One-Time Passwords, even biometrics...that rely on browser communications are useless against the bad guys...two factor authentication must be done "outside the browser."
Attacks on strong authentication factors need new defenses
According to Gartner...Fraudsters have started to raid user accounts by beating strong two-factor authentication methods. Gartner analysts said that Trojan-based, man-in-the-browser attacks are circumventing strong two-factor authentication, enabled through one-time password (OTP) tokens.Two-factor authentication based on telephony is also being circumvented, using call forwarding so that the fraudster, rather than the legitimate user, is called by the service provider performing the authentication.
Other strong authentication factors, such as those using chip cards and biometric technology that rely on browser communications, can be similarly defeated.
"These attacks have been successfully and repeatedly executed against many banks and their customers across the globe in 2009," said Avivah Litan, VP and analyst at Gartner. "However, while bank accounts are the main immediate target, these attack methods will migrate to other sectors and applications that contain sensitive valuable information and data."
Examples of attacks that have worked to date include:
1. Malware overwrites transactions sent by a user to the online banking website. This happens behind the scenes, so that the user does not see the revised transaction values. Many online banks will then communicate back to the user's browser the transaction details that need to be confirmed by the user with an OTP entry, but the malware will change the values seen by the user back to what the user originally entered. This way, neither the user nor the bank realizes that the data sent to the bank has been altered.
2. Authentication that depends on out-of-band authentication using voice telephony is circumvented by a simple technique whereby the fraudster asks the phone carrier to forward the legitimate user's phone calls to the fraudster's phone.
Continue Reading at HNS
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ubTfZcdDiaEe74VTduwINE-j9SFtKZ2BSLr5-MayoHg38TdL2ET5jc3mie0-mtWyc25u9Mb3VcegtNL1T03H82i5JkaWWXr0N2uqWWPcifbOcB9dhRnO4Gp3kJuFcVF69VzpDWIxdkMydjTCr04MI=s0-d)
