Skip to main content

kaspersky-labs-update-on-bank-attacks

Posted by: admin 15 years, 11 months ago

Hat tip: Securology.

Kaspersky Labs has an updated analysis of banking attacks. You should read the whole thing, but I'll point out this section of the conclusion:

Nonetheless, there is a fundamental problem with two-factor authentication, namely that though the session may be secure, whatever happens during that session goes unchecked. In order to increase security, some additional form of communication, such as the use of a cryptographic token or SMS messages (already implemented by some financial institutions) is required. SMS messages could set limits on the lifetime of the TAN, the account numbers being accessed and the maximum permissible transaction amount.

Obviously there is a potential downside to the method detailed above: it could lead to virus writers creating malware to run on the devices which receive the SMS messages. A cryptographic token is therefore a better solution as it's not possible to install any additional software on such a token. Ideally, it would have separate algorithms for both logging on to a site and signing a transaction.

While I assume they are talking about a hardware token, this is essentially what WiKID can do using two separate domains. Each domain has its own public/private key pair and thus are cryptographically distinct so the session authentication is completely separate from the transaction authentication. And there's no reason why we can't use the public keys to encrypt data that an attack can't guess a la Kaspersky's suggestion of the account number into which the funds are to be transferred.

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom