At RSA 2010 an old-timer mentioned that it is really easy to hack your typical home or small- and medium-sized enterprise router remotely to set its DNS server IP address to whatever you want. I don’t know if the router is addressable from the general Internet or whether one must run something in the user’s browser to turn around and address the device. But note that this is an attack upstream of the PC and downstream of the ISP that no trace of its presence needs to be left anywhere where a malware scanner would find it.

While I appreciate that all the losses you know about involve permanently compromised PCs, the fact that there are attacks at least *possible* upstream (known, unknown, and “unknown unknown”) just reinforces you point that the financial services institutions need to follow the “X-Files principle” (TRUST NO ONE. (But the Truth Is Out There.)

Like or Dislike: 2  0

But there are mules that sign up just before leaving the US, such as students graduating and returning to their home countries. Sometimes they manage to get out of the US before anyone comes to claim the stolen money. Those mules may well know what they are doing, as it seems unlikely they would sign up for something that would deposit their money in a bank in the US just before they leave, given the possibility that a SNAFU would delay the deposit until they no longer have access to the bank.

Like or Dislike: 1  0

The only possible angle of online attack is statistical analysis by the trojan of the screen challenge and the associated keylogged user response. Every time a user authenticates it does actually lose a tiny bit of predictable probabalistic information about the key so we’ve done lots of research on this sole attack. The results are great with it being very easy to put the necessary number of interceptions by the trojan well over 10000 or even higher magnitudes by changing simple aspects of the challenge picture, so lets say a user authenticates into their account once a day the trojan would need to wait around for 28+ years worth of authentication data by the user to correctly analyse the users key. Considering most cards are replaced every few years I don’t consider this attack feasible. This interception amount isnt set in stone either there are a number of basic multipliers which don’t affect usability at all and can easily multiply this interception rate but it seems unnecessary.

From a personal (in person) attack angle I like to think the security is pretty strong too. Being kept in your wallet instead of a hardware token floating around your desk seems much more secure and user friendly. Discreet photographic attacks (as in a hidden camera around your office) are pretty remote too with a simple transparent tint effect printed around the key pattern the attacker literally needs to get the card out of your hands and into a specialized photographic setup with a backlight. This seems as unlikely as me lending my house keys to a stranger. There are a lot of cheap open methods to protect the visual key pattern from transflective laminates to electro chromatic pressure activated cells, depending on the level of paranoia.

Anyway thanks for taking the time with a new idea, I am putting all this out here as a solution to the problem and it’s great to get any feedback.

Like or Dislike: 2  2

My concern with TOOBA as well as shifting to more obscure operating systems is it doesn’t provide a “secure” theory underlying it. Their phone trojans could just as easily record these conversations (which some do to an mp3 and upload out later) compared with what they are doing in the article above. A friend of mine who developed the cryptography behind a major brand of hardware token once lamented that the real security of their tokens was reduced to “knowing the user’s mother’s maiden name” because an attacker could just ring and answer this question to bypass the authentication. Constantly moving the authentication target so far has failed at stopping authentication fraud which is essentially what we are dealing with.
The most widely used out of band authentication is SMS mTAN’s, adopted as a lower entry cost solution by some banks however it comes with an entirely new set of problems in many ways worse than the old. For a start if a hacker can get their payloads such as Zeus into your computers running the most up to date trojan detectors then you can believe they can get a similar payload onto your mobile phone which doesnt have any protection. There is a slew of other problems with SMS listed here http://www.passwindow.com/security.html#sms

As Brian said you have to assume the user’s system, be that PC, Laptop or Mobile, is *already compromised*, I would personally like to add to that with *and the attacker can control every aspect of the compromised system*. From this angle it is better to work backward from what we know is secure and then consider the other two important aspects which is usability and price, neither of which can be ignored. I know the token transaction signing and the passwindow method can’t be circumvented under this situation so we at least have a starting point, if anyone else has any ideas they are welcome to throw them in.

Like or Dislike: 3  1

When the only “solution” that you can think of involves requiring a user to enter 40 random digits to secure every payment, it’s obvious that the information security industry needs a new acronym!

How about “TOOBA” (“Totally Out-Of-Band Authentication”)? If everything that goes through Windows is insecure, then don’t use Windows. Place a phone call!

If you think about it, the only transaction that requires this level of security is the addition of a new payee, and that is pretty rare. The bad guys can’t profit from your sending some extra bucks to someone you already do business with.

Gee, whiz. The only thing that *really* has to be secured is the addition of a new payee.

Like or Dislike: 4  1

The use of a Limited user Account would have prevented the theft.
Malware can not change system files when executing as a Limited User.

The use of an Administrator Account for causal computer work, guarantees that malware will gain control of the computer. One drive-by Adobe Flash exploit is all that is needed.

If your users are Administrators, then those users are certain to become victims of malware.

Hot debate. What do you think? 4  5