| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Top of Page | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
| European Banks: 29 American Banks: Zero |
 |
OTP's (One Time Passwords) will be circumvented by MITB attacks. (and real-time keylogging) |
I'm not Nostradamus, but I can tell you this. Banks would "prophet" from the eradication of "typing" and thus all the problems associated with with it.
 |
| Banks Should Be Big Drivers of this kind of hardware. First they need to admit that they're in a losing battle with hackers and must stop with the band-aid responses to the real threats they face. |
Malware integrating itself into a victim's Web browser is nothing new. Increasingly however, these man-in-the-browser attacks are being used to successfully bypass authentication mechanisms used by online banking sites, according to a security researcher. (Editor's Note: Kaspersky Labs has called for the mass adoption of peripheral card readers for ALL internet banking users and HomeATM has the ONLY PCI 2.1 Certiified Peripheral PIN Entry Device/card reader designed for eCommerce.) Jason Milletary, technical director for malware analysis at SecureWorks, explained banking Trojans like ZeuS, Gozi and SpyEye utilize man-in-the-browser (MITB) techniques to provide cyber-criminals with additional information needed to conduct financial fraud, such as the victim's Web browsing activity and data. "These types of threats have been technically established for several years," he said."The concern is how these types of attacks are potentially being used to attempt to bypass more advanced authentication mechanisms being implemented by online banking sites."  Editor's Note 2: No matter how "supposedly" advanced an authentication mechanism is, if online banking continues to be conducted "inside the browser" it will be eventually defeated by MITB attacks. Online banking authentication, and for that matter, ALL financial transactions, MUST be conducted OUTSIDE the browser. |
Question: If you are 2000 miles from your bank, at 2:00 AM and need $200.00 what process is trusted to authenticate you and disperse the $200?
Thus if all a banks customers securely login by doing what they do at an ATM, swipe their bank issued card, enter their bank issued PIN and do it on a bank issued PCI certified PIN Entry Device the problem created by "typing" would be eliminated by "swiping."I'd be happy to provide further insight as to why this is a "no-brainer" for banks to deploy.
 |
| It's the Typing |
Russian and Ukrainian banks have been lately trying to stop the onslaught of BlackEnergy 2, a Trojan that manages to bypass the Java application that the customers use to authenticate themselves when accessing their accounts, steals the credentials, and then proceeds to bombard the same application with data until it crashes - diverting the bank's attention from the heist in progress.According to Joe Stewart, a researcher with Secure Works, the people behind these attacks are Eastern European criminal gangs. The attacks started in late 2009, and they are still being carried out. The exclusive targets are banks (and customers) from Russia and Ukraine. The Register reports that Stewart analyzed the Trojan and has presented his findings at the Forum of Incident Response and Security Team (FIRST) being held this week in Miami. He claims that the Trojan has been modeled upon BlackEnergy, the DDoS Trojan (mis)used in the Russian/Georgian conflict in 2008.
Image via Wikipedia
Question: If you are 2000 miles from your bank, at 2:00 AM and need $200.00 what process is trusted to authenticate you and disperse the $200?Thus if all a banks customers securely login by doing what they do at an ATM, swipe their bank issued card, enter their bank issued PIN and do it on a bank issued PCI certified PIN Entry Device the problem created by "typing" would be eliminated by "swiping."I'd be happy to provide further insight as to why this is a "no-brainer" for banks to deploy.
