Survey finds firmware a common attack vector against banks