Skip to main content

two-factor-phish-against-citibank-demonstrates-the

Posted by: admin 15 years, 12 months ago

Lance James at Secure Science has screen shots of the phish attack against CitiBank's business site that uses a hardware token one-time password system. You can see them on WaPo's Security Fix Blog.

Before everyone gets all up in arms about this in the blogosphere. Let's talk about authentication types:

    Session Authentication - authenticating the user to the host to create a session
  • Mutual Authentication - The host is authenticated to the user, as well as vice-versa
  • Transaction Authentication - A transaction is authenticated in a manner cryptographically distinct from the session authentication mechanism
This type of attack was predicted and expected. If Citibank was doing just transaction authentication with their tokens, this attack would be a lot tougher. The MITM would have to generate a fake transaction at a time when the customer was planning on making a transaction. Still, it could be done, they would just have to wait for the user to make a transaction and be ready to the old switch-a-roo.

Much has been written about how SSL isn't effective against MITM attacks because nobody actually verifies the SSL certificate (this is way WiKID's mutual authentication method checks the cert for the user before showing the OTP).

Transaction authentication could be done via transaction analysis as it is for credit cards, but, while that might be effective for consumer accounts with regular payments, commercial and brokerage accounts would be much tougher. I don't think we need "digital signing", in a strict sense of the term, but I do think you need something that is distinct from the session authentication method or the attacker will fake a session time-out to get the user to give them another passcode. WiKID's ability to handle multiple 'domains' with separate public/private key pairs provides a cryptographically distinct method that uses the same token client.

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom