Slashdot Mirror
Knoppix Used in Internet Banking Solution
renai42 writes "Australian company Cybersource says it's currently talking to two domestic banks about providing Knoppix-based bootable CDs to consumers to ensure Internet banking security. The company says at least one bank will probably use the CDs in at least one sector of its operations. Cybersource envisages that banks will re-brand its product and provide the CDs alongside other marketing material."
To surf with knoppix you have to be using a cable/DSL ethernet modem or router, or have a supported dial-up modem and the ability to configure it.
I suppose this is geared to internet cafe use? In which case you have to hope the network's set up in a way that doesnt require password authentication...
Nevertheless, a great idea and I hope it works
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
Never stopped AOL.
How many CD's do you think they've burnt over the last 10 years (or so)?
UBS Switzerland give you a little calculator with a removable card that hashes a challenge code. You type in the response for a one time password. Seems to work quite well as neither my card not the calculator have my account number on it. It does have a card number, which doesn't have a visual link to my account (which would stop casual theft).
National Australia Bank used to have accounts tied to a specific SSL key in the browser's cache. Too bad if you used multiple PC's to access your account (home PC, work PC, work laptop, etc, etc).
Q:I was listening to a CD in Grip and it sounded horrible! What's up? A:Perhaps you are listening to country music
Even if this article is a bit dated, it's very relevant. I find it interesting because he talks some about the economics behind managing risks like those cited.
m es/2000-06-01.html
http://www.sims.berkeley.edu/~hal/people/hal/NYTi
Dr. Varian's writings are in general quite interesting. He is quite able in his discussions of economics for people without a background in the field, like myself.
http://www.welton.it/davidw/
Complete with full source code and build instructions.
SELINUX extensions, too, if they can manage it.
The bank is in the business of banking. Frauds against them or their customers get in the way of the business. Anything they can do to reduce losses and increase customer confidence should be goodness.
GPL is on their side, and should make it cheap and effective.
Hopefully nobody will force the customers to use it. Just provide it as an option.
Pile of Linux-for-Windows ISOs ... mostly Knoppix derivatives ... here http://home.btconnect.com/chrisandcarolyn/torrents /
Do things like http://home.btconnect.com/chrisandcarolyn/knoppix3 8-for-windows.png
Let you use the WinModem. But subject you to the Windows keystroke loggers. What you win on the swings, you lose on the roundabouts. Oh well.
Hi, I'm not informed much about American and other foreign banks, but here in The Netherlands it works the following:
(Almost all) The banks over here use a kind of calculator device. You insert your pass into it. Your normal pass you use for withdrawal from ATM's....
You type in your PIN code and hit 'OK'. On the website of the bank you have to type 2 things. Your account number and the key generated after you hit 'OK' on the device. This key is different every X seconds (I don't know the interval).
This matches with the interval the bank has running. This combination of pass ID, PIN code, account number and the interval is key to have access. You need all of them to get in.
The websites session times out after about 2 minutes when there is no action anymore.
If you want to transfer money, you get another screen. You have to insert the number shown on the screen into the device. After you hit 'OK', another number is shown on the device, you type this in the inputbox of the website. After it is verified, the transfer will be processed.
If the amount to fransfer is higher than X, you have to process 2 numbers on the device and submit the generated numbers on the website.
This is all done on HTTPS and works with most browsers.
I believe this is one of the most secure methods I can imagine. It is not flawless maybe, but it works and there is much needed to hijack information from the sessions. Without the device, the pass and the account number one can do nothing. Without the PIN you still go nowhere....
The device is small, portable and lightweight. Internet cafe's, at the office, at HotSpots, anywhere you can use 'safe' banking this way. As long as the banks website is online and within reach (no stupid proxies or whatever).
Just my view on banking online....
(Almost all) The banks over here use a kind of calculator device. You insert your pass into it. Your normal pass you use for withdrawal from ATM's....
Here is Luxembourg, banks are too cheap for handing out these calculator thingies. Instead they use a scratch-off plastic card with 16 alphanumeric digits on it. When logging in to their service, the site choses 2 (or some 3) positions out of the 16 possible, and you have to enter the corresponding digits.
This key is different every X seconds (I don't know the interval).
Well, here in Luxembourg, the "good" banks do it the same: the key (in our case: choice of scratch card numbers) is valid a set amount of time. However, some of the (less technically savy banks) propose you a different choice of digits each time you hit reload... so a thief who has sniffed some numbers (but not all) can just keep on hitting reload until the bank asks for numbers that he has... not good!
If you want to transfer money, you get another screen. You have to insert the number shown on the screen into the device. After you hit 'OK', another number is shown on the device, you type this in the inputbox of the website. After it is verified, the transfer will be processed.
Our banks do not have this additional security yet... (Apart from maybe Cortal-Consors. I know their German operation has such a system).
This is all done on HTTPS...
In Luxembourg too. No bank is foolish enough to use plain http. and works with most browsers.
Unfortunately, this is not the case in Luxembourg (although some progress was made over the course of last year).
The currently worst offenders have a gateway page which features a Rube-Goldberg like chain of Java Applets, Java Script code, and VB code which only works on Internet Explorer (the Java Applet is MS proprietary java (using the proprietary com.ms.util.SystemVersionManager class...). The output of this is fed, via the VB script, and then the Javascript (!) into a second URL, which gives you access to the Web application itself. Interestingly enough, once that gate is passed, there is no further dependancy on MS-ware, and you can cheat yourself access to the contents (graphs of their mutual funds) by entering that second URL manually.
For their homebanking they have the same "proprietary applet" hack, and in addition a server-implemented browser check. Manually enter the JVM=1 bit into the URL, and fake an Internet Exploder User Agent and you are in! What the hell are they thinking?
I believe this is one of the most secure methods I can imagine. It is not flawless maybe, but it works and there is much needed to hijack information from the sessions. Without the device, the pass and the account number one can do nothing. Without the PIN you still go nowhere....
Indeed, the number generated by the device makes it secure even against keystroke loggers that may be installed (but don't challenge your luck either...)
Say no to software patents.
They can use a mini-cd, the ones shaped like a business card, if thats not enough room for knoppix, then use a mini-dvd in businesscard shaped size.
Liberty freedom are no1, not dicks in suits.
Every WinModem I've encountered in the last three years have worked out if the box with linux. I still can't get my IDE modem to work with SuSE 9.x. I'm not saying that linux works with all software modems, but I think it would be more accurate if the criticism was limited to particular chip sets.
But if there is a keylogger on your machine it will still be able to capture all your passwords and credit card info.
TechSutra
A man in the middle attack can get it and doesn't even involve compromising the CD. Any router between the customer and the bank could be compromised and reroute all packets to a different destination. The most vulnerable will be the customer's router in thier home.
Even that poses non-trivial problems. Without setting up dedicated links, I don't see a better solution.
Just a Tuna in the Sea of Life
If a user has physical access to a regular PC, there is very little you can do to stop her from getting data off it.
Steps like blocking LiveCDs and USB ports may help a bit, but a clueful user/dedicated blackhat-type would get that data through some other means anyway. (assuming it is valuable enough)
I suppose the security measures in a place like that have to be of MUCH, MUCH higher caliber to be of any use. I don't think kicking out people who carry LiveCDs is the solution...
For example, in the situation you have given, she can just boot of a thumbdrive... USB ports aren't usually blocked at BIOS level. If necessary, getting through the BIOS password is just a matter of pulling out the CMOS battery for a minute.
PS: I'm neither a clueful user nor a dedicated blackhat-type. So I'm probably wrong, with that last part.
StrayByte.Net
I don't know what your smoking but why don't you pass that shit around.
"Then the hard disk is booted (which is infected with spyware/malware) which then sees that the Knoppix (or other CD) is in the CD drive, and then boots it instead of booting the operating system on the hard drive."
ok.... somehow malware writers are suddenly writing boot sector kernels that can supercede any operating system and run in front of any operating system..... the malware writers are not that talented, they just happen to have a wide pool of fish that all have the same weakness.
secondly lets say this malware "is loaded" at bootup when windows is loading, it then supercedes the winnt kernel to boot from a cd that it doesn't have a chance of working in? windows programs don't run under linux. windows malware rarely works with anything but internet explorer. So why would they go to all the effort of superceding the kernel to dump themselves into a non-native environment where they don't stand a chance?
Your argument is hubris it holds no water.
let's review.
Malware cannot change BIOS settings. there are too many BIOS' for such an undertaking to be worthwhile by the malware programmer....
let's say they did go after BIOS settings to disable the CD boot option. What would the malware creators gain from doing that?
Malware cannot supercede the kernel, and as soon as it destroys your boot sector to do so, it's a boot sector virus. and again, malware writers don't gain anything from you booting anything but the native OS and using the native browser.
The Knoppix plan regardless of what browser they go with, will be successful at doing what the bank wants:
1) not storing your passwords on the computer Hard drive
2) currently not targetted by malware. (that could be a long time out. malware and virus writers like the easy way out that windows and internet explorer give them.)
I'm talking about IT people using Knoppix. If a sysadmin is trying to recover data that a user stupidly didn't back up, a LiveCD is the best way to do that. The OP made it sound like ANY employee that used Knoppix got the boot, IT staff included.
Incidentally, if any company allows users to save sensitive data to their own hard drive, they're asking for problems. Sensitive files should be on a secure server, locked-down and access-restiricted. Disabling the USB ports treats the symptom, not the problem. And before anyone says boo about it, there ARE ways to prevent users from saving anything to their hard drive, even in XP.
* - I once worked for a company that, for some reason, let employees have admin rights on their NT machines. This led to massive problems (the usual stuff). But heaven forbid I want to change my mouse! I've got very large hands, and I couldn't comfortably use the standard-issue mouse. I asked if I could bring in my own, since the Employee Health Dept couldn't provide a mouse that I liked (the only alternatives were either the same size or those stupid-ass joystick style ones). IT said I wasn't allowed to use a non-standard mouse because it might cause the computers to crash.
A man who can't pronouce "nuclear arsenal" shouldn't have one -sig ends here.
I was just mentioning that the sheer effort to write an application (and yes, it would require a sizable application) to compromise in the first place would be hideous. Yes, CMOS can be written in the first place, to boot the regular drive. But as you can't write to the drive in the first place when it's not mounted for write, you can't have a boot sector code section in place to handle booting the CD. You'll just boot the regular HDD (or whatever).
The complexity you're trying to say can be done is to actuall rewrite the flash ram comprising the BIOS, which is the level you'd have to work this at.
The 'software' you're mentioning would be cleared from memory at the point you reboot the machine otherwise.
So, now you're at the level of not just having an application that's gathered all the CMOS maps for all the bios revisions of all the motherboards out there, you also have to have a working, patched bios that you can upload after inserting a kernel module by dint of a security hole in a browser from a non-priveliged user for each and every board out there. And has code to run a virtual machine from this area of flash ram.
Now, I'm not saying 'impossible', but having worked with embedded systems (building from chips up, building bootstrap code and trivial operating systems), I'd say you were in for a real struggle.
If you've got the nonce to do that, you'd make FAR more using the brain to do something legitimate and raking in millions.
"NOT be able to save any info to my local compute..."
Use PUPPY linux 1.0.0 (live cd)
Can save to a track on the cd that it boots from.