Virtual on screen keyboard?

Zuzzie

Hi guys.
Need some advice. Friend has just had £6,000 taken from her online NatWest bank account, goods ordered and money taken on her paypal account. Her bank account has been frozen. She has taken steps to secure all her credit cards and other bank accounts. NatWest have told her to get her laptop and desktop completely wiped. (I know you can run Malwarebytes etc but she is not PC savvy and has asked a local IT guy whom we both trust to come and sort it). We have no idea how this happened - she is at least aware of not opening links etc in emails or attachments. My question is:

NatWest have advised changing all passwords and using a virtual keyboard on screen in future to avoid keyloggers when logging in. Would using the Windows 7 or 8 virtual keyboard afford security or does she need to buy something like Karspersky which has a VK in the package?

This whole episode is worrying. The latest thing that happened is that someone has even got into her Talktalk phone account and put all her calls on divert. She has spent all morning on the phone trying to sort that out as they have changed her password etc. Makes us wonder whether this has something to do with Talktalk security as it was only recently that she upgraded her phone package and had to give some security information to the person she spoke to.

Any advice would be appreciated on how to avoid this happening in the future.

JasX

wouldn't a virtual on screen keyboard still be captured by regular key logging malware?

All she needs to do is
1-Have a reliable free anti virus program -get a recommendation (not a paid for but crap one!)
2-Keep windows up to date with security patches
3-Use an up to date browser (and keep it up to date)
4-Be careful about letting anything install itself on her PC, avoid visiting dodgy websites, ignore all popups and banner adds that offer to install 'toolbars' of any variety, 'smileys', 'make her PC faster', 'she has won an ipad for being the 1,000,000th visitor' etc etc

Oh and make sure she doesn't access her accounts from any PC she does not own/have control over ie internet cafes, airport lounges, work computers (depending where she works -locked down 'blue chip' firms corporate networks will be fine, medium/small companies with patchy IT policies less so). Even from her own PC over public wifi could be compromised by a determined attacker.

Finally keep a close eye on her accounts and look out for any suspicious transactions early on (particularly unexplained small value ones)

There are reasons this kind of thing doesn't happen to people who get the basics of IT security and security awareness right.

Zuzzie

Thanks JasX. That's a very comprehensive answer - some of which I already told her. However, your remarks about the keyboard are what I would have suspected. I wonder how they capture the key strokes on a VK - are they sitting watching your screen?

Zuzzie

Just found this which explains keylogging quite well:

'Keyloggers may record all keystrokes, or they may be sophisticated enough to monitor for specific activity - like opening a web browser pointing to your online banking site. When the desired behaviour is observed, the keylogger goes into record mode, capturing your login username and password.
Some sites attempt to thwart keyloggers by having the user respond to visual cues they must point to with their mouse instead of using their keyboard. However, some keylogger trojans also capture screenshots, thereby negating the effect of this strategy.
Keyloggers and other forms of remote-access trojans tend to be the most determined malware, taking extra steps to stealth its presence, including through the use of rootkits.'

Crafty beggers!

JasX

Zuzzie wrote: »

. I wonder how they capture the key strokes on a VK - are they sitting watching your screen?

They'll tap into a layer just above the keyboard driver (keyboard driver equivalent of upper filters/lower filters?) -I'm no virtual keyboard expert but I suspect whether your keyboard is a physical one or virtual one it'll still interface at the same place (ie the keyboard driver/virtual keyboard driver) where it will be intercepted -all your installed programs need to look in pretty much the same place to get their keyboard input after all