🔴commercial bank accounts තියෙන අය පරිස්සමින්🔴

[SimMaster]

NTB, Sampath හොදයි කිසි වදයක් නෑ.

 

[tharakaf]

oka thamayi godak phishing sites wada karana widiha.
user danne naha hack wela kiyana eka mokak hari suspicious deyak wenakan.
un credentials save kara gannawa otp ahanne nathi site wala nam + cookies - cookies thibbama otp ahana ida aduyi gmail wage ekaka unath kalin log una cookies etc & sitedata thiyena nisa



original site eke otp ahana step ekata dala athi mama combank use karala naha 7 years walin.
kohomath un aniwa original site eke otp ahana thanak saka nohithenna ganna set karagena athi.

samahara bank wala otp ahanne naha lankawe sign in weddi & transaction eka karaddi ahanneth naha ,
eth transactions karanna kalin adala recipient register karanna ona ethanadi otp ekak ahanawa.

මම ටිකකට කලින් ටෙස්ට් කලා OTP එක resend කරන්න කියලා පරන OTP එක පාවිච්චි කරන්න පුලුවන්ද බලන්න, ඒක වැඩ නෑ (දැන් හදලද, කලින් ඉඳන්ම වැඩ නැද්ද දැන්නෙ නෑ)

මට හිතෙන්නෙ උන් login එකට OTP එක දාල ඒකෙන් OTP එක බාන සීන් එකක් කරන්නෙ. එහෙම උනාම අරූට සැක හිතෙනවත් ඇතිනෙ බන්, සල්ලි ටික ගියා කියලා message එක ආවම තමා රත්වෙන්නෙ.

 

[NEMISIS]

User goes to the fake site --> Enters username/password --> This triggers the attacker to login to the real site with these credentials and initiates a transaction which sends OTP to customer --> Fake site has a additional login step to enter OTP --> Customer enters the OTP thinking it is to login to the site --> attacker uses the OTP to authorise the transaction on the real site.

So the above is the most probably mode of attack right?

pretty much yes.
there are some other practicle tricks to get both login otp and transaction otp from the user.

User goes to the fake site > Enter credentials > triggers the attacker to login with credentials > user gets the otp > submits the otp > attacker gets the otp but the take site take a long time to submit the otp/keep showing the loading screen (this is a deliberate by the attacker) > attacker login with the otp > immediately start a transaction( usually a new transaction otp says this is for a transaction, so most likely the attacker can add his account as a registered account in the portal *more details at the end of the post) > the the fake site says your otp is incorrect and submit the new otp sent (the new otp is the transaction or new account add otp) > user submits it and game over.

other thing is some banking apps does not allow login from two different locations(two login sessions), if an attacker take over an account and keep using it, the real user has no way of login to the account until the attacker logs out. I think banks have disabled multiple login attempts as a security mechanism, but it could work in favor of the attacker.

*more details at the end of the post
about this. Attacker never gets the money in to his own account. Attacker always has few contacts with shops (usually sellers from clarified sites, or facebook market place) they already have account numbers of some shops or sellers, and attacker transfer the money to those clueless sellers, they will send the item to the attacker. or there could be another layer (like a drop-shipping the item to someone else). It is very hard to track down the real attcker.

 

[Monkey D Dragon]

මම ටිකකට කලින් ටෙස්ට් කලා OTP එක resend කරන්න කියලා පරන OTP එක පාවිච්චි කරන්න පුලුවන්ද බලන්න, ඒක වැඩ නෑ (දැන් හදලද, කලින් ඉඳන්ම වැඩ නැද්ද දැන්නෙ නෑ)

මට හිතෙන්නෙ උන් login එකට OTP එක දාල ඒකෙන් OTP එක බාන සීන් එකක් කරන්නෙ. එහෙම උනාම අරූට සැක හිතෙනවත් ඇතිනෙ බන්, සල්ලි ටික ගියා කියලා message එක ආවම තමා රත්වෙන්නෙ.

OW OTP EKA valid wena time eka max thiyagena karanawa athi,
anith eka samahra welawata bank walin ena sms delay wela enawa , samahara bank wala

ලංකාවේ ඉඳන් පිට රටට සල්ලි යවන්න බැහැ .
track කරන්න & එවලේම report කරොත් බැරි කමකුත් නැහැ අල්ලන්න කරපු උන් .
card වලත් ලිමිට් තියෙනවා + card payment reverse කරන්න පුළුවන් ,
ඕව ඕන නැහැ පැය ගණන් call එකේ line එකේ තියාගෙන ඉන්නේ බයිට් කරන්න ez cash හොරු , අද වෙනකන් අල්ලල තියෙනවද

ඕව කරන්න තමයි රජයක් ඉන්නේ . රජය ඕව කරන්න ඕන විදිහට හදන්න තමයි අවුරුදු 5 කට පාරක් 225+1 ක් යවන්නේ දැන් ඉන්න උනුත් එකයි ඉස්සර ඉඳපු උනුත් එකයි උන්ගේ ජොබ් එක කරන්නේ නැහැ 225+1 කාලකන්නි ටික දැන් ඉන්න & මේ වෙනකන් ඉඳපු

 

[nash95]

bump

 

[NEMISIS]

OW OTP EKA valid wena time eka max thiyagena karanawa athi,
anith eka samahra welawata bank walin ena sms delay wela enawa , samahara bank wala

ලංකාවේ ඉඳන් පිට රටට සල්ලි යවන්න බැහැ .
track කරන්න & එවලේම report කරොත් බැරි කමකුත් නැහැ අල්ලන්න කරපු උන් .
card වලත් ලිමිට් තියෙනවා + card payment reverse කරන්න පුළුවන් ,
ඕව ඕන නැහැ පැය ගණන් call එකේ line එකේ තියාගෙන ඉන්නේ බයිට් කරන්න ez cash හොරු , අද වෙනකන් අල්ලල තියෙනවද

ඕව කරන්න තමයි රජයක් ඉන්නේ . රජය ඕව කරන්න ඕන විදිහට හදන්න තමයි අවුරුදු 5 කට පාරක් 225+1 ක් යවන්නේ දැන් ඉන්න උනුත් එකයි ඉස්සර ඉඳපු උනුත් එකයි උන්ගේ ජොබ් එක කරන්නේ නැහැ 225+1 කාලකන්නි ටික දැන් ඉන්න & මේ වෙනකන් ඉඳපු

I don't think government is responsible for this type of things. This is scamming users and this is a global problem. Only way to fight is to educate people and the bank has to play a bigger role to protect their customers and Implement more security measures on their websites/apps. Most of these problems are because of poor design decisions made by banks. For an example, If the bank uses only .lk webiste then it is hard to do a homoglyph attack, because nic.lk validates this and reject such.
90% of the time bank has to take the responsibility rest of the 10% is regularity bodies such as CBSL.

 

[Monkey D Dragon]

I don't think government is responsible for this type of things. This is scamming users and this is a global problem. Only way to fight is to educate people and the bank has to play a bigger role to protect their customers and Implement more security measures on their websites/apps. Most of these problems are because of poor design decisions made by banks. For an example, If the bank uses only .lk webiste then it is hard to do a homoglyph attack, because nic.lk validates this and reject such.
90% of the time bank has to take the responsibility rest of the 10% is regularity bodies such as CBSL.

scam wena eka kohmath nawaththanna baha ,
eth lankawe adu karanna ona dewal wath karanne naha

mage point eka - government(+cbls) ekata karanna puluwan dewal tikak thiyenawa unge power walin e dewal wath mun karanne naha ,

wadiyenma wena justpay otp scam eka , balen account walata obapu ekak nisa wenne , optout wenna ahuwama bank eken un danneth naha karana widiha.

mewata cbsl & government thamayi waga kiyanna ona.

lankawe OTP aniwaraya kiyana regulation ekak thiyenawa online site walata lankawe oparate wena cards waladi.

lk ekata regulation bari una guide line ekak hari danna puluwan cbsl ekata , pal booru civil engineering etc karapu modayo hire karala pirila inne cbsl eka athule.



lankawa athule wena scam track karanna action ganna ona . lesiyata atha pihida ganna balagena inna nikamo pirila inna adala than wala bahtuhajraya

ahu una un Ukrainian un denna Sampath bank wage sponsored ads dapu
ko un denna dan ,

neethi madi kama 100% 225+1 waradda thamayi ahu wena un nidahas wenna
thawa government eke responsibility ekak thamai hariyata chodana gonu karanna molayak thiyena un adala ayathana walata hire karana eka contact walata job nodi

lankawe unuth scam karapu meegamuwe set eka pizza eken mattu una ko dan un ?
bank account eka online job karanna gihin ahu una dennekge.
ohoma ewata lankawe ona tharam un ahu wela thibba case giya - ewa pita rata scam walata lankawe onlinke job hoyana un ahu wela salli unge accounts walata ewala scam karana un.

 

[NEMISIS]

scam wena eka kohmath nawaththanna baha ,
eth lankawe adu karanna ona dewal wath karanne naha

mage point eka - government(+cbls) ekata karanna puluwan dewal tikak thiyenawa unge power walin e dewal wath mun karanne naha ,

wadiyenma wena justpay otp scam eka , balen account walata obapu ekak nisa wenne , optout wenna ahuwama bank eken un danneth naha karana widiha.

There is a CBSL guideline for financial apps and websites. It is very comprehensive and covers many areas. But, banks are not adopting it 100% due to various reasons. In some cases, the bank’s Board of Directors decides not to fully follow the CBSL guideline, and the BOD takes the responsibility if a scam occurs as a result of their decision. CBSL and LankaPay also work with third-party cybersecurity companies, so it doesn’t matter if CBSL itself does not have all the expertise.

The same goes for JustPay. CBSL and LankaPay have already provided a solution for it, but banks were initially slow to adopt it. I think most banks have now implemented it, which is why JustPay related scams are rare today.

That is why I say that 90% of the responsibility still lies with the banks. If they truly want to fight this, they can do a far better job. However, almost all banks tend to look for the cheapest possible solution to any problem.

Most of these scams are not run by Sri Lankans, so it does not matter what rules and regulations we have here in Sri Lanka.

 

[Monkey D Dragon]

There is a CBSL guideline for financial apps and websites. It is very comprehensive and covers many areas. But, banks are not adopting it 100% due to various reasons. In some cases, the bank’s Board of Directors decides not to fully follow the CBSL guideline, and the BOD takes the responsibility if a scam occurs as a result of their decision. CBSL and LankaPay also work with third-party cybersecurity companies, so it doesn’t matter if CBSL itself does not have all the expertise.

That is why I say that 90% of the responsibility still lies with the banks. If they truly want to fight this, they can do a far better job. However, almost all banks tend to look for the cheapest possible solution to any problem.

Cyber Security neme CBSL eke inna bahutharaya adalama nathi un CBSL eke anith responsibilities walata wath. bank self regulate wenakan inna baha gov ekak thiyenne pressure karanna thamayi. gov eke administrate karanna ina 225+1 unta chanda walata salli wisi karanna kawda ehema unoth onawata wada dangaluoth , SC yanna unath bank walata limit ekak thiyenawa regulation strick wadi unoth ehma SC yanna tharam ona naha puluwan regulation tika wath dala thiyenawada gudielines nam follow nokara indiwi , laws & regulations ona.

The same goes for JustPay. CBSL and LankaPay have already provided a solution for it, but banks were initially slow to adopt it. I think most banks have now implemented it, which is why JustPay related scams are rare today.

Mokadda solution eka?
saralama solution ekak thiyenawa - opt out wena eka , ehema karanna puluwanda danta???

Most of these scams are not run by Sri Lankans, so it does not matter what rules and regulations we have here in Sri Lanka.

ow eka thamayi mama kiwweth
lankawe indan oparate una dewal walata ez cash mega wasana scam mukuth karala thiyenawada rajayen?

lankawe indan operate wena pita rata unwa scam karana ewath amaruyi kiyamu danduwam denna

lankawe indan operate wuna ,lankawe minissunwa scam karala mattu una ewata ko dunna danduwam , chodana , sakshi hariyata usawi giyada? neeth hadala thiyenawa ewat wath action ganna

e dewal karawanna thama 225+1 inne administrate karanna gov eka .

 

[NEMISIS]

Mokadda solution eka?
saralama solution ekak thiyenawa - opt out wena eka , ehema karanna puluwanda danta???

Justpay is a payment platform that works across different banks, and the account holding bank has the ability to reject/accept these transaction, so if the bank wants, they can implement opt out feature (enable by default, disable by default etc). Different banks may have different solutions for this, some banks enabled this by default that is the root cause of all the problems.
This is like banks implementing an insecure payment gateway and people asking from the government/CBSL why this is happening?

For the people who wants to use the just pay, now the bank has the ability to do some additional checks, there are some features implemented with telco/internet connection providers to verify the internet connection (if the connection is owned by the same account holder etc). Idea is to verify if the user is using the internet connection through the same mobile number that otp has sent. (Personally I am skeptical about this solution, but the bank having ability do this level of cheks is great.)

 

[netnet]

අනේ දෙයියනේ මගේ තිබ්බ රු 70 හැක් කරලා. හෙන ගහපන් මෝඩ හැකරා

 

[.::J@S::.]

Oya scene eka aranchi una central bank weda krna kenekgen.
Unata ghn tibbet gossip ekk wage.

 

[Monkey D Dragon]

Justpay is a payment platform that works across different banks, and the account holding bank has the ability to reject/accept these transaction, so if the bank wants, they can implement opt out feature (enable by default, disable by default etc). Different banks may have different solutions for this, some banks enabled this by default that is the root cause of all the problems.
This is like banks implementing an insecure payment gateway and people asking from the government/CBSL why this is happening?

siwurak da gena kaa gahana video eketh kalin kiyala ayin karanna kiyana eka online serama, eeta passe phone eka ussala or illagena activate karala tiyenne , ethana waraddak thiyena bawa aththa phone eka ussapu eke , eth e weddith bank eke branch walata option ekak naha disable karanna oka or danne naha

athhta lokedi oka disable karanna option ekak branch walata danuwath wela naha e weddi nam (people's or boc vid eka)

*************************************************************************************************************************************

Justpay eka secure widihata wada karanna hadana eka hodayi

"default dala thibba eka opt out wena widihak hariyata danuwath nokara " waradi 100%

oya scam yaddith bank walata gihin ahuwama danne naha opt out wena widiha
adu tharame account ekak mokak hari justpay app ekakata link welada kiyana eka balaganna option ekak thiyenawada bank eken ahuwama banak ekaa balanna puluwanda system eken?

" so if the bank wants, they can implement opt out feature (enable by default, disable by default etc)."
justpay eka or cbsl idk adala un tika oya system eka account walata
activate wena widiha gana reulation ekka launch wenna ona muladima,
nathuwa bank ekata ona widihata karanna kiyala atha pihida ganna nam CBSL eka mokatada

ehema una eke results thamayi dasadahas ganan otp scams walata ahu une

 

[Rick Sanchezz]

Yako mata giya sathiye awa [email protected] eken account ussana phishing link ekak.. gmail eke inbox deliver una..

spoof email ekak gmail inbox awada spam warning ekak netiwa? spf,dkim validate wela da? pudumai block une ne kiwwama. puluwan nam email header eke details tika dapan machan.

pretty much yes.
there are some other practicle tricks to get both login otp and transaction otp from the user.

User goes to the fake site > Enter credentials > triggers the attacker to login with credentials > user gets the otp > submits the otp > attacker gets the otp but the take site take a long time to submit the otp/keep showing the loading screen (this is a deliberate by the attacker) > attacker login with the otp > immediately start a transaction( usually a new transaction otp says this is for a transaction, so most likely the attacker can add his account as a registered account in the portal *more details at the end of the post) > the the fake site says your otp is incorrect and submit the new otp sent (the new otp is the transaction or new account add otp) > user submits it and game over.

other thing is some banking apps does not allow login from two different locations(two login sessions), if an attacker take over an account and keep using it, the real user has no way of login to the account until the attacker logs out. I think banks have disabled multiple login attempts as a security mechanism, but it could work in favor of the attacker.

*more details at the end of the post
about this. Attacker never gets the money in to his own account. Attacker always has few contacts with shops (usually sellers from clarified sites, or facebook market place) they already have account numbers of some shops or sellers, and attacker transfer the money to those clueless sellers, they will send the item to the attacker. or there could be another layer (like a drop-shipping the item to someone else). It is very hard to track down the real attcker.

combank nam login wenakota otp request karanne neha. anyway, oya kiwwa wage phishing site ekedi loading wenawa kiyala dala OTP ganna eka try karanna puluwan. wede ehema nam oka realtime salli adina wede wennat one.

hebei mataka widihata munge multiple sessions allow karala neha. devices 2kin access karoth parana session eka logout wenawa. netnam keylogger ekak tiyenne one. ehema netnam mun cards walin adinawa wenna one. samahara ecommerec platform wala OTP request karannet nehane.

ඕව කරන්න තමයි රජයක් ඉන්නේ . රජය ඕව කරන්න ඕන විදිහට හදන්න තමයි අවුරුදු 5 කට පාරක් 225+1 ක් යවන්නේ දැන් ඉන්න උනුත් එකයි ඉස්සර ඉඳපු උනුත් එකයි උන්ගේ ජොබ් එක කරන්නේ නැහැ 225+1 කාලකන්නි ටික දැන් ඉන්න & මේ වෙනකන් ඉඳපු

hema magulatama 255 japa karala wedak ne ban. Bank eka dena ganna owa monitor karala, threat asses karala unge brand + usersla protect karaganna. Un layer pita layer demmath wedak ne phishing sites tika tiyenakan.

Lankawe un kese wetat reputed fintech companies nam phishing domain eka register wela 1,2 hours yana kota domain eka clientHold wela take down karalath iwarai.

 

[NEMISIS]

combank nam login wenakota otp request karanne neha. anyway, oya kiwwa wage phishing site ekedi loading wenawa kiyala dala OTP ganna eka try karanna puluwan. wede ehema nam oka realtime salli adina wede wennat one.

hebei mataka widihata munge multiple sessions allow karala neha. devices 2kin access karoth parana session eka logout wenawa. netnam keylogger ekak tiyenne one. ehema netnam mun cards walin adinawa wenna one. samahara ecommerec platform wala OTP request karannet nehane.

මේ වැඩේ කරද්දි user ව ඩිවයිස් දෙකකින් ලොග් වෙන්නෙ නැහැනේ
User ලොග් වෙන්නෙ ෆේක් සයිට් එකට, scammer/hacker තමයි real site එකට ලොග් වෙන්නෙ. එතකොට එක ලොගින් සෙශන් එකයි තියෙන්නෙ
හැබැයි දැන් හැම බැංකුවෙම ලොග් උනාට පස්සෙ යූසර්ට SMS එකක් යනවා, ඒත් යූසර් fake site එකට ලොග් වෙන්න හදන නිසා ඒ SMS එකත් ignore කරන්න පුලුවන්.

මේක රියල් ටයිම් වෙන්න ඕනත් නැහැ, ෆුල් පාත් එක automate කරන්න පුලුවන් නේ. එතකොට කොයි වෙලේ මොන යූසර් ලොග් උනත් pre-define කරලා තියන automation එක රන් වෙලා user ගෙ account එක හිස් කරන්න පුලුවන්.

 

[Rick Sanchezz]

මේ වැඩේ කරද්දි user ව ඩිවයිස් දෙකකින් ලොග් වෙන්නෙ නැහැනේ
User ලොග් වෙන්නෙ ෆේක් සයිට් එකට, scammer/hacker තමයි real site එකට ලොග් වෙන්නෙ. එතකොට එක ලොගින් සෙශන් එකයි තියෙන්නෙ
හැබැයි දැන් හැම බැංකුවෙම ලොග් උනාට පස්සෙ යූසර්ට SMS එකක් යනවා, ඒත් යූසර් fake site එකට ලොග් වෙන්න හදන නිසා ඒ SMS එකත් ignore කරන්න පුලුවන්.

මේක රියල් ටයිම් වෙන්න ඕනත් නැහැ, ෆුල් පාත් එක automate කරන්න පුලුවන් නේ. එතකොට කොයි වෙලේ මොන යූසර් ලොග් උනත් pre-define කරලා තියන automation එක රන් වෙලා user ගෙ account එක හිස් කරන්න පුලුවන්.

That's the point! mata amataka una user phishing site ekata log wela inne kiyala.
mehe nam itin minissu danne neti nisa godak ahu wenne. Ape un SSL neti unath click karala yanawane.

 

[NEMISIS]

That's the point! mata amataka una user phishing site ekata log wela inne kiyala.
mehe nam itin minissu danne neti nisa godak ahu wenne. Ape un SSL neti unath click karala yanawane.

ෆිශින් සයිට් එකට උනත් බන් lets encrypt වගේ එකකින් ssl ගන්න පුලුවන් නේ. ඒක නිසා මේ වගේ එකකට හොඳටම දන්න එකෙක් උනත් අහු වෙන්න පුලුවන්
Domain එක නිසා email හදන්නත් පුලුවන්, එතකොට බැංකුවෙන් එවනවා වගේම email එවන්නත් පුලුවන් නේ.

 

[kasun090354t]

අනේ හුකානව මෙහෙම එකක් දැන්නේ දන්නේ. මුළු සෙසතම ඕකේ තියෙන්නේ.. . Website log වෙන්න වෙනවා ගිය මාසෙත් log උනා. උන් ඔය වෙන website කතාව දැන් කාලයක් තිස්සේ කියන නිසා දහපාරක් විතර බලලා log වෙන්නේ. ඒත් සුවර් නෑ දැන්නම් මට..

 

[kasunkaru]

daana ekak daapalla sampath eke dual authentication hinda pattama safe. wena eka bank ekakwat ochchra safe naa

 

[Narendrasinghe Maha Radun]

Fake news, my dear Sinhalese... @Pol hora @scurvy @tharakaf @Candid-B

My father works at commercial bank and confirmed that the same fake news was circulating in social media around 3 years ago...මේවා ඉතින් කඩාකප්පල් කැරි වැඩ...