Somebody tried to rip off my IB account and wire money to New Zealand

Status
Not open for further replies.
Scientist

Second your posting.

But I would say that XP is less secure than Win2000, there are some suggestions I made in an earlier posting in this thread. E.G. the PnP.

In addition you can encrypt your whole hard disk through the OS so that when someone installs another copy of the same OS they still cannot look at your sensitive information. See the link I mentioned in the other posting.

Kicking

Just remember that someone here in New Zealand was recently convicted and send to jail because he DISPLAYED in-appropriate porn on the schools PC (did not save it, but they traced that he downloaded it through the ISP and was still considered as possessing it....) Big Brother is watching you!
 
Quote from Scientist:

Now that's

About fault: Do you want me to be honest with you?
It's your fault. You're the fool.

You failed to provide adequate computer and online security to protect your assets, therefore you may not deserve them anyway. I don't need to investigate this, because I'm sure you had, otherwise you wouldn't have been attempted to be robbed.

Did you have either, all or any of these?

- Fully aggresively configured, exclusive-permission firewall?
- Internet via a fully encrypted and VPN-like proxy-masked secure tunnelling solution, such as Anonymizer?
- Fully functional and again aggressively configured virus & trojan scanning & control solution (Norton AV)?
- Specialized Pest/Bug/Spyware/Keylogger control solution, such as PestPatrol?
- Fully secured email solutions? Encryption of emails?
- Extensive encryption solutions for sensitive information, files, communications, hard drives etc, I.e. PGP? It's free and it's must.

I leave this to answer to yourself. Now let me ask: Are you guilty of any of the following?

- Using same passwords for different things
- Using as passwords words that can be found within your environment / life? (Social engineering target)
- Using passwords that don't contain both numbers and characters, including number-row characters and upper/lower case?
- Not changing your passwords regularly?
- Accessing sensitive accounts from public internet terminals?
- Not logging out from email account on the latter before leaving?
- Not making full use of privacy features, as given I.e. on Hotmail login? (If you use Hotmail, god beware)
- Using a system that is easily accessible/hackable because hard to restrict? If you must use Windows, XP Pro is your only choice! Period!

If you are a halfway serious trader, dealing money on the internet, every day, then you should know all this, or not trade!

If you walk through the Bronx at night in a suit with a suitcase that has "my trading money" written on it, and get mugged, is it the bad man's fault? LOL! It's your fault, big time! I think I can save myself explaining why.

Don't see the internet as any safer. In fact, it's a lot less safe than walking through a dark suburb at night. On the internet, anybody can attack you from anywhere at any time. You better go and get good armor before you use it extensively!

You can say you didn't know, but sorry, that's an obsolete excuse in the 21st century.

There's an interesting saying that's quoted even by the judges in Germany, it says "Unwissenheit schuetzt vor Strafe nicht."
Which translates about as: "Not knowing doesn't prevent you from punishment."

More quotes?

A fool and his money, will soon be parted.

If someone with money meets someone with experience,
the one with the experience will soon have the money,
and the one with the money will have the experience.

Always remember it. Being burnt is good, it teaches you. Experience is your greatest teacher, so honor it and act on it.
A mistake only becomes bad in the moment you fail to learn from it.
As it says in NLP: To FAIL = From Actions I Learn.

Blaming is always easy, but gets you nowhere. Stop blaming others (IB) and start taking responsibility. Good Luck!

This information was provided to you for free.

Scientist.
More...
Should I build a nuclear bomb shelter in the backyard as well?

Your obviouslu ignorant about business practices. A business, here in the U.S., is required by law to have controls in place. Since we know that this has happened before, they are aware that such a scenario exists. Therefore, IB needs to take steps to remedy it. It's funny that I have yet find any other malfeasance associated with this hack. It is the ease with which IB's controls make it possible for such an event to occur that makes the firm criticism worthy and exposed to legal action.

I am responsible for the hack. If the perpetrator had started trading in the account, that's my fault since there isn't anything IB can do to prevent that. There are reasons why limits are placed on transactions over the net(and in many offline as well, such as holds on checks), it is to prevent fraud from occuring. The blame shifts from me to IB's when they don't put in some sort of control to stop something that happens everyday on the net.

And also, if you would have read my posts(no wonder people think you're a jackass), I did take many precautions. Just yesterday, I scanned my system with an updated Norton and IT DID NOT FIND ANYTHING.

Quote from Option_Attack:



Trajan, a couple questions if you get a chance. I'm a little concerned that Norton didn't find the trojan.

1. Do you recall what trojan the hunter found?

2. What software did you use, was it TrojanHunter3.7?

Thanks
More...

1. It was something XVID something. XVID is a codecs like DIVX. I guess it came along with it when I downloaded it. Found a link that says the trojan came with from a Kazaa version, but I thought I downloaded from the developers site(I don't use Kazaa). There was a second one with a file called ALL.EXE in the windows folder, don't remember the name.
 
Quote from FX-Trader:

Something like that is already underway:

Secure Transaction Program (STP).

See def´s comments.
More...

Read Defs comments - Yes this type of technique is a good method to ensure security. The use of smart cards - where the identification algorithm is encoded in a piece of hardware - is an excellent way to prevent unauthorized access to an account.

We do this for certain systems within our company. Another technique adds the hardware and network fingerprint in addition to the use of the smart cards. A hardware fingerprint could be spoofed but the network fingerprint - in the way that we implement this patented technology - would be nearly impossible to counterfeit without the attacker having physical access to the originating network.
 
Quote from Trajan:

Just yesterday, I scanned my system with an updated Norton and IT DID NOT FIND ANYTHING.
More...

Your tone suggests you think that the problem was not your fault. However, the fact that you are relying on a virus scanner as your main tool for security defense makes you open to attack. Learn how to protect yourself. Don't download any nonessential files to your trading machine. Check your router's log of incoming/outgoing traffic for trojan horses. Understand that Norton's isn't a panacea.
 
I recently received my token device for generating a response to IB's challenge. I've previously used them and they are as fool proof a method of security as you can get. Any one can get one from IB at no charge (deposit required for some accounts).

There are only two ways I can think of to bypass this security. Method 1 requires having the account name and password to log into an account, stealing the device, and knowing the password of the device. That is, you're not going to loose money this way. Method 2 would be if you called IB to set up the wire, knowing personal information, etc. Do they even allow this or must everything be on-line?

As for a protective feature mentioned earlier about the receiving account having the same name as the IB account, in practice this is not a good control. In many countries the application of payments to accounts is automated and there's no guarantee (or responsibility on the part of the bank) to ensure that the account name matches the payee name. If the account number is correct, the deposit will be made.
 
ive been using the secure id cards for VPN access to our company for years. nice stuff changes your pin every 1 minute. sometimes the card can get out of sync with the login server but ive never had that problem.
 
Quote from CalTrader:



Computer systems can be compromised: yours probably was. The attacker probably grabbed your certificate and used this in combination with your password etc to change the email address etc.

There are however a couple of simple ways that this can be stopped by the vendor - IB or somebody else. One simple way to do this that comes to mind is to require additional information/steps upon any change request to the account information - Now IB already does this in a way using email but they could add another level of verification. This if course would increase their costs.

There is a relatively cost effective way to stop even a hacked account and that would be to use a hardware and networking your fingerprint that is uniquely identified with your workstation. This however would complicate the authentication system and add to costs - requiring additional workflow/business process steps.

I however believe that this type of system is a worthwhile investment and we have implemented it in our businesses where account integrity is of high importance and business value.
More...

your cost effective way sounds like big brother
 
Two things.

Change your passwords frequently. At least once a week. Make sure you have a different one for every account.

Do not enable any kind of "wire transfer" from your account. I know it is convenient, but it is inviting this kind of disaster. Do it all by check and mail if you can.

Have a dedicated "internet purchaces" credit card with a very low limit. Never give out the number to a "debit" or high limit card.
 
Quote from bobcathy1:

Two things.

Change your passwords frequently. At least once a week. Make sure you have a different one for every account.

Do not enable any kind of "wire transfer" from your account. I know it is convenient, but it is inviting this kind of disaster. Do it all by check and mail if you can.

Have a dedicated "internet purchaces" credit card with a very low limit. Never give out the number to a "debit" or high limit card.
More...

thats THREE things cathy..
 
Status
Not open for further replies.
Back
Top