Cyber bank robbers attempt billion-dollar heist, targeting your money

The next Internet billionaires won't be pushing social-networking apps. They'll be breaking into your bank accounts.

An organized global cyber crimewave has been underway for months, according to a report released today from security firms McAfee and Guardian Analytics, attacking banks in Columbia, Germany, Italy, the Netherlands, the United Kingdom and the U.S.

A total of roughly $78 million was successfully siphoned out of bank accounts, according to researchers, with a potential total of $2 billion attempted. (Banks are understandably loathe to reveal losses and due to additional security concerns have not been identified.)

Analysts at the firms report that these thefts represent a new generation of attacks running off of hijacked servers that can be frequently changed to avoid detection and completely automated so that thousands of customer accounts can be broken into without even raising the owners' suspicion.

By adapting two types of malware designed to steal passwords -- known as Zeus and SpyEye -- hackers can now invisibly record login information and add additional requests for information on what appear to be valid online banking pages. They can even intercept secondary, one-time only passwords, and then put the user on hold while they login and transfer funds to criminal accounts. After the transfer is complete, the software can even post false balances so that the victim is unaware of the theft until it is too late.

What is different about these new attacks is their high level of automation. It allows organized cyberattacks that can drain just a few dollars from multiple accounts without any intervention by the crooks. Furthermore, according to McAfee, the criminals look for large account balances -- hence the researchers dubbed the crime spree "Operation High Roller." In at least one case, the criminals made off with $130,000 from a single account.

The moral of this latest cyberscare story is that you cannot rely on your bank or financial institution to protect your money. In many cases, the financial institution's profits are sufficiently high and the investment in additional computer security measures considered too expensive to prevent many of these attacks. As some analysts have told me, it's considered part of the cost of doing business. Just make sure it isn't your cost of doing business online.

First, you have to run some sort of anti-virus software. There are free basic versions out there from the likes of Avast, AVG, and BitDefender. Many of these monitor new threats and will warn you about suspicious Web pages.

Second, never, ever, ever open a link in an "official" e-mail message you receive. This is the primary way criminals lead thousands of users astray every day. If you get a message from your bank, open a separate browser and type in the URL that you usually use. It's the only way to avoid being led astray.

Third, update your software: in particular the Web browser you're using and Sun's Java and Adobe's Reader software (for opening PDFs). These programs are the favorite targets of hackers and new exploits are uncovered every week. Keeping them updated can often prevent so-called iFrame hacks that may compromise legitimate Web sites and secretly install malware on your computer. So instead of watching that Tree Girl video, check for updates whenever you have a spare moment

The computer security threats are clearly endemic, prompting the head of Britain's spy agency,  Jonathan Evans of MI5, to coincidentally come out this week to warn that the level of cyber attacks is now "astonishing." Evans warned that the scale of such threats has now reached "industrial-scale" proportions.

So it's no longer a matter of paranoia to check your software and Web surfing habits. It's a matter of common sense.

Follow John R. Quain on Twitter @jqontech or find more tech coverage at J-Q.com.