Wi-FI Security with online banking

Yea the SSL is secure on the banks side, however, the information going from your PC to the banks site would be accessible. So you need to make sure you wireless network is secure as possible, using WPA w/ rotating key, do not broadcast SSID and set up MAC filtering. This will prevent anyone from accessing your network, which would make it easy for them to install a keylogger/backdoor to easily receive your bank info along with anything else you do online.

With all that said, I would have to say if you keep a virus scanner / firewall  and updated on Windows Updates and use those wireless tips I gave you above you don't have to worry about it. The thing is, even if the bank is secure, but you have a backdoor/keylogger your banks secuirty doesn't matter because your already compromised. I personally don't use Internet Explorer to check my online banking, try Mozilla Firefox ( www.mozilla.com/firefox ). Don't ever reply to any emails saying you need to update your bank info or paypal info, etc... That is an attempt of phishing your account or personally information.

Please let me know if you have any questions on anything I said, or if you would like more detail in any of the areas.

Thanks in advance,

Jorden
Tech-Security

"Yea the SSL is secure on the banks side, however, the information going from your PC to the banks site would be accessible."

No, it wouldn't. SSL encrypts the whole connection, data flowing both ways is encrypted and secure.
The original poster also said this was a WiFi HotSpot, so there's not much he can do about changing the WiFi security settings. When the connection is using SSL though, lack of WEP isn't a problem for that specific usage. A hacker can tell that you're using your bank, but he can't read any of the information sent both ways. Assuming you check the SSL Certificate as I detailed above, he also can't do a man-in-the-middle attack.

Keyloggers are a valid point, however. Make sure you're running a firewall, and that the firewall is set in Internet mode and not Local Network mode (most Windows personal firewalls have switches like that, AFAIK. In Local Network mode, your file shares and such are accessible to the local net, and if you're on a WiFi, that means the world. In Internet mode, most things should be closed).

"No, it wouldn't. SSL encrypts the whole connection, data flowing both ways is encrypted and secure."

That statement is obvious, considering thats the point of an SSL. I was stating that when entering his login/password that would be picked up no problem ( in certain cases). So worrying about the SSL connection / etc isn't really his issue, His issue would be security on that local computer, as I stated anti virus / firewall / windows updates, different browser than IE. I havn't seen a mode like that on numerous software firewalls. Try Sygate Personal Free or Pro edition, http://smb.sygate.com/products/spf_standard.htm , this is the only software firewall that prevents DLL injection, which more advanced keyloggers and backdoors use.

Very true about the wifi hotspot, I didn't catch that part when reading the post.

I would only be concerned with your secuirty settings locally. Let me list some programs that will keep your personal PC clean and running smooth with very little time in maintainance.

Detection / Removal:

1) Antivirus:
Kaspersky Antivirus 5.0 (new version) http://www.kaspersky.com/personal
This program is the best by far. It updates every 3 hours, scans web browser scripts also.
I've tested many other virus scanners through the years and this is by far the best.

AVG is also a great virus scanner (more for home user) not to mention they have a wonderful FREE edition.
http://www.grisoft.com/us/us_dwnl_free.php

2) Adware Personal SE: http://files3.majorgeeks.com/files/c3cbd51329ff1a0169174e9a78126ee1/spyware/aawsepersonal.exe  - be sure to run the update after you have completed the install. ALways nice to have this utility on hand, if already have, just update and run again.

3) CWSheddar - http://files3.majorgeeks.com/files/c3cbd51329ff1a0169174e9a78126ee1/spyware/cwshredder.exe  - This is good to run just to make sure.

4) HiJackThis -  Run this program again and then copy/save the log and goto www.hijackthis.de and paste/load your log into there to be analyzed. See if anything is labeled "nasty" if so, in hijack this, put a check in the box next to the items the website labels nasty.

If hijack this looks ok, reboot and move along to PREVENTION.

Prevention:

1) Run windows updates to make sure you are fully patched. Also might want to try: http://www.microsoft.com/technet/security/tools/mbsahome.mspx

2) Always a good idea to have a backup browser, these days tons of exploits are publically released against Internet Explorer. I'd check out Firefox: http://www.mozilla.org/products/firefox/

3) Software firewall: Sygate Personal Firewall: http://smb.sygate.com/download_buy.htm - both a Pro version for money, or use the free edition.

4) Virus software: If you have money buy, Kaspersky, www.kaspersky.com , Kaspersky is extremly useful for it blocks malicious scripts from the web, which a large percent of spyware comes from, also has definitions for adware/riskware/malware/etc.

Additonal clean up:
CCleaner - http://www.majorgeeks.com/download.php?det=4191
This program will clean out, temp, temp internet files, all the other junk that sites around on the computer, will help performance.

RegCleaner - http://www.majorgeeks.com/download.php?det=460
This program will remove any missing or invalid registry entries as well as perform a complete backup of changes you made. Very nice addition to system maintainance

Good Luck,

Jorden
Tech-Security

"No, it wouldn't. SSL encrypts the whole connection, data flowing both ways is encrypted and secure."


The entire session is encrypted, including the authentication via username and password. What would be the point if the entire session was not encrypted. Local security is an issue, I agree, people should follow industry best pratices for setting up thier systems.

harbor235