United They Stand: Cyber Threats Forcing Banks to Cooperate for Better Security

This week the FBI warned a new variant of the Zeus malware, Gameover, is infecting U.S. computers and siphoning off user bank accounts. This is just the latest threat forcing the nation’s largest financial institutions to share information and work together as they never have before.

Security officials from Morgan Stanley, Goldman Sachs and from the Polytechnic Institute of New York University researchers hope to create a center that “would sift through mountains of bank data to detect potential attacks,” according to the Wall Street Journal.The newspaper also reports Bank of America has begun informal roundtables with security officials from rival banks in order to thwart hackers. They are acting out of necessity. Financial institutions are a favored target in a time of increasing online attacks.

Even with this incentive the banks are hesitant to share much information with anyone, let alone competitors. They have a long and understandable culture of doing their own security and, because information is the lifeblood of their business, it is hard to get financial institutions to share it with researchers – never mind competitors.

But they have learned the hard way they have no other option. As the Journal reported:

A graphic example of just how vulnerable banks are to hackers occurred in 2010, when security experts from major financial firms gathered in San Francisco for a conference. As panel after panel discussed cyber threats and how to guard against them, hackers carried out a real-life attack. Using what has come to be known as the Zeus Trojan—a type of software that infects computers and covertly tracks keystrokes to steal personal data—thieves penetrated bank computer firewalls and stole millions of dollars from their customers. The security experts attending the conference emailed each other furiously on their BlackBerrys and agreed to meet in person to discuss the threat, according to a person who was there.

Attacks like this have driven banks to work with ISPs in order to stop criminals from electronically impersonating employees to get customer data. Banks are providing them with more information so the ISPs can do a better job of verifying the communications are authentic.

This won’t help stop the Gameover virus, though. It targets customers, not employees, with a phishing scam. This comes in the form of an email claiming to be from one of a number of U.S. banking agencies like, the National Automated Clearing House Association (NACHA), the Federal Reserve Bank, or the Federal Deposit Insurance Corporation (FDIC). Opening an attachment then infects recipients’ computers with malware that accesses to their bank accounts.

If banks want to do anything about this threat they are going to have to educate consumers and give them a reason to take the risk seriously. Under current U.S. law banks, not customers, are on the hook if any money is stolen online. So it will be difficult to change behaviors without sharing some of the pain.