Vodacom at centre of banking SMS scam

Vodacom did warn that “due to the immediacy of online banking, consumers are reminded to keep their online banking details secure from any third party”. This advice is however unlikely to put Vodacom subscribers’ minds at ease when the cellular provider itself was partly to blame for the security breach of their clients’ accounts.
Click to expand...

secure from any third party? like Vodacom employees?

also want to know if Vodacom will pay back the money stolen with the help of their employee? (their employee's help was presumably key for the scam to work)

deduct the money from the director's salaries, or the managers in charge of security
 
Surprise surprise - inside jobs are not as uncommon as people would like to believe... it happens at banks, why should it not happen at your phone provider?

ID Theft etc is more likely to happen at the phone provider IMO - they don't have to toe the line like the banks do. They simply shrug it off and carry on.
 
“Vodacom has implemented additional security measures, to ensure that this type of fraud does not happen again,” said Dot Field
Click to expand...
This might be a little bit OT, but why does she not change her name to something like Slash Park, or Comma Meadow? I'll think even Hyphen Lawn is a better option....

Anyways - that is on a lighter note. Not all is gloom and doom ya know.
 
Its not south african enough Roux...
How about Punt Veld
 
Every day when you log on to your banking site you expose yourself to a man in the middle attack [through SSL]. Sure, it's a lot more difficult to impliment but conceptually it's the same thing [in a way at least].

It's a risk we're all fairly comfortable to live with, since, not much can be done about it because at the end of the day, someone will still have access to whatever is being protected. The only safe way of dealing with information is not to tell anyone, not to write it down and not to need it. Clearly we need this, so in this instance we'd have to put our faith in Vodacom to minimize the risk of it happening again and to work with the SAPS [and others where needed].

More importantly I'm happy that the employee has been taken into custody and that he/she is ultimately held responsible for this fraud, to me, it's the positive in this case.
 
Lazy said:
Every day when you log on to your banking site you expose yourself to a man in the middle attack [through SSL]. Sure, it's a lot more difficult to impliment but conceptually it's the same thing [in a way at least].

It's a risk we're all fairly comfortable to live with, since, not much can be done about it because at the end of the day, someone will still have access to whatever is being protected. The only safe way of dealing with information is not to tell anyone, not to write it down and not to need it. Clearly we need this, so in this instance we'd have to put our faith in Vodacom to minimize the risk of it happening again and to work with the SAPS [and others where needed].

More importantly I'm happy that the employee has been taken into custody and that he/she is ultimately held responsible for this fraud, to me, it's the positive in this case.
Click to expand...
Actually, a verified and TRUSTED SSL certificate is provided by a company where the employee's are actually physically separated from each other, and the knowledge required to duplicate one certificate would require at least 3 employee's to work together at great risk and with obvious procedural changes.

The entire layout and flow and process of a TRUSTED company, and the audit processes are something to be admired.
 
davemc said:
Actually, a verified and TRUSTED SSL certificate is provided by a company where the employee's are actually physically separated from each other, and the knowledge required to duplicate one certificate would require at least 3 employee's to work together at great risk and with obvious procedural changes.

The entire layout and flow and process of a TRUSTED company, and the audit processes are something to be admired.
Click to expand...

There are various ways of implimenting man in the middle and all of them have very stingent requirements. But lets not get sidetracked with hacking techniques, I'd enjoy it too much and derail the thread completely.

My point was that even if the company has proper auditing, is to be trusted etc etc, at some point in the process someone will still be involved at a low-enough level to have access to some form of data that can be harmful. It's unavoidable really. The checks and balances need to be in place to detect that as soon as possible, which is not always easy either.

Which is why I'm happy they have the suspect in custody, because it means that the process is good enough to identify the culprit, which is well above what would probably be minimum requirements to be [fairly] responsible.
 
I have always said that SMS banking is stupid...they are way too easy to hack! I want our banks to get OTP tokens! From a quick google there is even an SA group that is doing this. www.fireid.com.

I also hate recieving like 5 SMS's when I log into absa banking to do a transaction. then I have to spend like 30 seconds deleting all the messages after I'm done.
 
confused about going to vodacom or staying at mtn, either way you lose money.
 
Lazy said:
<snip>Which is why I'm happy they have the suspect in custody, because it means that the process is good enough to identify the culprit, which is well above what would probably be minimum requirements to be [fairly] responsible.
Click to expand...
Yep yep yep!
But .. I am still wondering if any have managed to slip through the cracks.
We're not receiving assurances to that song yet.
 
Lazy said:
There are various ways of implimenting man in the middle and all of them have very stingent requirements. But lets not get sidetracked with hacking techniques, I'd enjoy it too much and derail the thread completely.

My point was that even if the company has proper auditing, is to be trusted etc etc, at some point in the process someone will still be involved at a low-enough level to have access to some form of data that can be harmful. It's unavoidable really. The checks and balances need to be in place to detect that as soon as possible, which is not always easy either.
Click to expand...

SSL and this are two different things. For one SSL is encrypted, the company issuing the certificate - eg Comodo or Verisign has no information pass through it - it's encrypted by the browser and decrypted by the banking institution. Info does not go encrypted to Verisign where it is decrypted, someone can intercept the plain text data and then passed onto the bank.

Man in the middle with bona-fide certificates is very rare or even so difficult to be impractical. Here the thug in VC had direct access to your information.

I'll give you a better example where your data is at risk - PayPal. PayPal - is not a registered bank - except in the EU where their offices had to pass stringent checks - elsewhere - and our PayPal is in Singapore - PayPal is not registered as a banking institution which means they don't have the same checks and balance (and insurance) as a real bank and their employees could misuse your credit card/banking data as well as the funds in the PP account.

Vodacom is a communications company. They are not supposed to protect the data with high level security. SMS is like HTML without SSL, its not safe and only safe through obscurity. A better option would be to have an encrypted SMS sent to your phone so Vodacom thug can't do anything with the data - only your phone or you can decode the code, I'm not sure how this would be implemented but as is SMS is the equivalent of plain text to the thugs at the communications company, while encrypted http traffic passing through a router between Africa and United States is encrypted and idiots there can't decipher it without a million years worth of computing time.
 
Ya,
Vodacom said that it is unfortunate that a Vodacom staff member, in conjunction with an online banking syndicate, was able to commit fraud
Click to expand...


Kaaskop said that it is unfortunate he won't be using Vodacom as his service provider once his contract expires.;)
 
kaaskop said:
Ya,



Kaaskop said that it is unfortunate he won't be using Vodacom as his service provider once his contract expires.;)
Click to expand...

+1!!! BOYCOTT VODACOM...
oh... and MTN cos of their billing nonsense of late
lol
 
THIS IS A TERRIBLE ARTICLE - This creates the impression that the cellphone banking industry has been compromised and scared the what-have-you out of some of my employees!!!

It has nothing to do with mobile banking, it is just the old online banking fraud modified to include the SMS notifications. Which upon inquiry, turns out to have happened a number of times and worldwide.

So this whole discussion is confusing to me and others, due to the SMS Banking reference.

And now I crapped on someone for no real reason!!!!
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X