Rapport security software

[Neil625]

Hi there,

 

Rapport is a security program that I downloaded from the Santander website. It is also offered by a number of other UK banks. It is designed to be run alongside your existing Antivirus and Firewall. However, Rapport seems to be detecting a number of false positives. Here is a conversation I had with a Rapport agent. I wondered what you guys thought of the issues?

 

My initial question was why Rapport is blocking itself and Internet Explorer from taking screen grabs (Rapport should stop malicious programs from taking screen grabs of protected websites).

 

Please wait for a site operator to respond.

You are now chatting with 'Mila'

Mila: Hello and Welcome to Trusteer Support online response !

Neil: hello!

Mila: The problem you have reported may be related to one of Rapport's protection mechanisms.

Mila: We would like to ask you to disable Rapport's protection from Screen Capturing and let us know if the problem is resolved.

Mila: Instructions for disabling protection from Screen Capturing:

Mila: 1) Open Rapport console (Start > Programs > Trusteer Rapport > Rapport Console)

Mila: 2) Click on the arrow icon to move to page 2

Mila: 3) Click on "Edit Policy" in the "Security Policy" widget

Mila: 4) Type in the required characters

Mila: 5) Locate "Block Screen Capturing" and choose "Never" in the drop-down list

Mila: 6) Click on "Save"

Mila:

Neil: Ok, but I was wondering if this is a bug with Rapport

Neil: The Rapport report says "iexplore.exe is permanently blocked from capturing sensitive data" and "RapportService.exe is permanently blocked from capturing sensitive data"

Mila: No, it's Rapport's protection mechanism

Neil: it would seem a bit odd of Rapport to block itself? and to block internet explorer, both genuine programs

Mila: one moment please

Neil: ok thanks

Mila: It's a known issue, and we're working on solving it.

Neil: Oh right ok, glad to hear you're working on solving it

Neil: There is another odd thing:

Neil: When I type Santander: Bank Accounts, Savings, Loans and Mortgages into the address bar (which is the correct, genuine domain name for Santander) and hit enter, then I get the following message in the Rapport report:

Neil: "IP address 184.85.206.196 doesn't match Santander UK"

Mila: It is a harmless event, which you can disregard.

Neil: But surely, unless there is an error with the DNS server (in which case there would be a nationwide problem with the Santander website), or if there is a virus on my PC that's playing with internet explorer (in which case my McAfee should have detected it), then when I type in santander.co.uk into the address bar, it should go to the correct IP address, and Rapport should know that it is the correct IP address?

Mila: Yes, however, Santander did not provide us with all of their IP address. Due to this Rapport does not recognizes it.

Neil: Ah that explains that, so shouldn't Santander be made to give Trusteer all their IP addresses as a condition of distributing Rapport so that Rapport doesn't give false positives?

Mila: No

Mila: We are collecting them.

Neil: How do you collect them?

Mila: We have a department that deals with this issue.

Neil: Because obviously it is important that you collect the IP addresses in a way that insures that they are the correct IP addresses, otherwise, when you type in santander.co.uk, Rapport could end up replacing a correct IP address with a false one surely?

Neil: Well it might seem like that department has a problem if they're allowing false positives

Neil: Do you agree?

Mila: No, since your bank suppose to give us the necessary IP address.

Mila: As long as they are not provided Rapport can't verify this address, it is not a false positive.

Neil: well it is a false positive if it blocks a genuine IP address

Neil: it just seems odd that Santander wouldn't provide you with all of their IP addresses in order that Rapport works as well as possible

Mila: But Rapport is not familiar with this address, it is not an actual event.

Mila: this issue should be resolved in our next versions.

Neil: oh great; it would have been nice if Rapport had been tested properly before it was released though to iron out bugs; it is essential that security software like Rapport works properly

Neil: if there are mistakes like this, then there could be worse mistakes elsewhere in the program that could comprimise security

Neil: the only other explanation that I can think of is that Rapport deliberately creates events when there is no threat, so it looks like Rapport is doing something useful when it isn't

Mila: Please not as long as the Rapport icon turns green on your bank's website, it's protected.

Neil: but it is the Rapport program that is making the icon green on a 'protected website', so if there is a mistake in the Rapport program then there could be a mistake in the colour of the icon

Mila: No, Rapport recognizes the Santander domain, and protects it.

Mila: Nut since we still was not provided with all of your bank's IP address Rapport can not protect them all, since it's not familiar with them.

Mila: *But

Mila: This is not a false positive, since Rapport didn't accidentally recognized a legitimate IP as invalid. This is not a listed IP address.

Mila: However, this event is harmless, since Rapport can still identify Santander's domain, and protect you.

Neil: well Rapport does "accidentally recognized a legitimate IP as invalid"

Neil: it is a legitimate IP address, but it is not on the list of legitimate IP addresses

Mila: It's not exactly accidently, Rapport is actually doing exactly what it should.

Mila: This address is not listed as a legitimate IP, so Rapport alerts regarding it.

Mila: It isn't on the list since we still did not receive it.

Neil: ok so the fault is in Santander not providing all their IP addresses

Neil: anyway thank you very much for your help, I am going now

Neil: bye

Mila: Goodbye.

Mila: Thank you for choosing Trusteer's on-line chat support.

Mila: We would like to encourage you to contact us for any question/problem related to Rapport at support@trusteer.com

 

 

I am using Windows Vista Home Premium.

 

Thanks,

 

Neil

[Dalo Harkin]

You dont need anything else running along side

 

I thought I would see what the world of Google thought so I typed Rapport security in and got this:- *Mods/Admin, this isn't spam just saving people the trouble of searching

 

Rapport Security Software - avoid using it

 

 

13 posts - 9 authors - Last post: 9 Dec 2009

This product is to be avoided at all costs...if anyone is still having problems, I have managed to switch it off and uninstall it, ...

www.computing.net › Forums › Security and Virus › General - Cached - Similar how to remove rapport security download‎ - 3 posts - 22 Sep 2010

Rapport security software‎ - 5 posts - 13 Feb 2010

Rapport security software from bank Good/Bad‎ - 6 posts - 8 Feb 2010

rapport installed problems‎ - 12 posts - 20 Feb 2009

 

 

Uninstall it and use your AV/Firewall programs you know work :)

Edited December 24, 2010 by Dalo Harkin

[Synapse]

I think one has to be careful of advice suggesting a product such as Rapport is not needed. I know plenty of people that have been thankful of that extra layer of security, and it hasn't caused them any computing hassles. The banks don't develop software for nothing, they have a just set of reasons to try to help customers stay secure.

 

None of us visiting these forums have the security knowledge, inside line and abilities to say whether it is truly effective or not. For every gripe on a forum there will be a happy user somewhere too.

 

Bottom line I think is that if you do not like it, remove it.

 

Merry Christmas to you all :)

[Plastic Nev]

Having seen reports both good and bad myself for Rapport, I would be interested in how our security folk think on it and their views, Starbuck is more likely to know the important side of it and its usefulness or otherwise.

Nev.

[Starbuck]

I have to admit that every time i log in to my internet banking site, i get bugged to download this software.

I've never bothered with it, my installed security has always protected me.

This is not to say that one shouldn't try new things ..... just that if you are happy with your software then stick with what you have.

There are cases where too much security is as bad as not enough.

Sadly not all security software will play nicely with each other.

My advice would be to back up your system, then try new software and if you get any problems afterwards .... uninstall it straight away and revert back to the settings you used before the install.

[cherokee1940]

Excuse me but we had Rapport and it infected our computers. It cost money to have my husband's desktop repaired, to have the viruses removed that this program put on his pc. I was successful at removing them from mine but there was one on his that was very stubborn. There is another thread in this site that gives more information. I suggest you do a search and find it. Do not download Rapport. With it comes emails from NACHA which is a partner with Trusteer who is the maker of Rapport. With the email is a message that a transfer has been blocked and with that email is an attachment supposedly showing the transaction but it contains a virus. The attachment is automatic. My husband did not receive the emails but I did. I had 8 viruses and 4 corrupted files on my desktop. He had 3 viruses one of which was very stubborn. It took our pc tech several days and several programs before he could remove it. Kaspersky did not catch these viruses but AVG did and quarantined them. Malwarebytes removed the two that AVG caught which left one for another program to remove Spybot. All three are free programs. Over seventy dollars and several days later.....Trusteer's Rapport is not to be trusted.

[cherokee1940]

Good advice. My husband's pc had to be restored back to before Rapport was installed. He also said if a bank has to offer extra security he would withdraw his money from that bank. From what I have read you cannot have two antivirus programs on your pc at the same time. They conflict with each other. Rapport brings with it viruses. Do not install it. See previous posts about this program please.

[Starbuck]

With it comes emails from NACHA which is a partner with Trusteer who is the maker of Rapport. With the email is a message that a transfer has been blocked and with that email is an attachment supposedly showing the transaction but it contains a virus.

I think you'll find that this email didn't come from NACHA.

Nacha have been having problems with emails being sent out in their name:

http://www.nacha.org/news/newsDetail.cfm/RecentBusinessNewsID/236

 

So you'll also find that it WASN'T Rapport that infected your systems.

 

From what I have read you cannot have two antivirus programs on your pc at the same time. They conflict with each other.

That is very true, but Rapport is not an anti virus program.

So it does work with your resident AV.

There were a few glitches with it conflicting with AVG, but i think those have been sorted now.

[wellies]

I have Trusteer Rapport installed and wouldn't know it's there apart from the icon in the browser toolbars.

 

If it installed viruses, all Rapport users would be experiencing infections ..but they aren't. They may get other problems but none in that respect. An AV program might detect Rapport as malware but I believe this would be a false positive rather than a genuine detection of a virus or viruses:

 

http://www.trusteer.com/faq/my-anti-virus-alerts-about-rapport-what-should-i-do

 

I use Rapport not because I consider it's particularly needed but more because if anything goes wrong with my bank account, I'll be able to say that I was using their recommended security program. A little less dispute about the security arrangements on my computer if the worst should ever happen. If it impacted my computer in any way, I probably wouldn't keep it. Since it doesn't, I might as well use it.

 

Unfortunately, it doesn't work within Sandboxie, so I've had to force myself to use the browser outside of the sandbox when doing financial transactions. It goes across the grain a bit to use my browsers outside of the sandbox but I do it.

 

That's maybe not so bad though. Afterall, Sandboxie will have done its job of keeping malware off the system, so there's perhaps not much liklihood of danger coming from that direction in the form of hidden malware looking at what I'm doing.

 

I've found Trusteer support to be very good. When Google Chrome went from version 10.0 to version 11.0, Rapport became incompatible. I asked Trusteer support when an update might be forthcoming and got a reply shortly after assuring me it was being worked on. A short time after that, I was sent a link via e-mail to an updated version. OK, I didn't trust it and waited for the update to come via the program but Trusteer made the effort nonetheless. When Chrome went from version 11.0 to version 12.0, Trusteer broke again but this time, an update for it was released about 24 hours later.

 

A thumbs up for Trusteer Rapport from me.

[Plastic Nev]

Considering this subject has been brought up again I thought it perhaps a good idea to have a further in depth look at it.

 

As per this thread and another in this section there have been, and no doubt may still be, issues concerning conflicts with other software. As said the issues with AVG has been resolved but this doesn't mean there are no others. However Trusteer Rapport do seem to do reasonably well at sorting things so long as the real nature of the conflict and the definite name of the software involved is passed on to them.

 

Secondly, as reported, certain false E mails supposedly from NACHA did catch some people out and installed malware. This was definitely not the fault of either Trusteer Rapport or NACHA as these E Mails were designed by the criminal hackers to catch people out. Back to the warnings about checking carefully all E Mail before opening them.

 

Now for what Trusteer Rapport isn't, and what it really is.

It is not an anti-virus, neither is it an anti-spyware as such, it is if anything an extension to your firewall, though is not intended to be used instead of a firewall.

What it does is to block all known phishing sites from accidentally being opened instead of the intended site. Once your browser is connected to a known and correct banking site, plus any other site you enter into its system, it then acts as a secure protection against any attempt to break into that connection. In a sense it is like an armoured tube surrounding that connection.

Once the connection is broken and a normal other site is opened Trusteer Rapport is no longer in action. This means you are back to your normal security from then on.

Should something get in such as a trojan or key logger however, Trusteer Rapport is supposed to be able to prevent that malware stealing data while it is active, but cannot do more.

It is down to your anti-virus or anti-malware software to pick up and remove the malware during a normal scan.

Nev.

[smartalan]

I have now been using trusteer repport for some considerable time along side AVG with no problems what so ever.