possible consequences it may carry. Convenience and speed in transactions are not the only things that matters.

The post How to withdraw money safely without a credit card appeared first on MediaCenter Panda Security.

If you love downloading things of the Internet, probably you know uTorrent, one of the most famous clients of BitTorrent, which allows us to download files quickly and free. In spite of the annoying banners that constantly accost users. There are many webs where you can check how to eliminate these sponsored advertisements.

Nevertheless, Bit Torrent, with 150 millions of users per month, suffered strong reviews in the last few days because of their latest update design. As one user explained in the uTorrent forums, they had installed new software, without warning him. He only realized it when he saw that his processor was consuming more resources than it should.

In this particular case, the program that sneaked into his computer was EpicScale, a mining bitcoins software. To those who don’t know how the Cryptocurrency works, mining is the process that replaces currency issuance. Users offer part of their computer resources for the community’s benefit and then obtain some cryptocoins.

After the first message, many more users protested, ensuring that EpicScale was installed on their computers without them knowing it. Bit Torrent, uTorrent’s parent company, confirmed the service’s inclusion in the last update, but assures the users were notified. “We have reviewed the issue closely and can confirm there is no silent install happening…. Most likely these users accepted the offer during install,” the company explained.

Therefore, or users are mistaken or there is a lack of transparency in the system. After revising the whole process experts at Trusted Reviews concluded that because the system design, users were misinformed. Now, they don’t dismiss that the problem may be due to a faulty installation. So if you are uTorrent user check if it has also installed EpicScale and, if you want, remove it so it stops consuming your computers resources.

Some users stated that they couldn’t uninstall the program completely with the Control Panel feature “Add/ Remove Programs” nor erasing the program’s data. One of the recommendations already spreading through the Internet is to uninstall EpicScale with the help of CCleaner.

Another option is logically stop using uTorrent. Torrent Freak has already included a list of ten possible alternatives that you can use if you want to abandon this P2P client and continue downloading “torrents” safely: qBittorrent, BitTornado, Vuze or Tribler are some of the options available to continue downloading.

What can we draw from this? It is always advisable to read carefully all the steps in the installation wizard, just in case anyone tries to sneak a service partner, to consume your resources or for other purposes.

The post Do you use uTorrent? Careful with what it installs in your computer! appeared first on MediaCenter Panda Security.

In Origins, a movie released last year, appears a worldwide biometric signature file different to the fingerprint’s one; an iris readings record. Although this disturbing reality is still unthinkable, there have been many steps in incorporating eye scanners as a method of personal identification.

This technology is already being used in some companies to control their employees’ entrance and exit, as well as in corporations with strict security measures. But, its daily use is getting closer. Mobile phones manufacturers like Samsung, Nokia and Fujitsu have announced that their upcoming models will have an iris scanner among its features.

Maybe in the future it would be enough to peer at the screen to unlock your mobile phone or access some of its features. If so, you’d better check the pictures you upload on the Internet. Jan Krissler, expert in computer security for Telekom Innovation Laboratories, proved that some of these biometric systems can be evaded simply using snapshots taken from Google Images.

Krissler had previously exposed the vulnerabilities of fingerprint readers. In December he copied none other than the German’s defense minister, Ursula Von der Leyen

On that occasion he used the Verifinger recognition program to read Von der Leyen’s fingerprint, that he had photographed himself in a public event. Then he printed the result on a transparent surface, applied latex and there it was a fingerprint clone! However, he wasn’t been able to do further verification or testing.

This time, Krissler claimed he can do something similar with eye scanners without using his own camera. As we mentioned, you just need to search with certain premises in Google Images. The first one is that the target’s eyes must have enough brightness, as the researcher used a system based on infrared light, Panasonic’s Authenticam BM-ET200 which is one of the most extended technologies.

You also need a high quality image; size and clarity are important, to a certain point. In his tests he succeeded to use iris with diameters that did not exceed 75 pixels. It’s easier to deceive an eye scanner than a fingerprint reader, you don’t even have to make a clone, just print the picture and show it to the device, and it will mix it up with the real one.

Surely we all have a picture with these qualities, but it will never surpass the amount there is of any famous person, including politicians. Just type Barack Obama or François Hollande on Google and thousands of snapshots will emerge, of all sizes and shapes.

Krissler searched the faces of Vladimir Putin, Hillary Clinton, and David Cameron among others, before choosing Angela’s Merkel to carry out his verification. He chose an iris with a 175 diameter of the German Chancellor which Panasonic’s scanner recognize without a problem.

However, in an actual attack, the process wouldn’t end here, and the remaining steps are complicated. Accessing the biometric readers which Merkel or other politicians would use is not as simple as getting their picture.

Furthermore, although Fujitsu’s technology is also based on infrared light there are other methods, and there is the possibility to apply protection filters to the pictures. Despite these obstacles and reservations, Krissler wants his findings to be a warning to manufactures so they implement safety measures to future developments and to future users so they watch what they post, never better said!

The post Hacking Hollande, Merkel and Cameron’s eyes through their photos in Google appeared first on MediaCenter Panda Security.