The WiKID Blog | WiKID Systemshttp://www.wikidsystems.com/blog/2010-06-22T15:25:00+00:00The WiKID Blog, musings on two-factor authentication, information security and some other stuff.Javelin Strategy on Business Banking2010-06-22T15:25:00+00:00adminhttp://www.wikidsystems.com/blog/author/admin/http://www.wikidsystems.com/blog/javelin-strategy-on-business-banking/<p>Read this post on "<a class="external-link" href="https://www.javelinstrategy.com/blog/2010/06/21/business-bank-accounts-the-missing-features-that-no-one-is-talking-about/">Business Bank Accounts: The missing features that no one is talking about</a>" for a great summary of the missing features that online banking needs to provide a secure solution for their customers, including one-time passwords. I find this to be a little dis-heartening as I believe that online banking needs for more than the features on this list. We have often gone on about <a class="internal-link" href="http://www.wikidsystems.com/learn-more/technology-architecture/wikid-mutual-authentication/" title="WiKID Mutual Authentication">mutual https authentication</a> and <a class="internal-link" href="http://www.wikidsystems.com/learn-more/technology-architecture/transaction_authentication" title="WiKID Transaction Authentication">transaction authentication</a>, but it turns out banks are a long way from providing these "advanced features". Perhaps I should be more positive: Think how easy it should be for a bank to increase their security.</p>Best Practices2010-03-12T13:36:00+00:00adminhttp://www.wikidsystems.com/blog/author/admin/http://www.wikidsystems.com/blog/best-practices/<p>There were a number of <a class="external-link" href="https://twitter.com/joshcorman/status/10320866478">tweets</a> yesterday about "<a class="external-link" href="https://twitter.com/jack_daniel/status/10322465243">best practices</a>". This took me back to <a class="external-link" href="http://newschoolsecurity.com/2009/10/new-best-practice-think/">Adam Shostack's post at New School on his best practice: Think</a>. Now I am throwing my hat in the ring with:</p>
<p>Improve.</p>
<p>This best practice was in part in reaction to the conversations about APT or Advanced Persistent Threat, or as<a class="external-link" href="http://www.csoandy.com/2010/03/the_adaptive_persistent_threat.html"> CSOAndy says: Adaptive Persistent Threat</a> and to some conversations around <a class="external-link" href="http://www.krebsonsecurity.com/2010/03/crooks-crank-up-volume-of-e-banking-attacks/">the pain being felt right now around Zeus and other malware by banks and (mostly) their corporate banking customers</a>. Adaptive is the correct word here. Whatever security mechanism you put in place to protect yourself will eventually be circumvented (most likely) or defeated. </p>
<p>What this means that security is always going to be additive. You can't turn off your firewall just because today's threats go around them. Those old threats are still out there.</p>
<p>It also means you should think about how you structure contracts with vendors. I've long believed that the "permanent license" was not. An annual license makes more sense when your goal is to keep your vendor improving their product. </p>
<p>An interesting sub-practice implied is to start simple. As some of you may know, we have a partner in the corporate banking space, <a class="external-link" href="http://www.onlinebankingsolutions.com">Online Banking Solutions</a>. They have embedded our software tokens for two-factor session and mutual https authentication into their products, including M-Secure Browser, a hardened browser they have in production at a couple of banks. At a recent joint presentation, we were asked if their USB version has "FIPS-whatever encryption". The answer is no, but it certainly could be. It certainly would be more secure if it did, but the current solution solves the current problem of Zeus and other MiTB attacks and traditional phishing and MITM attacks.</p>
<p>The problem with running on a hardware-encrypted USB drive now is that it is expensive to do and might not protect the user from the next attack. It might be better to do transaction authentication on a separate wireless device. Or to require two digital signatures/authentications just like checks that require two signatures. Or maybe it will be to use a hardened USB drive with it's own hardened version of Linux and a hardened, single-site browser. The point is not to over-spend now and plan on improving.</p>
<p> </p>More on PCI: The Costs of Credit Card Fraud2010-02-12T15:07:00+00:00adminhttp://www.wikidsystems.com/blog/author/admin/http://www.wikidsystems.com/blog/more-on-pci-the-costs-of-credit-card-fraud/<p>For all the circus atmosphere of the PCI debate at Shmoo, I got the feeling that most everyone agreed: PCI is getting the worse security offenders up to speed. There is no guarantee that they are 'doing it right', but most are doing it better. If the payment system had been designed correctly, then all of this effort to secure payment data would not be necessary. Sadly, it is too late to fix this because of cost. Oh, wait. Stop. Actually, that last point was somewhat contentious.</p>
<p>It's time to discuss the "4,000,000 band-aids vs. Just doing it right" debate point from Great (and Ongoing) PCI-DSS debate. @mycurial made the point that if payment processing was designed correctly, then all this security infrastructure would not be needed. Why not make the change? Cost, was one answer. The key questions here are 1. How much? 2. To whom? Visa apparently does not release these numbers, luckily, by using a complex statistical analysis function known as 'subtraction' I have come up with an estimate. </p>
<p>According to the <a class="external-link" href="http://risk.lexisnexis.com/literature/LexisNexisTotalCostFraud_09.pdf">2009 LexisNexis® True Cost of Fraud Study</a> (Watch out! PDF!, but worth it!) the annual costs breakdown as follows: $4.8 billion for Consumers, $11 billion for Financial Institutions and $100 billion for merchants. But that's not all:</p>
<p class="callout">Factoring in the additional cost of lost/stolen merchandise, U.S.<br/>retail merchants are suffering a total industry-wide fraud loss of<br/>$191 billion</p>
<p>The study claims that 16% of the $191 billion is in fees to "financial institutions". It doesn't specify whether that included the Brands (I assume it does). So, just using these numbers, it would appear that FIs net $19.5 billion from fraudulent transactions. I guess one person's costs are always someone else's revenues. </p>Marcus Ranum on Gartner on Two-factor Authentication2009-12-17T16:57:00+00:00adminhttp://www.wikidsystems.com/blog/author/admin/http://www.wikidsystems.com/blog/marcus-ranum-on-gartner-on-two-factor-authentication/<p>Here's a <a class="external-link" href="http://blog.tenablesecurity.com/2009/12/afterbites-with-marcus-ranum-gartner-two-factor-authentication.html">great post by Marcus Ranum</a> on <a class="internal-link" href="http://www.wikidsystems.com/blog/avivah-litan-on-two-factor-authentication" title="Avivah Litan on Two-factor authentication">Gartner's recent pronouncements about two-factor authentication</a>:</p>
<p class="discreet">In other words, the title SANS gave this "NewsBite" is almost 100% wrong. Gartner (regardless of how they phrased it) identified not that 2 factor authentication isn't "strong enough" - it's rather more a case of "everything surrounding the 2 factor authentication is too weak"</p>Avivah Litan on Two-factor authentication2009-12-14T18:55:00+00:00adminhttp://www.wikidsystems.com/blog/author/admin/http://www.wikidsystems.com/blog/avivah-litan-on-two-factor-authentication/<p><a class="external-link" href="http://www.gartner.com">Gartner</a> analyst <a class="external-link" href="http://www.gartner.com/AnalystBiography?authorId=12030">Avivah Litan</a> has released a new report on how attackers are <a class="external-link" href="http://blogs.gartner.com/earl-perkins/2009/11/25/when-and-where-strong-authentication-fails-by-avivah-litan/">circumventing the protections provided by two-factor authentication systems</a>
for online banking. I have not purchased nor read the document, just the summaries that have been released.</p>
<p> </p>
<p>In my Sector presentation I covered a many of these same issues. The malware owns the browser and you cannot trust anything that comes from the browser. Moreover, <em><strong>whatever mechanism you use to validate the transactions will become the next attack target</strong></em>. So, as banks have started to use SMS as a low-cost method of validating transactions, attackers have followed, leading to <a class="internal-link" href="https://www.wikidsystems.com/another-nail-for-sms-authentication" title="Another nail for SMS authentication">fraudsters bidding up re-programmable phones</a> to intercept SMS messages and other attacks. As I pointed out at Sector, if you use dial-back system, then the attackers will target the user's phone system (remember, Zeus is currently focused on corporate accounts for large dollar amounts). Phone systems are often unpatched or not considered a security threat. </p>
<p>Litan recommends:</p>
<p class="discreet">Use out-of-band communication protocols that can prevent calls being
forwarded to numbers that are not registered for a specific user
account.</p>
<p>I'm not really sure how you can do that. She also recommends:</p>
<p class="discreet">Use out-of-band transaction verification to verify user transaction
requests and only execute the specific transaction verified or signed
by the requesting user.</p>
<p>I believe it is only a matter of time before digital signing on a second device is required for online transactions. Why? Because the problem that banks face is not malware or social engineering. The problem is a determined, motivated attacker that will not stop until it is practically impossible to get any money from their efforts. </p>
<p>To be clear, WiKID does not do digital signing at this time. However, it is capable of providing some type of digital signing since we use public keys. </p>
<p>You can find my Sector Slides here: <a class="external-link" href="http://www.slideshare.net/nowen">Towards a More Secure Online Banking Experience.<br/></a></p>Sector2009-10-05T14:20:00+00:00adminhttp://www.wikidsystems.com/blog/author/admin/http://www.wikidsystems.com/blog/sector/<p>I will be speaking at the Sector security conference in Toronto this week. The title of my presentation is "<a class="external-link" href="http://www.sector.ca/sessions.htm#Nick%20Owen">Moving Toward a More Secure Online Banking Experience</a>". It is indeed mostly about authentication for online banking (session, host/mutual/, transaction authentication), but also about the structure of the industry. </p>
<p>If you're in Toronto and want to meet, please track me (Nick Owen) down. The best way to get me <a class="external-link" href="http://twitter.com/wikidsystems">will probably be via twitter</a>. To follow all the Sector action on twitter, use the #sectorca hash tag!</p>