Washington Post Says Use Linux To Avoid Bank Fraud

christian.einfeldt writes "Washington Post Security Fix columnist Brian Krebs recommends that banking customers consider using a Linux LiveCD, rather than Microsoft Windows, to access their on-line banking. He tells a story of two businesses that lost $100K and $447K, respectively, when thieves — armed with malware on the company controller's PC — were able to intercept one of the controller's log-in codes, and then delay the controller from logging in. Krebs notes that he is not alone in recommending the use of non-Windows machines for banking; The Financial Services Information Sharing and Analysis Center, an industry group supported by some of the world's largest banks, recently issued guidelines urging businesses to carry out all online banking activities from 'a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible.' Krebs concludes his article with a link to an earlier column in which he steps readers through the process of booting a Linux LiveCD to do their on-line banking." Police in Australia offer similar advice, according to an item sent in by reader The Mad Hatterz: "Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit told the hearing that he uses two rules to protect himself from cybercriminals when banking online. The first rule, he said, was to never click on hyperlinks to the banking site and the second was to avoid Microsoft Windows."

Comments

What about the banks?

[Profane MuthaFucka]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

Re:What about the banks?

[Shakrai]

And asking me for my Mother's maiden name is really that much better? Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?

I like the security token concept myself. It doesn't rely on easy to figure out (Mother's maiden name, hospital you were born at, etc.) information and is easy enough that most lusers can figure it out quickly. I don't understand why more financial institutions haven't adopted them.

Re:What about the banks?

[AvitarX]

Countrywide had a nice system.

I had to enter my user name, and then then the password screen came up, I would type in my password, and then click on one of about 40 images on the screen.

I had to click the one that was my image (this was rather than a sign in button).

Also, I think a security token can count as a second factor of authentication, and I agree on security questions, never help at all, and often I can't find options with an obvious answer (for myself).

Re:What about the banks?

[nmb3000]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

Re:What about the banks?

[FooAtWFU]

Security tokens are the second factor in two-factor authentication. The banks are just convinced that another-password is good enough, mostly because it's cheaper than doing it right.

Re:What about the banks?

[Anonymous Coward]

I liked your ... windows (haha) ... comment, but ... what if the one part in n-factor is onetime token (like securID and similar ones) ... ... just a thought, just a though

Re:What about the banks?

[Shakrai]

If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

Re:What about the banks?

[Tynin]

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

This computer is protected by retaliatory DoS attacks? I guess that is the best we can hope for until we work out a better implementation of PoIP (Punched over Internet Protocol).

Re:What about the banks?

[Cousarr]

You realize that the way two factor security is supposed to work is that is requires you to know something and have something right? The way that two factor security is usually done from what I've seen is requiring a password that the client knows and a rolling code from a small device the client has. As long as a bank does not allow that same rolling code to be used twice it doesn't matter what kind of keystroke logging, mouse gesture capturing, or screen recording is used nor how fast it is sent to the bad guys.

For you car enthusiasts, it's like taking the engine with you when you leave the car. Even if the car is hot-wired, it's not going anywhere without that thing you still have.

Re:What about the banks?

[Anonymous Coward]

[SA]HatFullOfHollow would be proud.

Re:What about the banks?

[greenbird]

mostly because it's cheaper than doing it right.

Of course it's cheaper than doing it right. They've managed to twist bank robbery do to their lack of adequate security into identity theft that they blame on the costumer and force the costumer to suffer all the financial consequences. It's the perfect scam. If you walk into the bank with a fake id and steal money it's never been blamed on the costumer.

Re:What about the banks?

[Thinboy00]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

What if the token in question is a dongle? It could easily (these days) have several gigabytes of crypto, which you could use as a one-time pad or something... That's a lot of data to log/sniff...

Re:What about the banks?

[some_guy_88]

The Commonwealth bank in Australia (and probably many others) sends you a random code via SMS to your phone that you have to type back in to the site in order to transfer money to an account you've never transfered to before.

Re:What about the banks?

[DarkFencer]

Though I agree two factor authentication is useful, the 'taking the engine' analogy overestimates the difficulty of breaking through it.

All the scammers have to do is instead of recording your keystrokes, gesturing, etc., they display a 'fake' copy of the bank to you through whatever software they have installed on your computer. They take the information you think you are sending to your bank (but are sending to them instead) and instantly have their scripts login to the site from their own systems (or some other bot on the net).

If they prevent your initial login to the site from happening, they can use your username + password + rolling code themselves if their software auto logs in.

This of course requires a user to go to a phishing site (miscellaneous.scammersite.com or something more complex), or requires the phisher to own the user's computer enough that they can intercept their connections & deal with the SSL certificate issues) while the phisher's automated software automatically goes to the real miscellaneousbank.com site.

Re:What about the banks?

[trawg]

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

The way it works here with some banks in Australia is they send you a code via SMS when you try to issue a transfer from Internet banking. You need to enter the code into the website to continue the transaction. So the extra factor here of having the phone offers a pretty useful extra layer.

My bank doesn't offer it; I wish it did.

Re:What about the banks?

[Evil Shabazz]

If your computer has been compromised in this fashion, you've already lost. For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

A Penguin.

Seriously. Because it doesn't matter what OS the computer is running, no matter how badass its security model is, when you have PHB's at the keyboard. Same for the Smith & Wesson: no matter how badass the gun is, that security is only as good as the guy with his finger on the trigger.

Re:What about the banks?

[hidden]

Well, with a token generator (for example), the thief would only have a few minutes to login before the token changed... that would help considerably.

Of course, that means the banks somehow convincing everyone to carry a token generator... (could some of these "printing circuits on paper" things we've been seeing lately be used to put a token generator on your bank card?)

Re:What about the banks?

[Gerzel]

No I'm pretty sure they'd call that Identity theft now too. Great way to shirk off responsibility while still charging for that same responsibility.

Re:What about the banks?

[Anonymous Coward]

The attack described in the bank heists were two-factor. The login basically had them wait for another rolling code to enter, and in the wait period, the thieves stole the money. SNAP!

Re:What about the banks?

[Anonymous Coward]

No it doesnt. You have to type in the code. On.an.infected.machine. The bad guys can STILL see that.

Read the lock analogy above. If you have an untrusted endpoint, no matter if you had a token, smartcard, sms message, or even other "2 factor methods" like geolocation, encrypted cookies, or velocity/risk weighting you would get hosed.

BTW, the bad guys can still screw you over because 1. Javascript based attacks to own your browser 2. they can still get your underlying data, because livecd's usually mount your disks. 3. Livecds are not updated much, so they grow stale, and susceptible to attack.

Re:What about the banks?

[mlts]

That's when you use something like the IBM ZTIC which moves the confirmation of bank transactions to a dedicated device that is hooked up to the PC, but only uses the connection as a method to talk via an encrypted connection to the bank. Because the device and the bank's servers are using their own encrypted channel, the only thing a compromised PC can do is try to jam or block the connection.

I've also seen another third party make a similar authentication device where it doesn't just display an eight digit number on the screen, or act as a smart card, but have an allow or deny button on a standalone LCD screen to confirm things.

Re:What about the banks?

[Anonymous Coward]

liveCD mounts HD (only) when you want to install said liveCD to HD ... other times, it's not mounted (if it is, then the liveCD is no good)

Re:What about the banks?

[jamstar7]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

Per TFA, the banks in the two cases mentioned in the summary used two factor authentication. The hackers' malware delayed their access, and the hackers used a VPN tunnel to access the bank through the compromised computer.

Re:What about the banks?

[JumpDrive]

"This computer runs Windows 7"
The most secure operating system yet.
And it will stay that way , Mr Balmer, as long as you don't release it.

Re:What about the banks?

[schon]

And asking me for my Mother's maiden name is really that much better? Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?

Those are both the same factor, just like a user's password.

Security factors are

1. something you know
2. something you have
3. something you are

In order to qualify as "two factor", you must have two of those (no, having two of the same factor doesn't count.)

So passwords, personal question, and favourite image are all examples of "something you know", and don't represent two-factor authentication.

The Security-token would be an example of "something you have", and thus combining them with a password would be two-factor authentication.

Re:What about the banks?

[mjwx]

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

Because a 2 factor authentication token like an RSA key changes every 10 or so seconds so by the time Bad Guy #1 has finished parsing that log the 2nd authentication factor is out of date. The far cheaper way of doing this which most banks in Australia have started using is a one time password sent to you via SMS. This password works one time only (hence we call it a one time password, geddit) so if the Bad Guys(TM) get the entire password in real time and are reading their logs in real time then they still cant use it as the password has already been used.

Yes it's a band aid solution but at least it's a decent kind of band aid. The alternative is complaining that it doesn't work and then having nothing happen because no one has a better practicable idea.

Re:What about the banks?

[AuMatar]

This has always struck me as a silly way to look at things.

Something you know- a piece of information shared between you and the bank
Something you have- whether it's an old school trick like a signet ring or a new fangled device that uses a hidden key to generate a random number, its still just a second piece of information that's shared between the two of you.
Something you are- whether it's a strand of DNA or a retinal scan, it's still just a piece of information shared between the two of you, except this one can't be changes.

It's all information. Some are slightly harder to get at, but not all that hard. If someone puts a gun to my head, they can have my keychain fob as well as my password, and a sample of DNA. And unless you're physically going to take those things yourself (ie walk into a bank), its still going to be condensed into binary and sent over the internet. I see minimal to no improved security from them over a second password.

Re:What about the banks?

[Inner_Child]

What in the holy hell do people who make costumes have to do with any of this? I would be more concerned about the banks blaming things on their customers.

Re:What about the banks?

[Deagol]

Ugh... my credit union takes not only my login/password, but displays a picture and phrase that I picked out of a list, *and* asks me a question. Kinda inconvenient, but I'm pretty sure I won't be logging into a bogus server in the near future.

Re:What about the banks?

[Anonymous Coward]

DMCA

Re:What about the banks?

[Anonymous Coward]

People dont seem to be thinking about this properly. It doesn't matter how many factors you have of authentication, (or whether one of those factors was SMS'ed to you) you are entering them into your computer, which if compromised, will allow a smart attacker to act as you.

Example:

1) User goes to log in, enters his username and first password, gets the 2nd code from SMS or token generator etc.
2) User enters 2nd code to log in.
3) User gets delivered a 'please wait' page by malware, while his username, password, and valid token code are sent to the waiting hacker, allowing him to log in as the user before the timeout occurs.

There is no way to prevent this that I can see as long as the information is being entered into an invalid PC. The only possible way I can think of to bypass it would be by using SMS but requiring the user's registered cellphone to text (not receive) one of the codes to the banking authority - this would mean that at least one password travels across a system that is (hopefully) not compromised.

Please note that step 3 may not be as obvious as that anyway - the hacker could easily cause the users PC to hang or reboot and he'd just blame Windows, while the hackers merrily log on and steal what they can.

Re:What about the banks?

[zubiaur]

No... if its a propper two factor authentication (password + token) it wouldnt matter, the token changes every 30 seconds or so.

Even if the hacker could see in real time what you are doing, logging every keystroke and having a live video feed of your pc (tokens are entered on a virtual keypad which change everytime) it simply wouldnt matter, by the time you log out your token would have changed at least a couple of times, rendering the obtained token unusable. And at least in my bank, you cannot have two sessions open simultaneously... sooo... it really works! arent we fkn clever?

Re:What about the banks?

[tlhIngan]

The way it works here with some banks in Australia is they send you a code via SMS when you try to issue a transfer from Internet banking. You need to enter the code into the website to continue the transaction. So the extra factor here of having the phone offers a pretty useful extra layer.

My bank doesn't offer it; I wish it did.

Great idea, but then you'll just get a nice bunch of hackers doing a DDoS of the SMS servers used, so you can try to log in, but the servers are so busy, you'll get the SMS sent out a half hour after you try to login. Or they'll monitor your account's phone number, then when you log in, send you hundreds of spam SMS. Nothing's more fun than being spammed all of a sudden, and having to read them all because the one you need is in there somewhere. Especially if they all look very similar.

It's this kind of thing that makes a netbook running Linux very useful. It's why I use my Acer Aspire One (Linux) for. Boots up in 30 seconds flat. That way you don't have to reboot your PC - you whip out your little netbook and do your banking there. Offer a financial package on there to help people manage their money, and you've got a handy device there.

Re:What about the banks?

[shird]

And do you realise this authentication scheme has also been broken?

The crooks these days are breaking into your account in real-time by using your security token code as you login, and preventing you from logging in.

Read the article, he mentions this.

Re:What about the banks?

[maestro371]

"Or how about showing me an image that I picked out but will soon ignore after seeing that it never changes?"

That's kind of the point. If it changes, then that's an indication that someone might be trying to scam you.

Regardless, it's a weak mechanism.

Re:What about the banks?

[shird]

This can be automated easily enough.

Also, it's trivial to redirect the POST to login.cgi or add an entry to /etc/hosts for bank.com to a different site that just presents a 'failed to login' instead of logging in. Meanwhile your password, security code etc has been sent off to the bad guys machine which does an automated "transfer *.* funds to x" script using these credentials.

It's been done.

Re:What about the banks?

[mjwx]

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

Window Forefront. It provides little in the way of actual protection and just makes you more likely to hurt yourself.

Re:What about the banks?

[dakameleon]

No it doesnt. You have to type in the code. On.an.infected.machine. The bad guys can STILL see that.

I think you missed the point - the bank generates the code when you request to add, or transfer to, a new account, and sends that code to your phone which you've registered with them when you signed up, either for the account or for online access. You then return to the site, and activate the new payer or approve the transaction by providing the code.

This means that attackers would have to (a) get a hold of your bank account login details through the above attack vectors, and (b) get hold of your phone or divert your mobile service somehow to receive the code. Short of working out how the bank generates the code, this would put off all but the most targeted bank phishing.

My bank (a major international's Australian arm) goes to the additional step of sending me an email and a letter to say a new payee has been added. The letter is probably a last-resort as it'd be too late to prevent the initial theft, but it's reassuring that failing to notice my phone missing and my emails disrupted I'd still get notified somehow, and probably serves a useful purpose on joint accounts.

Re:What about the banks?

[Compholio]

Because a 2 factor authentication token like an RSA key changes every 10 or so seconds so by the time Bad Guy #1 has finished parsing that log the 2nd authentication factor is out of date. The far cheaper way of doing this which most banks in Australia have started using is a one time password sent to you via SMS. This password works one time only (hence we call it a one time password, geddit) so if the Bad Guys(TM) get the entire password in real time and are reading their logs in real time then they still cant use it as the password has already been used.

None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have. In one of the examples they specifically stated that crackers used the token code and delayed the customer's request:

Johnston's bank requires customers to enter the code from a Vasco security token. But the thieves - armed with malware on the company controller's PC - were able to intercept one of those codes when the controller tried to log in, and then delay the controller from logging in. Indeed, Johnston said the company's computer logs show that the controller logged into the system while the series of thefts was already in progress.

So, instead of the cracker getting blocked the customer would have been blocked because the "malware" made the customer's request come in AFTER the cracker's. If you were really clever you'd program the thing to intercept all the communication before it gets encrypted to go out to the bank and then fake the returned data so the user doesn't know that you're toying with them (yes, you can intercept the crypto library calls - I toyed with this some to get the Red Alert 3 Beta working on Wine). I don't know about you, but I can't think of a solid way around this interception (except having the bank only allow logins from a special custom browser that they load on a Live CD).

Re:What about the banks?

[Anonymous Coward]

BZWBK in Poland sends out SMS withcode for every transfer along with the transfer details - account number, amount and account holder, so if you are careful, you're pretty safe.

Re:What about the banks?

[Profane MuthaFucka]

That's not two factor, it's one factor. It's something you know, in two parts. A key fob introduces something you have.

A big problem with what you described is that 40 images to choose from is like adding one more character to your password, allowing lowercase, numbers, and 4 other punctuation marks only.

It doesn't add much to security at all, in other words.

Re:What about the banks?

[stretch0611]

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

http://fatpenguinblog.com/wp-content/uploads/2006/08/fp_linux-tux-born-2-frag.jpg

Re:What about the banks?

[Anonymous Coward]

Wrong. Read about security tokens, (link somewhere up there). If the factor two is a changing password which comes from a little device, then even logging keystrokes won't help the bad guys. I have a little thingy on my keychain, push a button and get a one time password valid for one minute, without that no one can do anything on my account.

Re:What about the banks?

[mjwx]

Also, it's trivial to redirect the POST to login.cgi or add an entry to /etc/hosts for bank.com to a different site that just presents a 'failed to login' instead of logging in. Meanwhile your password, security code etc has been sent off to the bad guys machine which does an automated "transfer *.* funds to x" script using these credentials.

And this will work how many times before someone notices?

A bank in Australia begins to get suspicious if there are 10 logins from Russia, if they are from the same IP and using different accounts that gets flagged pretty quickly. Besides, this is gotten around easily enough. With my bank I dont have a 2 factor authentication to log on, I use it when I make transactions so each time I make a bpay transaction I have to use my one time SMS code, an attacker can transfer money between my three accounts all they like, they just cant move it out of one of my accounts.

A second authentication factor will stop 90% of attacks, the only thing left is extremely elaborate and detectable ones like this. No it's not 100% bullet proof but what is? Two factor authentication is a vast improvement over single factor authentication. In order for my account to be vulnerable an attacker must have both my password and my phone (or at least SIM card) without my knowledge and/or compliance.

Re:What about the banks?

[HangingChad]

And it will stay that way , Mr Balmer, as long as you don't release it.

Good one. That was the same story we heard when XP came out. Yeah, yeah, Windows 7 is all over that now.

For about six months.

Re:What about the banks?

[Profane MuthaFucka]

A banking chip on every motherboard? Sure, why not.

Connect a very very inexpensive terminal with a protected nonvolatile memory to it and you can enter banking codes. Banks could invent sealing and anti-tamper systems so, like a gas pump or electric meter, the seal is visible to the user where it can be verified to be intact, offering a bit of physical security.

Re:What about the banks?

[tuxgeek]

It doesn't rely on easy to figure out (Mother's maiden name, hospital you were born at, etc.) information and is easy enough that most lusers can figure it out quickly.

The trick to using the "Mother's maiden name, hospital you were born at, etc" approach is to feed bullshit answers to these Q's.
Then record your answers to an encrypted text file you can access whenever you wish to perform your online banking tasks.

Main rule #1, never follow email links to your bank. Either type by hand or click your own bookmark links to get there. Duh!

Re:What about the banks?

[Anonymous Coward]

Bank of America does that now for logging in ..

Re:What about the banks?

[ShooterNeo]

Wrong.

Security tokens store internally a crytographic key or a one time pad. It is mathematically impossible to find out what the secret key/OTP is on these devices from readouts on the display. You have to steal the device and read the bits using an electron microscope. Even if you could do that, it would be very difficult to create a cloned copy of the device and return it to the owner's possession in any length of time.

Thus, the inherent security is obvious : in order to break into an account protected by a keyfob, one absolutely HAS to steal the actual keyfob. That vastly limits the vulnerability : if the user still possesses the card, they KNOW they haven't been hacked to 99.9999999% certainty. Furthermore, only individuals who come in direct contact with the user have a chance to steal the card, and they cannot do so secretly - you could freely give your credit card to a waiter at a restraunt and have him use the keyfob with the secret code displayed, and know that the card could not have been skimmed.

And, of course, the moment the user of the card notices that it is missing, he can call the bank and cancel it and ask for a replacement, eliminating any further losses. If your account information had been compromised, you might not realize for month(s).

I will agree with you on "something you are" authentication. Even if you owned some kind of biometric reader and used it to log on to your bank, it is not any more secure than a password because a fingerprint or DNA sequence is a static piece of authentication. Well, ALMOST....

Theoretically, using technology not yet available, you could give the bank a sample of your genetic material and essentially have security whereby the bank asks your home DNA scanner "give me n->Z portion of the user's genome". This would only be a practical security measure if whole genome sequencing were still very expensive.

Re:What about the banks?

[Profane MuthaFucka]

Something you have- whether it's an old school trick like a signet ring or a new fangled device that uses a hidden key to generate a random number, its still just a second piece of information that's shared between the two of you.

It's all just information. But what the information indicates is the important thing.

When you put in the number from the key fob, you're not sharing a password. You're proving that you have a specific device in your hand.

Re:What about the banks?

[nmb3000]

arent we fkn clever?

No, you're not. Did you miss the part where the malware is running on your computer? If they wanted to, they could simply use your computer to perform the actual transaction, thus your "only one session at a time" doesn't make a difference.

This combined with the description above that details why a 30-second code doesn't help you any (the malware delays/redirects your login and allows the attacker to use the code instead) has just wiped out your fancy 2-factor authentication. Still feeling clever?

Re:What about the banks?

[mjwx]

None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have. In one of the examples they specifically stated that crackers used the token code and delayed the customer's request:

A two factor authentication session, especially a one time password session works for one session only (the active session only if set up correctly). It's not an ideal solution but it can work. No security idea is 100% bullet proof, providing rare examples on how this will not work ignores the fact that in 90% of cases it does work.

Johnston's bank requires customers to enter the code from a Vasco security token. But the thieves - armed with malware on the company controller's PC - were able to intercept one of those codes when the controller tried to log in, and then delay the controller from logging in. Indeed, Johnston said the company's computer logs show that the controller logged into the system while the series of thefts was already in progress.

This is a good example of poor set-up. It allowed another session to be created while a different session was created. This is bad in general and wrong when using two factor authentication. If I have another session open my bank will not permit me to open another one even from the same IP (I had left my desktop logged in and went to do the same on my laptop, I was busy and rather distracted at the time). My bank uses two factor authentication when making transactions not when logging on, so for each bpay or inter-bank transaction I make I must enter a code from either SMS or a "Factor2" authentication token. This is not an example of how two factor authentication doesn't work.

As I said, two factor authentication solves most problems but not all of them. Nothing is 100% secure and there will always be breaks in security, the point of creating security is to make it as hard as possible to break in, not to make it impossible. Also as I said, do you have a better and practicable idea. If not please stop using rare examples against it otherwise nothing will get done and online banking will remain as vulnerable as it is. Two factor authentication may not be perfect but it makes banking a lot more secure then it already is.

Re:What about the banks?

[Anonymous Coward]

You have the right general idea, but a simple security token does not prove "something you have" as the siblings to this post explain. Instead, you need a challenge on transactions that goes into the token somehow. On other posts, a table of one-use transaction tokens used by some banks has been mentioned (which one to use is determined by the transaction target and amount somehow).

Re:What about the banks?

[AuMatar]

Security tokens store internally a crytographic key or a one time pad. It is mathematically impossible to find out what the secret key/OTP is on these devices from readouts on the display. You have to steal the device and read the bits using an electron microscope. Even if you could do that, it would be very difficult to create a cloned copy of the device and return it to the owner's possession in any length of time.

Its a device with a 1 time pad in rom (or similar). The 1 time pad could be easily read off of rom if you crack it open. Or taken from the company that makes them. And none of it stops man in the middle attacks or stops someone from taking the fob- it doesn't need to be stolen for long to loot your bank account. Its marginal extra security at best.

Re:What about the banks?

[nmb3000]

I think you missed the point

It seems it is you that's missing the point.

An SMS code sent to your phone is just a poor-man's RSA "rolling code" security token. The instant you begin to type that code on your keyboard, you've lost the battle again. The running malware can intercept the form submission attempt and then use the code you typed in to do whatever it wants while it delays or just fails your real login request. This isn't a theory, it's a proven fact that's already in use by malware in the wild.

This is exactly what is discussed in the article. Rolling codes (or a cute little SMS message) provide the illusion of security to those operating a compromised terminal. Once again -- if the interface you use to interact with your bank has been compromised, you've failed. End of story.

Re:What about the banks?

[st0nes]

My bank sends me a one-time PIN by SMS to my cell phone when I log in. Any thief would have to be in possession of my cellphone as well as my password. Not 100% secure, but at least it's another layer.

Re:What about the banks?

[AnyoneEB]

None of this will work with the problems described in the article, if someone has control of your computer then you're screwed no matter what kind of authentication you have.

That's not entirely true. If there is some sort of challenge-response scheme that involves the "what you have" part of the authentication (either by a lookup in a table of single-use tokens or by typing the challenge into a security token-like device) and the challenge is based on what the user is requesting to do (ex. the user explicitly types the amount and target account number into their security token and then feeds the response into the website), then you can avoid unauthorized transfers even from a compromised computer.

Of course, it would be best if computers weren't compromised, and booting an OS off a CD is good way to be relatively sure of that, but, realistically, most bank customers are going to be using computers with some amount of malware on them for the foreseeable future.

Re:What about the banks?

[nmb3000]

A bank in Australia begins to get suspicious if there are 10 logins from Russia, if they are from the same IP and using different accounts that gets flagged pretty quickly.

As I pointed out in another post, you are completely missing the point that the malware is running on your computer. The attacker doesn't need to access your bank from Russia, or even from a different IP address. They can just as easily access it from your own computer and your own IP address -- even using your own browser if they want to.

Do you really think the people authoring and operating malware as sophisticated as this are going to be thwarted by something as mundane as checking an IP address? Not likely.

Re:What about the banks?

[st0nes]

Same in South Africa.

Re:What about the banks?

[Compholio]

Not to nickpick, but it's pretty easy to trick users. For example, let's say the bank website says this when you perform a transaction:

Please enter the transfer amount (123456) into the security token and enter the unique transaction authentication code:

A cracker could easily perform this action during the login process and replace the page the user is expecting with something like this:

Your login failed to process due to an authentication key timeout problem. Please enter the new unique key 123456 into the security token and try again.

Re:What about the banks?

[Anonymous Coward]

Even this OTP out of band authentication attempt has been compromise. Two articles, one from 2007 (http://www.fin24.com/articles/default/display_article.aspx?ArticleId=1518-1786_2196328) and another in 2009 (http://www.fin24.com/articles/default/display_article.aspx?ArticleId=1518-2386-2432_2538650) tells the story of syndicates teaming up with the employees at the cellular provider to intercept those SMSs and use it to steal money very effectively, from multiple banks.

Re:What about the banks?

[fluffy99]

It is mathematically impossible to find out what the secret key/OTP is on these devices from readouts on the display.

Not impossible, just not feasible.

in order to break into an account protected by a keyfob, one absolutely HAS to steal the actual keyfob.

Not true. It's still not secure if you're using a compromised computer. It just means the person who compromised your computer has to block your logon attempt (perhaps with a bogus system is offline message) and quickly logon themselves within the short window before the token updates. The hijack could even be scripted such that when the user attempts to logon, it waits until it suceeds, throws the user a system-offline message, and then proceeds to do a money transfer. Certainly not outside the realm of possible.

Its a device with a 1 time pad in rom (or similar). The 1 time pad could be easily read off of rom if you crack it open.

Not if they are done right. In a secure chip design, the rom and processing is all on one chip, and the rom can not be read back out once written. The cpu on the same chip is the only thing that can read the key, and the only thing it does is generate the numbers for the display. This is a similar concept to the smartcard or CAC cards employed by the DOD. The digital signing happens on the card and the private keys can not be retrieved once put on the card.

Re:What about the banks?

[phcrack]

This is why German banks use a one-time pad system at the actual transaction itself. I can log in with a single password. To process an actual transaction though, I need to enter a randomly selected code from a piece of paper they sent me or the code they send me in an SMS. Since it's only good for the transaction at hand and only ever used once, there's no way for it to be used by someone who's intercepted it.

Though, I suppose the attacker could try and get me to go through the entire TAN list, faking failures every time. I don't know how many people would go through 200 failures before calling the bank though.

Re:What about the banks?

[Compholio]

Also as I said, do you have a better and practicable idea

I doubt that the example I've given will be rare for long, computer criminals have proven that they are able to adapt to new techniques when they've been shown to work. Personally, I think that two-factor authentication is an improvement and is a good first step, but I believe that "train your users to be smarter" is a practical idea and will work much better in the long run.

Re:What about the banks?

[sapphire wyvern]

An SMS code sent to your phone is just a poor-man's RSA "rolling code" security token. The instant you begin to type that code on your keyboard, you've lost the battle again. The running malware can intercept the form submission attempt and then use the code you typed in to do whatever it wants while it delays or just fails your real login request. This isn't a theory, it's a proven fact that's already in use by malware in the wild.

It's possible to engineer that out. Instead of sending you a code to "authorise your login", which can then be stolen by the software, the bank sends you a code to authorise a *specific action* which has been requested (either by you or by the pwnage bot). The SMS would contain details of the requested transaction. That way, you get to view the details of the transaction *that was actually lodged*, rather than the transaction that you thought you were lodging, on a much more trustworthy interface.

The next step, I guess, would be Windows malware that attempts to compromise any phones that are connected to the PC so that the bad guys can somehow interfere with the bank SMSs at the phone end of the link. That would be significantly more challenging for the bad guys, though.

Re:What about the banks?

[Compholio]

Though, I suppose the attacker could try and get me to go through the entire TAN list, faking failures every time. I don't know how many people would go through 200 failures before calling the bank though.

If the cracker has hijacked your computer then once you're logged in they know the balance in your account. It seems to me that they only need to present you with a single convincing page to get you to give them a one-time pad that can be used to drain your account (at least up to your withdrawal limit, if you have one).

Re:What about the banks?

[Anonymous Coward]

And how are they intercepting the SMS message to my phone, the one I need to enter to allow them to transfer those funds?
The one that when I get, I think to myself "Who could be transfering my funds, since I'm not logged in?"

Re:What about the banks?

[Randle_Revar]

What's the computer equivalent of the "This car protected by Smith & Wesson" bumper sticker?

Maybe this image?
http://www.insidesocal.com/click/openbsd_armed.jpg

Re:What about the banks?

[Anonymous Coward]

Slightly off topic, but Australia has a very odd notion of security. Any company you do business with over the telephone will ask you for only two things; your name and birthdate. That is all the authentication required.

I moved here a year ago and couldn't believe it. Now everyone in my cubicle-farm knows my birthdate and I know theirs.

Re:What about the banks?

[Korin43]

Marginal? With current credit card security, any waiter can take your card, write down your name, account number, svn number, expiration date, then at any time in the future, buy stuff as you. If they need a keyfob, it would be MUCH more obvious because they need to not only take the keyfob, but keep it (because writing it down would be useless). And what if they buy something on a computer in the back room while you think they're just charging your card for dinner? When it shows up on your credit card statement it would be incredibly easy to find out who did it.

Re:What about the banks?

[cjfs]

Security factors are

1. something you know
2. something you have
3. something you are

The line between factors isn't always so clear. You can ask "who's your favorite musician?" and your answer could be "Kanye West". Now is that something you know ("Kanye West is my favorite musician") or something you are ("a douchebag")?

Re:What about the banks?

[skastrik]

If they prevent your initial login to the site from happening, they can use your username + password + rolling code themselves if their software auto logs in.

This of course requires a user to go to a phishing site (miscellaneous.scammersite.com or something more complex), or requires the phisher to own the user's computer enough that they can intercept their connections & deal with the SSL certificate issues) while the phisher's automated software automatically goes to the real miscellaneousbank.com site.

Which is why some banks (in Sweden at the very least) require that the hardware token be used again for the actual transaction.

Re:What about the banks?

[craagz]

very informative. mod this comment up.

my bank uses a password (something I know) and a grid at the back of my ATM card (something I have) that has A through P alphabets and corresponding random two digit numbers. Every time I make an internet transaction, I am asked to input the numbers corresponding to three random alphabets displayed on screen.

Re:What about the banks?

[Eivind]

True, but it doens't have to be that expensive to do right. My bank offers two different solutions for the second-factor. One is s crypto-key tokenthing that they send you to hang on your keychain. (so you log in with a password + a 5-digit security token from the gadget)

The other is, quite simply your mobile phone. You enter your username and password, if correct, they send you a SMS with a 5-char one-time-password, you enter this and are in.

Yes, it adds 10 seconds to the login-procedure, but it's a very efficient way of stopping keyloggers and malware from learning how to access your account. Even if they successfully snoop your password, that doesn't help them aslong as they can't ALSO intercept SMS-traffic to your cellphone. This isn't IMPOSSIBLE offcourse, but it sure as hell raises the bar.

Re:What about the banks?

[AuMatar]

The original story is about online banking, not credit cards. Credit cards have no security as it is. Adding a key fob to a password protected service doesn't do much. Adding a key fob to an unsecured mechanism does add a fair amount.

And actually you overestimate the security of credit cards- all you need is exp date, name and account number those little numbers on the back aren't really checked, I recently figured out I've been putting in the wrong one for 2 years. It always worked. Credit cards are a moot argument though. It'll never happen. It would eliminate the ability to charge over the phone, do tabs (they typically take your credit card once and then charge it at the end if you walk out), and it would be too inconvenient to carry 3 or 4 of those around everywhere. A pin is more likely to occur (and already is used in Europe- in fact I had trouble using my american card in 1 or 2 places due to lack of a pin). Although hopefully they use more than the laughable 4 digits.

Re:What about the banks?

[ShooterNeo]

Completely impossible if you use a One time Pad. If you use a secret key, and the display updates the code every 10 seconds, it is feasible that it would require the cracker to wait for several years or decades worth of data from the display in order to figure out what the secret key is.

Both ways, you might be able to glitch the secure chip by playing with temperature, voltage, or cutting into the chip and injecting current to the IC itself while it is still running. Or just read the bits off with a microscope.

It COULD be done...but it would be an arduous task that would require probably days of work, if not weeks with top of the line equipment in order to break into a single one of these cards.

And all the owner of the card has to do is notice it is missing, call the 1-800 number, and the card is revoked.

Re:What about the banks?

[wvmarle]

While true, it is not that clip and clear.

For example my bank requires you to know a password, and to have a security token (e-cert they call that over here).

To log in, I have to first enter my account number (a 14-digit number), user ID and password.

The second step is the e-cert: this is a file stored on a USB stick (so not exactly secure, an attacker can access that just as easy as sniffing your password), and then enter a 16-digit hex code as "e-cert password".

This looks like two-factor but it isn't: this e-cert is something you "have" but as it resides on the same computer as the potential password sniffer it is easy to intercept and copy as well. Together with the e-cert password as well. And as this is something that is of course impossible to remember, and you have to enter it every time you "authorise" a transaction, of course I have no choice but to save it in a text file to make it somewhat convenient. So in effect, with that e-cert data (basically an cryptographic key) accessed by the same web page where you have to enter all information, it's still effectively one-factor. Oh and it only works in Windows (FF/Win is OK, FF/Linux not).

The "what you have" part should be TOTALLY separate. A device that gives you a one-time code through some challenge-response maybe (bank gives you some code, your device gives the reply code). A list of those one-time codes printed on paper (similar to the above mentioned device). A one-time code sent to your mobile phone is pretty safe as well (yes it can be intercepted but that is pretty hard - and requires a lot of information from the victim already).

So I do my e-banking from a VM running Windows under Linux, using that VM for nothing but my e-banking. And keeping my fingers crossed in the mean time... oh and as far as I know all banks in HK work like this, so switching to other bank is no use.

Re:What about the banks?

[ShooterNeo]

I just thought of a solution to the man in the middle attack.

In order to do a large transfer of funds, or anything else that a hacker could benefit from, you would be required to enter a code from the keyfob a SECOND time. That is, you would have to enter the code once to log into your online bank, and a SECOND time with a new code in order to move any serious amount of money. PER major transaction.

This would be vastly more difficult to do a man in the middle attack on.

Re:What about the banks?

[anton_kg]

2FA like security tokens with 6 digits does not protect against MITMA, i.e. in case then you PC infected and trojan can change all requests/responds. You might not even know that you are trasfering money to a wrong account, for example. The only solution would be a proper "calculator" type tokens with MAC signature but that is really not user friendly.

Re:What about the banks?

[wvmarle]

If the ROM was opened, you (user) would notice your pad doesn't work anymore, and you ask your bank a new one.

If it is stolen, you will know as well, and unless the thief also knows your password and login ID (not likely - they would either have to force it from you or have your computer compromised to sniff the info beforehand) then it's useless to them.

It is even better than the two-factor ATM card plus PIN code. To successfully defraud the card has to be copied AND the pin sniffed. Yes it's been done (card reader on the slot and a camera) but it's hard.

MIM attacks it won't prevent of course. Nothing is 100% secure. But to say such a token is "marginal extra security at best" is silly. It's probably the best we have, and for sure it's pretty good.

Re:What about the banks?

[craagz]

Maybe one should use this.

http://www.biometrics.dod.mil/Newsletter/issues/2009/Sep/v5issue3_Tech.html

Re:What about the banks?

[wvmarle]

Not true. It's still not secure if you're using a compromised computer.

Unless a MIM attack is done, it's still secure. Just privacy is breached. And even MIM can be mitigated I think.

Use un/pw to log in to the bank account, allow to view past/pending transactions, etc.

When wanting to do a transfer, user enters details, sends those to the bank, then bank replies asking a security code based on their code. Enter that code in the keyfob, read the result, enter that in the web page, send it back.

A MIM attacker could of course intercept this and send their own transaction details. Now requiring the user to e.g. enter the last four digits of the recipient account of a transfer after the code sent by the bank would mitigate that very much. Then a MIM would only work if their account ends with the same four digits. Otherwise the bank would have a challenge/response mismatch. So this way I think it may be even possible to safely do transactions from fully untrusted computers.

Re:What about the banks?

[phcrack]

It seems to me that they only need to present you with a single convincing page to get you to give them a one-time pad that can be used to drain your account (at least up to your withdrawal limit, if you have one).

One-time pad was perhaps the wrong wording. It's a list of 200 or so numbered 6-digit numbers that are used a single time to authenticate a single transaction.

Though I realize people are dumber than I expect, who would enter 200 6-digit numbers into a form from the bank? The bank sent you the numbers in the first place.

The point is that you're only ever asked for a specific number once, and if you mess up three times they lock your account. The attacker would need a good part of the unused list to have a chance at having the right number at the right time.

Re:What about the banks?

[wvmarle]

Then that is not proper two-factor authentication. The second factor should come in play every time you do something sensitive, such as making a transaction. Every single order a single code. Add some transaction information into the challenge-part of the code (e.g. part of the recipient account number) and MIM doesn't work so well anymore. Then the response you have to give your bank depends partly on the actual transaction...

Doing the two-factor part only upon login is not exactly secure indeed.

Re:What about the banks?

[craagz]

or SoIP (Shot)

Re:What about the banks?

[Anonymous Coward]

A little two factor authentication would be nice to see in American banks. Passwords just aren't adequate any more.

And how would an n-factor authentication scheme help when software on your computer is logging keystrokes, mouse gestures, and capturing images of your screen and then sending them near realtime to the bad guys?

If your computer has been compromised in this fashion, you've already lost.

The way this works in Britain (for some banks, anyway) is that every transfer of money out of your account is individually authenticated. Your bank issues you with a little crypto dongle/calculator, and a bank card with a contactless processor and an embedded private key. When you want to move money out of your account, you put the card in the dongle and enter your PIN, the destination account number, and the amount to transfer, and the dongle gives you back a signature on those fields (plus an implicit sequence number), which you copy into the internet banking site. This prevents a number of attacks:

• Stealing the main login password (etc.) is useless, because, by itself, that's not enough to actually get any money out.
• Key loggers don't help: the sequence number means that the authentication code is different every time, and so can't be re-used
• Man-in-the-middle attacks can't initiate a transfer unless the legitimate user is doing something (because they don't know the private key, and can't calculate the signature).
• MitM attacks can't (easily) cause an existing transfer to go somewhere else. You basically have to trick the user into entering the wrong account number; possible, but slightly more difficult.

Of course, it doesn't prevent an attacker from seeing things like account balances and histories, or canceling direct debits, or any of a number of other things, but those are (at best) indirect attacks, and therefore much less profitable, and so less attractive to criminals. There's also a risk of the card being stolen, but that's the same risk as you run with ordinary debit cards.

(This has only been introduced in the past year or so, so there might still be some banks which don't do it, but it seems to be the most common way of handling things now.)

Re:What about the banks?

[MadKeithV]

This is what both online banks that I use do. Every transaction has to be re-verified with a code from the passcode calculator (a separate piece of hardware).

In one case, the password calculator needs your debit card to be inserted, to verify your PIN code at least, and perhaps using more information off the card chip to generate passcodes. The calculator itself is not unique, but you need the debit card and the PIN code to be able to do anything with it.

In the other case, the calculator itself is unique and has a serial number.

Re:What about the banks?

[rohan972]

There is no way to prevent this that I can see as long as the information is being entered into an invalid PC. The only possible way I can think of to bypass it would be by using SMS but requiring the user's registered cellphone to text (not receive) one of the codes to the banking authority - this would mean that at least one password travels across a system that is (hopefully) not compromised.

If it is a one time code used not to give access but to complete a particular action then it doesn't make any difference if the attacker gets it from the compromised PC. It only gives them the ability to complete the transaction initiated by the user. The SMS with the code should also have the details of the transfer requested.

Re:What about the banks?

[Animaether]

The ING bank in NL uses three forms (mostly after fully incorporating the Postbank).

I should note that these are all for authorizing a transaction. Logging into your account still only requires a username and password. Should those be acquired by a malicious party somehow, they will be able to see your balance, your recent transactions (and if they see you always withdraw $200 from a specific ATM every tuesday at 10am, that's dangerous enough, tyvm), and change several settings including your password (but none of the transaction authorization methods).

So, transaction authorization then...
A. You go to complete the transaction and are presented with the challenge.. some long-ish unique number. You whip out an annoying little calculator device that you have to stick a smart card into. You enter that number, and you get the response..another number. You enter that number into the website form and the transaction has been authorized. Problems with these things are rife, from not having the calculator on you, not having the card on you, the device being broken (be that dirty contacts or truly broken), etc.
It's relatively secure, of course, as they'd have to steal your card (the calculators are the same across all clients, of course)

B. TAN-by-phone. You go to complete the transaction, and are presented with just a form where you enter a TAN. At the same time, a text message with that TAN is sent to your phone, along with the amount total. The amount total is shown so that -if- at any point some sneaky man-in-the-middle managed to add a transaction to your session, you should be able to see that, and stop the transaction, notify your bank, etc. Anyway, if all is well, you enter the response, and you're done again. Problems with this might be not having your phone on you, or dead battery, no signal, no carrier, etc. etc.

C. TAN-by-list. You go to complete the transaction and are presented with a challenge, which is basically a number from 1-100, or 101-200 if you've already made more than 100 transactions, etc. Basically 3-digit, maybe 4 if you make transactions all day long. This number can be found on a printed list that was sent to you beforehand by secure mail. Just find the number, and read the TAN code next to it, and enter that. Done. No technological problems with this one, but obviously it does have the weakness that it includes 100 TAN numbers and, if compromised (photo, scan, etc.), can be used multiple times without your direct knowledge until it's too late.

Of all the systems, I very much prefer option C. If I don't want to carry around a piece of paper, I can even move the list over to my phone if I were so inclined (and incur the issues of option B, of course). Its weakness is also easily solved by rotating the look-up relative to the TANs. I.e. shift all the TAN codes by N, say 50. You get a challenge asking you for the TAN code listed by number 80. Those who have a copy of your list go to number 80, enter the value, and the bank tells them 'nuh-uh.. try again, 2 attempts left'. Good luck to them figuring out that they -really- should have been looking at number 80+50 = 130. 130-100 = 30.

This is easily -as- secure as the calculator+smart card, if not -more- secure, a lot less prone to problems both technological and logistical.

Sadly, I think the EU will be mandating the smart card route in the nearish future. So I'll have to carry another card around in my wallet (which is already a nice theft target, but where the f else do I keep it?), drag a calculator with me all the time especially if going abroad (what, you think a Highway 9 Motel is going to stock online banking calculators for dozens of nations? Maybe a Hilton or above might, as a free service included with $500/night rooms.), worry about batteries (I dunno why they haven't made them solar-fed yet; I used to find solar calculators in laundry detergent boxes in the late 80's!), keeping contacts clean, etc. etc.

Re:What about the banks?

[Anonymous Coward]

How about this:
Everyone using online banking has an extra device(card reader, about the size of a small pocket calculator), in which to insert your card.
At the login, the user receives a 6 digit code, first he pushes a certain key on the device, then he has to enter that code into the device, along with his PIN-code (4 digits here)(also there's an 'ok' button to be pressed in between, the device then generates a new 6-digit number based on those 2 codes, the user has to enter that on the bank website. Of course there is a time limit (about 2 minutes I guess).

After login you can do your transactions...
Then the transaction needs to be confirmed using the external device again, multiple transactions can be confirmed in one go.
The user receives another 6 digit code, presses another key on the device (not the first one), then enters the code, presses 'ok', enters his PIN, presses 'ok' again, then has to enter another number (the rounded amount of the transaction), followed by another two 'ok' presses. Thus again generating a 6 digit code which has to be entered.

This is the system we use here, and it proves to be quite effective.
You have the PIN, which only you know, the 6 digit code from the bank, and the transaction amount to verify that there is no 'man-in-the-middle' typing in additional transactions.
Of course website traffic is encrypted as well.

Why aren't more banks doing this?

Re:What about the banks?

[LordAndrewSama]

I like what LloydsTSB does. First, they ask for my username and password, then on the next page, they ask for 3 random letters, like the 2nd 4th and 10th, of another password. not brilliant, but better than username/password and it means if someone gets my details via malware, they have to hope they get the same 3 letters, and they've probably got some system for too many errors.

Re:What about the banks?

[LordAndrewSama]

That's what ABSA south africa does. their security process was better than most. username, password(has minimum complexity), then random 3 letters of a second password(also has minimum complexity). then once you're logged in, if you want to do anything other than looking at the small numbers you get the sms with one time password, and have to enter that.

It would be great if they also sms'd you as soon as you logged in, and gave you a number to reply to if that wasn't correct, but I think they charge extra for that and don't offer the "no I didn't" option.

Re:What about the banks?

[Lord Bitman]

technically, a key fob still uses "what you know", it's just "what you know that you are unlikely to know without what you have", which is good enough for now.

Re:What about the banks?

[IrquiM]

Maiden name is ok - it's you who choose what the answer will be. You do not have to use the real one! I can actually tell you that my mothers maiden name was Ellingsen, and it won't help you anywhere, because that's not the answer I'm using to that question!

Re:What about the banks?

[squizzar]

Paypal recently implemented a SMS based authentication, so whenever I log in I get a message with a code. Since it is sent to my phone I presume this counts as a 'something you have' factor? To me it seems like a fairly simple and effective way of achieving the security requirements. Saves dishing out tokens (you'd end up with loads of them after a while surely)

Re:What about the banks?

[IrquiM]

The SMS way (skandiabanken? ;) ) is far better than the token. You don't want to have everything in your pocket, so you leave it at home instead.

Re:What about the banks?

[squizzar]

What about the card reader solutions in the UK (and elsewhere presumably)? When you go to make a transaction it requires you to put your card in the reader, this talks to the chip on the card. You get get asked to select identify, respond or sign depending on what you are trying to do. Enter a code from the website and your PIN number (into the reader) and you get a response code. I'm no expert but presumably the code you enter is some encrypted hash of the details of the transaction (including the amount), that is then decoded using the key from the card. Thus the generated code is tied to the specific transaction you are trying to achieve so much harder to fake.

I suppose you could do a man in the middle attack whereby the transaction is redirected to a different account, but you wouldn't easily clean someone's account out before they notice that their bills aren't getting paid or something.

Re:What about the banks?

[squizzar]

I asked earlier, but does this sort of attack work against the card-reader type solution we have in the UK where you enter a code and amount into the card reader, with your PIN and it responds with an authorisation code. I presume this works using the secret keys in the chip on the card to encrypt a hash of the transaction details, thus the response code is only valid for the amount (you could presumably fake the rest) specified by the user, which would make it a lot harder to clean out someone's account.

Re:What about the banks?

[IrquiM]

We do this already in Norway in Sparebank1 at least

Been doing it for a couple of years I think, so this is not something new.

Re:What about the banks?

[jimicus]

Mitchell & Webb put this pretty well:

http://www.youtube.com/watch?v=CS9ptA3Ya9E

Re:What about the banks?

[Anonymous Coward]

Well, you're at least thinking, but your comments show that you are obviously new to some of this security stuff ...

Point one - key fobs almost never use OTP - the data storage requirements get big, fast (on both the client key and the server).

Point two - the key fob isn't the weakest point in the chain, so it isn't what is attacked. Go read some of the other comments about session hijacking, especially since that's what occurred to the business in the article.

Point three - when the session can be hijacked, authenticating multiple times for additional transactions doesn't help. There needs to be some way to include transaction details in the authentication for it to have any chance of succeeding (and that ain't easy).

Point four - never, ever use words like 'completely impossible' and 'absolute' in a security discussion. You're 'absolutely' guaranteed to be proven wrong.

Re:What about the banks?

[jimicus]

You are assuming, of course, that these ATM cards really do have random digits on the back.

Rumour has it that at one point a major UK bank's PIN generation algorithm only generated three or four different PINs, and this was in the days before you could easily change your PIN at any cash machine.

Re:What about the banks?

[jimicus]

Malware doesn't have a boredom threshold. Provided it's undetected, it can sit there forever if necessary.

Re:What about the banks?

[Anonymous Coward]

Which changes exactly nothing.

Customers logs on to his bank account. Customer initiates a transfer of $20 to the phone company to pay a phone bill. Malware sends data to the bank to transfer $20,000 to account in Russia. Bank answers back "please enter code to transfer $20,000 to account in Russia. Malware shows dialog box "please enter code to transfer $20 to phone company". Customer enters code. Malware sends code to the bank.

Three hours later, guy in Russia gets out of bed and checks his bank account, then goes out to celebrate. He doesn't even need to be online, waiting for the right moment. Software is much better at waiting than people are.

Re:What about the banks?

[richard.cs]

requiring the user to e.g. enter the last four digits of the recipient account of a transfer after the code sent by the bank would mitigate that very much. Then a MIM would only work if their account ends with the same four digits. Otherwise the bank would have a challenge/response mismatch.

I think this is a very good idea and I hope that someone in bank security thinks of it and implements it

Re:What about the banks?

[jimicus]

Why couldn't your anonymous hacking script simply MITM the entire session and only change the recipient's account for any transactions?

Sure, you're trusting that the user will actually carry out a transaction but if you have the script running on enough people's computers then by the laws of probability you'll still make a fortune.

Re:What about the banks?

[jimicus]

The next step, I guess, would be Windows malware that attempts to compromise any phones that are connected to the PC so that the bad guys can somehow interfere with the bank SMSs at the phone end of the link. That would be significantly more challenging for the bad guys, though.

Significantly more risky, too, seeing as most people (particularly those that are likely to have their PC bogged down with malware) don't regularly connect their phone to their PC.

Re:What about the banks?

[Ant P.]

To make it secure they should store the details of the transaction, then SMS that back to the user along with a verification code to enter if it's correct. A MITM would then have to break into your phone or the cell network to get at your money without you noticing, as opposed to just passing through two magic numbers instead of one.

Re:What about the banks?

[xaxa]

You go to complete the transaction and are presented with the challenge.. some long-ish unique number. You whip out an annoying little calculator device that you have to stick a smart card into.

A big problem with this (if they're the same as the ones used in the UK and, I think, Germany): Criminals can now verify a PIN number when they mug someone. After stealing your card and demanding to know the PIN, they can put your card in a card reader thing, press "Identify" and check it. The reader says "PIN OK" or "PIN incorrect".

See this paper (PDF) for full details.

Re:What about the banks?

[rtb61]

Far safest is to have strict limitations on the size and number of transactions and to ensure the bank is liable for all transaction that it can not legally prove you made. Reason why, think armed bank robbers and how you home via the digital age has now become a branch of a bank, sure only limited cash but there are many ways to obtain your password as demonstrated and approved by the US government and with transfers and withdrawals it can become very risky.

Biggest problem with the digital age, it has taken the secured fortified bank vault and stuck it out in the wild with easy access by any miscreant and only secured by a user name, password and the will power of the person securing both.

Re:What about the banks?

[L4t3r4lu5]

For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

What a totally rubbish analogy.

It's more like having a key for the ignition, and also having a 4 digit code to disable the immobiliser system. Your car keys becomes only half of the required data to start, and therefore steal, the car. Something you have (car keys), and something you know (passcode).

Nobody is saying it'll stop theft of private details outright. It'll just make extra-super-dooper hard for the lay-criminal.

Re:What about the banks?

[Anonymous Coward]

The attacker would only need to ask for the one the bank is asking for.

This is done real time, on the customers PC, by the malware, not by some guy sitting in Russia reading logs from a keylogger.

Re:What about the banks?

[Bert64]

Because they're expensive, and people will lose or break them, and many of the tokens come pre-keyed before you buy them - meaning that the vendor of the device always knows the key...
Most suppliers of these type of devices charge annual or monthly subscriptions for the keys, spread out over a large customer base the costs would be ridiculous.

Re:What about the banks?

[Bert64]

Sending passwords by SMS is not exactly a very secure way of doing things....

Re:What about the banks?

[salarelv]

Yes, this would be a problem but if You are quick You could close the account permanently by calling the bank. Or You just can contact the police and then You would have evidence of the robbery.

Re:What about the banks?

[Bert64]

Depends on the individual tokens...
Some of them let the purchaser load the key material, in which case the keys will only be in one place...
Others are pre-keyed by the supplier, meaning that the keys for all their customers are in one place. If you can acquire access to this (hacking, physical breakin, rogue employee etc) then you now have all the customers and you just need to determine the serial number associated with a particular user.
Also, if a breakin like this occured, do you think a security company selling authentication tokens would admit to the theft? They would do everything they could to cover it up.

Re:What about the banks?

[craagz]

I can verify that I have seen about 5-6 ATM cards from the same bank, with different sets of numbers. :) . that's better than the three or four different PINs of UK bank

Re:What about the banks?

[nostrad]

Won't work, because first you need to authorize the account number being added, and the challenge to adding that is by inputting the account number into your token. Thus the criminal can't transfer funds into his account.
The second part is a challenge with the amount you want to transfer. Again, making it hard to fiddle, although since there are limited amount of digits on the token you can fiddle a bit with the amount, however you still can't get it to your account unless that account# has been pre-authorized to receive transactions.

Re:What about the banks?

[gnud]

You mean, like banks in Norway have been doing for 3+ years? =)

Re:What about the banks?

[Anonymous Coward]

Though I agree two factor authentication is useful, the 'taking the engine' analogy overestimates the difficulty of breaking through it.

All the scammers have to do is instead of recording your keystrokes, gesturing, etc., they display a 'fake' copy of the bank to you through whatever software they have installed on your computer. They take the information you think you are sending to your bank (but are sending to them instead) and instantly have their scripts login to the site from their own systems (or some other bot on the net).

If they prevent your initial login to the site from happening, they can use your username + password + rolling code themselves if their software auto logs in.

This of course requires a user to go to a phishing site (miscellaneous.scammersite.com or something more complex), or requires the phisher to own the user's computer enough that they can intercept their connections & deal with the SSL certificate issues) while the phisher's automated software automatically goes to the real miscellaneousbank.com site.

My bank uses special codes for logging in via my dongle, it always starts with a 9. For sums, I always just enter the sum etc.

So if I see my banksite trying to log me in using a number that could be a transferrable sum for me, I should be very alert. This as always still requires that the user actually think.

Re:What about the banks?

[xaxa]

A pin is more likely to occur (and already is used in Europe- in fact I had trouble using my american card in 1 or 2 places due to lack of a pin). Although hopefully they use more than the laughable 4 digits.

The PINs used in many European (and other) countries have produced a massive drop in fraud.

From here: "The amount of money being lost through card fraud fell by 23% in the first half of the year in the UK, as criminals changed their strategies and prevention measures began to take effect, according to figures published today.
"fraudsters realising that they can prosper more by targeting foreign issued cards, particularly those without chip and pin protection and which currently have stronger currencies than sterling."

Note that the same system is used for both debit and credit cards.

It would eliminate the ability to charge over the phone, do tabs (they typically take your credit card once and then charge it at the end if you walk out)

With PINs you can still do this, but the risk is carried by the retailer rather than the bank if a PIN isn't used (i.e. the retailer loses the money, but if the card + chip has somehow been cloned the bank would lose the money). Shops will demand a PIN if the card supports it, but a hotel might not -- they know where you're staying, after all.

Re:What about the banks?

[selven]

So make the second password a security token! Make a really, long and unguessable password and put it onto a USB stick (or 2 or 3 so you don't lose your account if one breaks), something like this

Re:What about the banks?

[Anonymous Coward]

Asking for a second, weaker password is not really two-factor, and by now you hopefully see why your tone is a stupid one to jump into a conversation with.

Re:What about the banks?

[xaxa]

Yes, this would be a problem but if You are quick You could close the account permanently by calling the bank. Or You just can contact the police and then You would have evidence of the robbery.

It's still worse than before though, and a small change could have prevented it (the card reader just spitting out a number rather than also saying "PIN OK" -- leave that for the bank to decide).

Re:What about the banks?

[Anonymous Coward]

I've used 5 separate banks in Scandinavia the last 7 years and all has had this feature. One token for login, and one to confirm any transfer/payments, tansfers between your own accounts excepted. So I honestly thought this was the way most internet banks do things.

Re:What about the banks?

[Alex Belits]

65537-factor authentication won't help you if established and authenticated session is hijacked by malware.

Re:What about the banks?

[maxume]

The information isn't easy to figure out if you make up answers and store them in a password safe.

Re:What about the banks?

[maxume]

You 'just' have to successfully, transparently MITM a bunch of HTTPS connections. And hope that the infrastructure you needed to do this is not noticed quickly.

Re:What about the banks?

[Anonymous Coward]

That is easy to get around and there was a successfull attackdemo on Swedbank in Sweden which uses a keyfob for all transactions outside of the users own accounts and for all new account creations and also for logging in. For account creations and transactions, the challenge was the actual account number and the sum of the transaction amounts respectivly.

The attack was like this:

Eve sets up a man in the middle attack, between the bank and the user (eg. on your router or on your system usually) and when entering the bank page, it shows the real page.
Alice enters her code which Eve records and sends it to the bank, logging in.
Eve display a fake "wrong token"-page on Alice and move to the transfer page and make a creation of her own account. She then give Alice the token for account creation this time so Alice enters that, thinking she entered it wrong when trying to log in the first time.
Then when the account is created, the same procedure is done again for the actual transaction.

The solution Swedbank made was quite clever, but needs some further attention from the user.
They used the knowledge that no account could begin with a nine (9) and no transactions over a certain amount could be made so they went out with a information campaign that all login challenges must begin with the digit nine.

This thwarts the attack as long as the user is aware that all login challenges begin with digit 9 and the rest of the challenges are easily verifiable as they are either the account number that they wish to create as a valid place to put money or the sum of the amounts of transactions.

Security is hard, and a man in the middle attack is very hard to defend against but this security scheme is very good as long as the user is somewhat aware of what they are doing.

Re:What about the banks?

[jimicus]

As has already been discussed, though this is damn difficult under normal circumstances it's relatively trivial if you happen to be in control of the end-users PC through malware.

The premise with SSL is that once the host you're connecting to is verified, you trust the hosts on each end of the connection aren't compromised in some way. If this trust is misplaced, all security assumptions are straight out the window.

Example: You could do a fairly crude but effective hack just by fiddling with your victim's hosts file and injecting your own CA certificate into their certificate store.

That would give you a browser window which appears legit - it looks like it's connected to https://secure.bank.com/ there are no warning signs saying "Alert! This may not be bank.com!" and if the bogus CA cert claimed to be from Verisign I daresay that most people would never know the difference.

Re:What about the banks?

[Anonymous Coward]

You do realize of course that the linux suggestion is so that if your windows machine is compromised there is no way for the intruder to actually watch what you're doing. You can do vnc like connections to watch exactly what another is doing on the machine without the other knowing.

A little usb key fob isn't going to fix that if you're whole machine is compromised. The person infiltrating your machine will have to know a lot more and know how to read information over the usb pipe, but I'm more than positive its do-able. whether you think that is detterent enough for an attacker to move on to an easier target is up to you and how "safe" a usb key fob makes you feel; although I do have to admit it is a pretty catchy gimmick.

Re:What about the banks?

[vtcodger]

***Nothing is 100% secure.***

Well then, that'd be that problem, wouldn't it? If you are going to do electronic banking and electronic commerce, ultimately one really needs 100% security for the parts of the system outside the vendors/banks. If something VERY close to 100% security can't be provided, electronic banking/commerce will eventually become too risky to use and people will stop using it.

Re:What about the banks?

[geminidomino]

svn number

What does the "N" in "SVN" stand for in this context?

Re:What about the banks?

[MartinSchou]

Well, I quite like the smart card system I have with my bank (Nordea, Sweden). The smart card is built into the bank card I already have. That way I only need to carry my card and calculator with me. If I drop either, it's not a big deal. Nor is it if I drop both in the same location, as I need a code in addition to the card (something I know + something I have) to do any transactions.

Re:What about the banks?

[dkf]

Do you really think the people authoring and operating malware as sophisticated as this are going to be thwarted by something as mundane as checking an IP address? Not likely.

The effective systems seem to be the ones that use a second factor (sending an SMS to your phone is an excellent example) to verify significant state changes. Logging in is not a significant state change, nor in many ways is paying a regular bill. What's significant is making a payment to a new account, and that has the benefit of being pretty rare which helps people remain appropriately cautious when they receive the callback verification message. (Changing the number to send the SMS to would probably need to be another significant change.)

The net effect is that even if the computer/browser is compromised, the attacker still can't get funds away from you since they can't divert any to an account they control without your knowing about it and manually approving being electronically robbed! (OK, they could use someone else's compromised account that you already trust and so on, but that's getting really elaborate and likely to get spotted early.) Having the hacker seeing how much you're into your overdraft is a much lesser problem.

Re:What about the banks?

[T Murphy]

most bank customers are going to be using computers with some amount of malware on them for the foreseeable future

Not if the banks become liable for theft due to poor security. Give the banks financial incentive to improve security and they will do so as soon as they are done trying to lawyer their way out of it.

Re:What about the banks?

[pongo000]

And what happens if your phone has been stolen *and* your login compromised?

Re:What about the banks?

[tompeach]

My bank does this with every transfer or payment, it's called transaction signing. Since the codes are sent via SMS it even confirms the amount and destination in the SMS.

Re:What about the banks?

[Jason Levine]

As a victim of Identity Theft, I can tell you that banks and credit agencies just don't care. The bank writes off the loss due to fraud. The credit agency shrugs their shoulders at bad information in your credit file and tells *you* to fix it (while they happily go on reporting the bad information). In the case of stolen credit card numbers, the credit card company simply issues a new card and reverses the fraudulent charges. Meanwhile, the thief has their new television and the store is out a few thousand dollars.

In my case, the credit card company opened a line of credit for "me" even though the online application contained the wrong Mother's Maiden Name. I only found out about it because the thieves put in for a rush delivery of the card and *then* changed the address on the account. The card wound up at my house instead of their house/drop box/whatever. The incorrect maiden name and quick address change didn't set off any fraud alerts. Neither did "me" trying to get a $5,000 cash advance on the card prior to activating it. And when I called them about it, they refused to give me any information because "I might run out and kill the thief and then they're liable." They even gave the police department the runaround.

As I said, they just don't care. They'll do everything in their power to protect themselves. Even if protecting themselves in the short term means the identity thief gets away and commits more fraud against their business in the long term. In the end, you are only important to them insofar as how much green they can make off of you.

Re:What about the banks?

[Svartalf]

A "little" two-factor authentication that would work would be a PRNG key issued to the customer and a pin/PRNG passcode would go a long, long way to handling the issue. It'd not be bulletproof, but it's something that actually approximates real security.

Unfortunately, they implement things that just simply won't work as second factors, like silly bitmap pics, putting cookies on the browser so they can "recognize" the PC you're on, and the like. Little more than security theater- and not able to protect you any better than the userid/password security does now.

However, until they can actually come up with something along those lines, the suggestions are pretty sound- and comments about popularity are really not good enough to say to not do it. You know, some of those things about Linux that people "don't like" or "make it hard" happen to be some of the things that make it resilient to some of this BS in the first place. Real security isn't something you can "make easy" under all circumstances. The moment you make it "easy", it reduces or removes the effectiveness thereof. Unfortunately, while it's a good rule of thumb, many IT departments take that a bit far and try to make password security "more secure" and actually diminish it by way of making things TOO difficult.

Re:What about the banks?

[Svartalf]

Unlikely to know is more like verging on impossible. Pretty much everyone will be unable to get any more than the pin on a pin+PRNG keyfob passcode, since the passcode changes every minute and unless you know the algorithm and the seed used for the account, it's vanishingly possible to "know" the right combo.

As a result, it's actually effectively "what you have". Biometrics would be another "what you have" but since they can be fooled in many cases, it's not something I'd want to rely upon at this time.

Re:What about the banks?

[Eivind]

It's not a "usb-fob" it's a completely disconnected fob with a small lcd-display from which you read the one-time-pass and enter it into the login-form, using your eyes and fingers.

Sure, it could be sniffed on entry, that's where the "one-time" comes in, the info is useless, because next login, a different pass will be required.

Re:What about the banks?

[mcgrew]

I haven't RTFA yet, but on the face of it, it doesn't make much sense to me. You can be phished as easily using Linux as any other OS. You usually don't get your bank account compromised by a worm or a virus, it's usually a fake web page.

That's why I don't bank online. There's nothing I can do with my bank online that I can't do over the phone.

Re:What about the banks?

[Eivind]

The point of two-factor authenthication is that when you need TWO factors, which are independent, it's a lot harder for a criminal to learn both than if you need only one.

To get into my account a criminal need to know my password AND intercept an SMS sent to my mobile phone.

This is a lot harder to do than *only* know my password. A keylogger or virus on my computer could conceivably steal my passwords and mail them to russia or wherever. It'd have a harder time doing that -AND- intercepting SMS-traffic to my mobile phone.

As I said, SMS by itself isn't impossible to intercept. But when you need to do that in -addition- to sniffing my password, the bar is raised significantly.

Re:What about the banks?

[wh1pp3t]

I had to click the one that was my image (this was rather than a sign in button).

The image you choose is used by Countrywide (BofA) to provide you with the verification that you are not signing into a phishing site, not as part of your login credentials.

Re:What about the banks?

[Anonymous Coward]

My bank (Barclays in the UK) already has this in place. I put my card in a small reader they've sent me, it asks for the pin. If I get the pin right I get an 8 digit code, this gets me into my account. To transfer money to someone I haven't paid before I need another code from the reader.

Re:What about the banks?

[mortonda]

So, instead of the cracker getting blocked the customer would have been blocked because the "malware" made the customer's request come in AFTER the cracker's. If you were really clever you'd program the thing to intercept all the communication before it gets encrypted to go out to the bank and then fake the returned data so the user doesn't know that you're toying with them (yes, you can intercept the crypto library calls - I toyed with this some to get the Red Alert 3 Beta working on Wine). I don't know about you, but I can't think of a solid way around this interception (except having the bank only allow logins from a special custom browser that they load on a Live CD).

The ultimate solution would be for the "something you have" factor be a small usb type device that actually houses a public/private key crypto system. The keyfob would handle the encryption, so there's no chance of intercepting the call. The keyfob could have a small pad on it to enter a password to unlock the private key too, to avoid keyloggers from intercepting that. Once authentication is done, the total ssl cipher can be transmitted using the public key, and then use synchronous crypto for the rest of the communication.

Re:What about the banks?

[Lord Bitman]

look behind you.

Re:What about the banks?

[DarthVain]

Maybe the banks realize that if they make their clients too hard to hack, then they themselves will become the target. This would force them to spend some big bucks on their own security which they are not wont to do. The current system allows them to blame customers. Not to mention banks are not the fastest adapter of technology, or the fact that they currently have other large issues to deal with.

Re:What about the banks?

[Anonymous Coward]

it doesn't help if the windows (haha) are already broken.

That's why I use The Club. Nothing can get past that.

Re:What about the banks?

[BitZtream]

Because when your awesome logging software logs a code generated by my key FOB, that is only valid for one use, during a 5 minute window, then you're still SOL since by the time you get it, I've already used it to login to my account and thus invalidated it for any future attempt.

How about you leave the security to those of us who understand it, or at the very least, read the wikipedia article before you try to blow it out of the water.

For car users, its like if added another lock and key to your car, that ensured the windows were up, doors locked, engine disabled, they key would only work during a 5 minute window around the time you requested it, and the key would destroy itself after its use, requiring that you get a new unique key next time you wanted to unlock your car. So if someone steals it, they have to use it within 5 minutes, AND before you use it.

Breaking the windows in this case would be like someone hacking into the banks computer systems. Not hacking YOUR account. It would be like breaking into GM and rekeying EVERY GM CAR, which is far less of a problem for you specifically.

Realistically, a key fob IS like a car key. It must be physically present to work.

A better comparison is ...

Imagine if your car required just a pin number to unlock the door and start it to drive off. Some cars already do have trivial to bypass numeric entry systems. These are your back account website passwords. Thats where online banking is NOW. Adding a second factor to the equation, say a key fob which generates a one time key for us to access your account is adding a physical requirement to your account. You must have the key fob in your possession to get the key. Now your car requires the passkey AND a physical key to get in. Your car is now ever more secure.

Just for future reference about the numeric keypad entry on some vehicals:

Don't buy those ever. I've come across several and its never taken me more than 30 minutes to unlock one, and thats generally been done in the middle of a parking lot where no one bothered to say anything to me while I was doing so. You might as well just leave your car unlocked if you're using those numeric entry units. Theres your code, and a dealer code that is common to all cars at the dealer in most cases that pretty much everyone at the dealer will know.

Re:What about the banks?

[zubiaur]

Read again please, I am not ignoring the fact that the computer is compromised, instead I am embracing it, If you used online banking systems as the ones I am used to, you will see how difficult is to actually take control of a computer and do all the required steps to make a succesfull operation without the user noticing that his mouse is moving doing things on his own clicking links and all, in fact all cash sensitive operations require the use of the token, thus making a succesful fraudulent transaction a nearly imposible task.

Now, let me give you a real example using my bank's (banco de credito del peru) online system as a reference, lets say that I want to pay my college bill, this are the steps necesary:

-enter the kind of card and the last eight digits.

-enter your online banking password using V keypad(can only be changed using the ATM).

-enter your token.

-select operation.

-wait for the token to change.

-enter token using virtual keypad.

-confirm operation.

-repeat last four steps if necessary.

For added security they make you change the background color and upload a random picture wich is displayed everytime you log in, this is a meassure to fight masive scamms.

You are also constantly nagged to check ssl certificates, not only on the same web page but by phone, mail, tv ads and in the bank's waiting room, it gets anoying but it seems to be working.

Of course, you might argue that if someone is in total control of your pc he could as well fake a personalized web interface, lure you to make aparent valid transaction, record your token and use it in the 30 seconds he has, fine that can happen, but this is not perfect, he would have to fake the ssl certificate (?), monitor constantly the pc until the user decides to use the banking system and act almost simultaneously. How difficult would it be? I mean, seriously.

Ohh and I forgot, unless the operation is not in your "frequent operations" you cannot trasfer more than 300 dollars or 900 pen, how do you make them "frequent"? you have to use the atm.

See? creating a secure system is possible, there is no thing as completely secure but it so far the system seems to be secure enough, If I were a scammer I wouldnt bother with BCP clients, I would go paypal or bank of america.

http://en.wikipedia.org/wiki/SecurID http://www.rafaelvillafuerte.com/2009/05/13/clave-digital-banco-de-credito-del-peru-bcp/tokens they gave us

Re:What about the banks?

[Anonymous Coward]

> Thus, the inherent security is obvious : in order to break into
> an account protected by a keyfob, one absolutely HAS to steal
> the actual keyfob.

Absolutely not.

Imagine a MITM attack with sslstrip or sslsniff. You type in your one-time password, but since I'm in the middle, I pass it on to the bank - which lets me log in as you. I pass your traffic through, and their traffic back, and you are none the wiser. I can also tack on my own transactions between your requests, and I can even modify your balance on the fly as you request it so that you don't see my transactions.

Re:What about the banks?

[AvitarX]

I actually think if I have a grid of 40 images, and need to click on the proper one it is part of credentials.

though the other poster mentioned it is only adding one character to your password.

I still think it is more secure than a security question, and easier to remember too.

Re:What about the banks?

[Anonymous Coward]

Several years ago in my city, there was a home-invasion robbery where the robber demanded a debit card PIN at gunpoint, threatening to return and rape the female if the PIN was incorrect.

This has been proposed before, I think it's a great idea, and I have no clue why banks aren't jumping on it: ATM duress PINs. A secondary PIN that "works" normally by dispensing cash, while the ATM silently reports a hostage situation.

Duress codes are already an almost-universal feature in burglar alarm, and I see no technical reason why this couldn't be done. If there's a problem with idiots mixing up the two codes, a hefty false-alarm fine could solve that problem, just as local authorities already levy false-alarm fines against errant burglar/fire alarms. I have a duress code in my home burglar alarm, and I've never accidentally used it.

What this would not solve is the robber with the mobile PIN verifier, which would probably know what a duress PIn is. For that matter, a robber could probably carry around a scientific calculator, _pretend_ it's a PIN verifier, and threaten death if the PIN is wrong.

Granted, a robber could force you to write down two working PINs under threat of death if whichever one he chooses to use doesn't work, but that still means he faces a 50% chance of using the duress PIN. Burglar alarms have the same vulnerability.

Re:What about the banks?

[BitZtream]

All the scammers have to do is instead of recording your keystrokes, gesturing, etc., they display a 'fake' copy of the bank to you through whatever software they have installed on your computer. They take the information you think you are sending to your bank (but are sending to them instead) and instantly have their scripts login to the site from their own systems (or some other bot on the net).

Which of course requires them to modify the software I'm using so that it ignores or fakes the SSL certificate. Of course doing that requires them to have admin rights on my PC.

It doesn't work by tricking me into going to a phishing site since I don't enter any information at domains I'm not positive about, with valid SSL certificates. That is, after all, the primary point of SSL, authentication. Encryption is a secondary feature that is easily implemented after the authentication has been done anyway, it lays the ground work for the key exchange required for encryption.

So, they have to own my entire PC, as root, or own my bank.

You may be concerned, I'm not.

I'm more concerned by the ridiculous restrictions required for passwords now days that are so absolutely retarded that they make the passwords less secure by eliminating huge chunks of possibilities. You make passwords more secure by adding possibilities, not removing them. Requiring a password to be 6 digits long immediately removes the need to check almost a billion potential permutations, if you only use letters and numbers.

Stop making passwords so ridiculous that people can't remember them.

Re:What about the banks?

[Anonymous Coward]

If the bank site is a bit smart (as my swedish bank) they add security once inside the bank site as well.

So, I have two factor auth (acct number + question/response token pad) to log into the site. Once inside though I cannot add another account to transfer money to unless I put in another number from the token pad. Once the new account has been added and I wish to transfer money to that or any other existing account, yet again it needs to be confirmed with a new number from the token pad.

That's a simple way of doing secure banking. Even if the hacker can get into your account they *still* cannot make transfers.

Re:What about the banks?

[BitZtream]

And what do you do about the big red glaring 'This SSL certificate doesn't match!@$!@%!@%!@%!@%!@%' warnings that slashdot people typically bitch about because they love their self signed certs and ignorance?

Re:What about the banks?

[BitZtream]

You can't prevent the interceptions, not while allowing users to bank over the Internet. The question just becomes 'where did it get intercepted'.

This can all be done with the phone systems as well, and in fact, has been done, its just been a few years and it tends to not be remembered.

Re:What about the banks?

[MBGMorden]

Some have gotten a little better.

Both my credit card accounts are now setup so that if I login on a NEW computer (and after a period of time on a computer I've been using), they'll ask me for the answers to 3 security questions. If you get those correct you are then prompted for the password along with a message you entered when you first registered. The idea there being that if the phrase doesn't match, then you're not really on their site and it's a phishing attempt.

It's still not great, but it's decent. Ironically enough though my WoW account is FAR more tightly secured (via Blizzard's Authenticator) then my actual bank accounts :(.

Re:What about the banks?

[PitaBred]

If you do account locking after a certain amount of tries (as every bank I know of does), it most certainly does add security.

Re:What about the banks?

[ShooterNeo]

Umm, no. Actually, the equation is incredibly simple.

The COST (in special equipment, special knowledge, and time) of breaking the security measure has to exceed the typical gains a thief might get from the crime. The overall security scheme does not have to be bulletproof. After all, nearly no defense that a bank could devise would prevent a thief from obtaining money at gunpoint from the account holder. However, holding people at gunpoint involves an enormous inherent cost...

Re:What about the banks?

[skeeto]

That's exactly the problem. Banks don't have any liability in the case of fraud, so they don't have any incentive to fix it. If banks were as responsible for accounts as credit card companies are for theirs then bank accounts would have much better security. Until then, this will always be a problem.

For example, if a credit card is stolen the holder is only responsible for up to $50 in losses, and if only the number is stolen it's no more than $0. By law. This puts a lot of pressure on credit card companies to take care of security, which is why they do things like call their customers when something looks unusual.

Re:What about the banks?

[AuMatar]

With PINs you can still do this, but the risk is carried by the retailer rather than the bank if a PIN isn't used (i.e. the retailer loses the money, but if the card + chip has somehow been cloned the bank would lose the money). Shops will demand a PIN if the card supports it, but a hotel might not -- they know where you're staying, after all.

In the US, the retailer already assumes all the risk. Which is why we haven't moved to PINs yet- no real impetus for the cards to do it, it won't be them saving money.

Re:What about the banks?

[phantomcircuit]

Which does not even protect against real phishing sites because they can simply get the correct image from the BofA website in the background themselves. At the very best those verification images just increase the complexity of producing a convincing phishing website. Once more I'm sure that anybody who is going to fall for a phishing website would be fooled by 'the verification images feature have been discontinued'.

Re:What about the banks?

[Anonymous Coward]

What's the name of the bank? I definitely want that!

Re:What about the banks?

[greenbird]

The credit agency shrugs their shoulders at bad information in your credit file and tells *you* to fix it (while they happily go on reporting the bad information).

Can some lawyerly type explain why this isn't actionable slander/libel and defamation of character?

Re:What about the banks?

[greenbird]

No I'm pretty sure they'd call that Identity theft now too.

Yeah, I should have said ten years ago this wouldn't have been called identity theft and blamed on the customer, it would have been bank robbery using fraud.

Re:What about the banks?

[dissy]

And asking me for my Mother's maiden name is really that much better?

Of course not. Going from one factor authentication, to one factor authentication twice, is the same thing.
There is no difference between asking for a password and another password, than simply doubling the minimum password length of the first.

The parent suggested two factor authentication.

Re:What about the banks?

[Golddess]

But the point is, presuming that the current minimum password length is 8 characters, it is exactly as secure as making the minimum password length 9 characters and displaying a simple "Submit" button.

Though I guess an argument could be made for the image situation being more secure than increasing the minimum password length by 1 character. Afterall, for a password like "password" how do you predict what image the user would have chosen (the upper left one, duh) if the images are arranged randomly on the screen (oh)?

Re:What about the banks?

[dissy]

Its a device with a 1 time pad in rom (or similar). The 1 time pad could be easily read off of rom if you crack it open

At least on that point, they have planned for it already.

RSA fobs hold their secret key in RAM, not rom.
The battery is held on by the plastic case and not fastened to it in Any way.

If you pop open the case, the battery comes off the contacts and you lose the key.

Additionally, the ram, firmware, and CPU (as well as LCD driver) are all the same single chip.
You really do need an electron microscope to read them. I have attempted to run one through our xray machine at work as well, and the chips die is such a small nm length that you can't see anything of use anymore than photographs of any chips silicon are.

http://www.svtii.com/images/IC_Chip2_SVTI.gif

That is an image of a chip from 20 years ago. Shrink the width of the traces by a factor of 4x (at least) and now imagine how useful that same resolution image is.
Most people don't even have access to an xray machine, let alone a device with the needed resolution.

Even then, all you get is firmware (which RSA is a publicly known formula, so you can get that much easier)
The private key being in RAM will make it extremely hard to read out with only physical access to the fob.

This is also why the fobs have an expiration date on the back. The battery can not be replaced, by design.

Re:What about the banks?

[Anonymous Coward]

Alternatively to stealing the keyfob, they can steal the code live as the user enters it on their keyboard -- which is what happened in the given story which apparently no one here read.

Re:What about the banks?

[Jason Levine]

I'm not a lawyerly type, but as far as I've seen, it isn't because the credit agencies are big. Very big. As such, they have many lobbyists making sure that laws are written in their favor and many lawyers making sure that lawsuits directed at them go nowhere fast.

Re:What about the banks?

[Anonymous Coward]

> in order to break into an account protected by a keyfob, one absolutely HAS to steal the actual keyfob.

Um, NO. Once the user's Windoze infested PC has been taken over by a
rootkit, there's no problem emulating ANY authentication process to conduct
a seamless and lovely man in the middle attack. While the authorized user
is interacting with a botnet pretending to be his or her bank or etc., the botnet
owner - who controls the rootkit and its family of installed trojans on the victim's PC - is conducting the transaction of his or her choice using the owner's login credentials.

And of course there are other ways, that's just the first one that comes to
mind. Using a Live CD or a dedicated piece of network hardware that can
not be reprogrammed without physical access, are the best overall solutions.

Re:What about the banks?

[Korin43]

I missed up, it's actually a CVN number. And it's a card verification number number (or card verification number^2 if you prefer).

Re:What about the banks?

[Chandon Seldon]

Basically, if the user's computer is compromised then the attacker has won. Having a device that you plug into the compromised computer doesn't help unless that device has its own input and output hardware, since the user is inputting his commands into the compromised computer.

Re:What about the banks?

[The Archon V2.0]

That's not two factor, it's one factor. It's something you know, in two parts. A key fob introduces something you have.

A big problem with what you described is that 40 images to choose from is like adding one more character to your password, allowing lowercase, numbers, and 4 other punctuation marks only.

It doesn't add much to security at all, in other words.

Less than that. If the other 39 images are a stock set of images, then someone just needs to try two different accounts once each to find the odd men out. (The second account wouldn't even have an "Image check failed" warning on it.) If they're from a randomized collection of X images, then depending on X, one just needs to try twice (big X) or three times (small X) to whittle down options. Less if one starts with an already-compromised account to get a feel for the possibilities.

And I assume "your" image is chosen by you from their collection? Else most people will have 39 pictures of flowers and colorful frogs and such, and one of a bunch of drunk guys waving at the camera.

And of course, a MITM or even mildly sophisticated phishing attack makes this security trivial. In their program's database, next to 'John Smith's Username: "JSmith23" Password: "MollY4"' is an entry for 'Clicked on this image:'

Re:What about the banks?

[PitaBred]

Also note that it's one of 40 images. Who knows how many total images are in the database? That can really slow down any brute-force attacks, and that's assuming they have a user name to start with. It's also a mouse click instead of a keylogger entry, so basic text keyloggers will still only give an attacker a 1/40 chance of being able to log into your account. It's not perfect, but it's significantly better than a simple extra character.

Re:What about the banks?

[AnyoneEB]

Good point. Hopefully anyone designing such a device does not hire me as their usability expert. ;-)

Seriously, you may or may not be able to create a device such that the user cannot be tricked like that. For example, have "transfer" and "login" buttons on the device and have login keys always start with "login". This may or may not be clear enough.

Re:What about the banks?

[AnyoneEB]

The poor security here is mostly on the user's side, making it difficult for the bank to be sure they are really connected to their customer, so I am not sure how making security the bank's responsibility will change that. I guess distributing live CDs and requiring users to use them when banking would one way to enforce good security on user's computers (while banking). Obviously it is not reasonable to expect to be able to tell what software a remote user is running, but just user agent checking or having the live CD's browser have a client-side certificate which the bank's login page checks for would discourage most users from not using the live CD.

Re:What about the banks?

[dakameleon]

It's possible to engineer that out. Instead of sending you a code to "authorise your login", which can then be stolen by the software, the bank sends you a code to authorise a *specific action* which has been requested (either by you or by the pwnage bot). The SMS would contain details of the requested transaction.

Not only is it possible, that's exactly how it works. I'm amazed that this isn't common practice in the US or elsewhere, now.

The next step, I guess, would be Windows malware that attempts to compromise any phones that are connected to the PC so that the bad guys can somehow interfere with the bank SMSs at the phone end of the link. That would be significantly more challenging for the bad guys, though.

This was my earlier point about how targeted the attack is; this would dissuade all but the most determined, because the phone malware would have to be compatible with your phone's OS, be able to hijack your carrier etc without you noticing something odd with the phone - and given its more limited capabilities and hardware, it's more likely that you'd notice an issue there.

Re:What about the banks?

[bruno.fatia]

My bank requires me to submit the MAC address but again that is not really hard to fake

Re:What about the banks?

[Anonymous Coward]

Heh, I am with Commenwealth and I personally think this is an awesome feature.

However unlike simply securing the login with an sms, the system secures EACH insecure transaction with an sms (Meaning transactions to new accounts, large transfers, etc)

And when you think about it.. The security of such a method is fairly solid.

In one scenario the attacker would need to get your login id, your password and then steal your mobile phone. Which happens to be such a prevalent technology within society that everyone already has one (cuts down costs) and everyone is slowly becoming socially wired to keep their mobile on or near them at all times. So losing your mobile is something one would notice quite quickly. Thereby blocking the attack by either disabling the phone number or changing your password.

In the other scenario logging keystrokes, gestures etc is next to useless. The sms is a one time usage thing FOR EACH TRANSACTION. therefore getting the keystrokes is worthless as it wont work on the attackers transaction (which would generate another sms and alert the user)

Its not impervious I'll admit. I mean someone could somehow remote into your machine and change the details when your not looking for a second. However most banks have both a confirmation screen( where the sms is required to be entered) and then a transaction record screen. Which gives the user ample chance to review their transaction before entering the sms code and agreeing. Unless the user was an complete idiot. Then even this type of attack is very limited at best.

All in all, The system is damn near bulletproof. Using SMS to confirm individual transactions is IMHO such a simple but effective secure method of 2 factor, that I have to tip my hat of to whoever implemented it.

Re:What about the banks?

[fluffy99]

Completely impossible if you use a One time Pad. If you use a secret key, and the display updates the code every 10 seconds, it is feasible that it would require the cracker to wait for several years or decades worth of data from the display in order to figure out what the secret key is.

Two months of output is enough to crack 10% of the SecurID tokens. http://www.cosic.esat.kuleuven.be/publications/article-118.ps. So definitely possible, but not very feasible as I stated.

you might be able to glitch the secure chip by playing with temperature, voltage, or cutting into the chip and injecting current to the IC itself while it is still running.

If you look at http://www.linuxsecurity.com/content/view/124176/2/, they simply sped the clock up and recorded all the possible outputs. In theory you could take a SecurID token, modify the clock long enough to spit out all the values and "wrap" around to the current time again.

Re:What about the banks?

[ShooterNeo]

One time pad of course solve this problem. The bank would have one copy of a one time pad, and your card would have another. The bank's machine would send a "challenge" consisting of the next 16 bits off the bank's one time pad, and your chip would compare it to the next 16 unused bit's off the one time pad in the chip and then respond with about 16 bits following that on the one time pad. The total transaction would eat up 32 bits of the one time pad. The chip would not give any output at all unless interrogated with the correct part of the one time pad. After 10-20 failed attempts or so, the chip would permanently brick itself.

I leave it as an exercise to the reader to determine how much flash memory the chip would need so that it would not run out in in any reasonable length of time, with dozens to hundreds of banking transactions per day.

Re:What about the banks?

[Anonymous Coward]

To counter the fact that a lot of users machines are compromised is why a number of banks in the UK are turning to transaction signing, where an offline device generates a MAC based on the individual transaction. Other options is to use an out of band channel (telephone) to advise the customer of the transaction value and destination account and ask the customer to key into the handset of the phone the confirmation code displayed on the web site.
Both of these approaches protect against the customer machine being compromised and the capability of the fraudsters to rewrite the transaction in the background without the customers knowledge. The so called man in the browser.

Re:What about the banks?

[ToasterMonkey]

When you put in the number from the key fob, you're not sharing a password. You're proving that you have a specific device in your hand.

In most implementations, you enter a PIN along with the key fob number.

Re:What about the banks?

[Eivind]

We've got tan-by-list too. But the tan's are on a credit-card-sized card, with the kind of film over them that you can scratch of with a coin or nail.

Makes it easy to carry on you, and stops people from photocopying the card, even if they could get hold of it for a minute. Sure, they could scratch of all the film, and THEN copy the card, but you'd notice that, hopefully. (atleast you'd have a chance of noticing it)

Re:What about the banks?

[Profane MuthaFucka]

Hence TWO factor. The key fob number proves you have the key fob. The PIN proves you know the password.

Hence TWO factor. Something you have and something you know.

Re:What about the banks?

[Anonymous Coward]

True.dat, I really want my bank to start using something like syferlock

Re:What about the banks?

[DaVince21]

ABN AMRO in the Netherlands does it fairly good. They give you a device when you sign up for online banking, and you use the device to insert your bank card, enter a code given by the website, and enter the response code the device gives you. This gives you several stages of security: your card number, your actual bank card, your PIN, and the output code the device gives you.

Re:What about the banks?

[DaVince21]

For you car enthusiasts, it's like adding additional locks to the car doors -- it doesn't help if the windows (haha) are already broken.

What if one of the locks wasn't actually on the car, but did require unlocking to use the car?

Re:What about the banks?

[Ajaxamander]

I believe biometrics[1] are considered "Something you are" to round out the trifecta with "have" and "know."

[1] NB: Biometrics are bad for a huge number of reasons. (Including, but not limited to: un-revokable. I'll let you ponder the others.)

Re:What about the banks?

[Anonymous Coward]

thank you.

Re:What about the banks?

[Anonymous Coward]

And you won't get suspicious being sent (via SMS) and asked (via your browser) for an authentication code to transfer money when you haven't tried to make any such transactions?

They'll at least have to wait till you want to make a transaction that needs to be authenticated, if they want to avoid arousing your suspicion.

Re:What about the banks?

[Anonymous Coward]

My bank has solved this by asking you to enter numbers related to the action you're performing into the pad, so the number generated can only be used for that specific action. to verify an account (which i need to do in order to transfer money to it) i need to enter X+Accountnumber into the pad , to logon its Y+randomnumber , to complete a transfer to a verified account its Z+amount, etc.

If a hacker hijacks my logon they can only transfer money to accounts i've allready approved, and only in amounts that they've managed to sniff verification codes for, Getting a verification code for their account requires (threats of) physical violence or enough time to figure out my private key (which requires a reasonable number of different request and verification code pairs and a hell of a lot of computing power).

The violence part is highly unlikely (Cybercriminals tend to not actually chase down their victims in the real world) and breaking the encryption is time consuming (Which means its not likely to be done by the time i get a new pad with a new key)

Stealing the cryptopad is basically the only viable solution, (and getting my pin so they can use the pad) , However since the pad is only used for online bank affairs there is no real need to carry it around.

Re:What about the banks?

[Anonymous Coward]

what a stupid article, regardless of the operating system the number one thing that a user always uses when conducting bank and financial related activities on the web is their underpowered brain and we all know where that gets most users. the biggest problem with fraud and accounts getting hacked and systems being compromised is the "idiot factor" and there is an excess of that around today.

Re:What about the banks?

[Baki]

In fact I know no european bank (at least no dutch nor any swiss bank) that does not use TAN, sms or a secure-id in addition to login/password, and this since the last 15 years at least!

I remember electronic banking end of the 80's for postbank/ING already used TAN.

Since about 2 years many banks have switched to the more conventient SMS to a pre-registered mobile number.

Most swiss banks use a secure-id (a device containing a 6-digit number that changes every 20 seconds or so) or a kind of challenge-response "calculator" that uses a smartcard.

Without both stealing user username/password and something physical (phone SIM, TAN list or smart card) it is impossible to take over your account.

The remaining danger of course is a man-in-the-middle attack.

Are there really still any banks left that rely only on 1 or more username/password cominbations alone? That is completely irresponsible.

VM?

[0ld_d0g]

Why not just a VM running whatever OS you want?

Re:VM?

[Techman83]

Keyloggers could still capture the input from the Host OS.

Re:VM?

[shird]

Because as the author explains in the comments, key loggers can run at the low level device driver level. At this level, it can hook key presses in a VM just as well as the host OS.

It's a pain, because nobody wants to go to the trouble of rebooting twice for the sake of paying a few bills. But it's the only way to be sure of a clean environment, unless your BIOS has been hacked. It's at least one good argument for the trusted platform, TPM, or whatever it is. In theory you could be sure that you are running only un-altered digitally signed executables and nothing else.

Re:VM?

[BitterOak]

But it's the only way to be sure of a clean environment, unless your BIOS has been hacked.

But isn't that a rather serious problem? What if the keylogger is in the BIOS? Would a LiveCD help in that case? Is there any way to detect malware in the BIOS?

Re:VM?

[fuzzyfuzzyfungus]

Presumably, if one is handling enough money that 100K or 450K could be stolen, one could afford a second computer and a 2 way KVM switch.

That doesn't solve the "but joe user doesn't want to reboot just to get to his overdrawn checking account" problem; but with real computers routinely showing up for $300 and lower, it isn't exactly an extremist position to suggest banking from dedicated hardware for any nontrivial amount of money.

Re:VM?

[couchslug]

"Keyloggers could still capture the input from the Host OS."

Good reason to use a virtual keyboard in the VM.

Re:VM?

[Firehed]

Which you're clicking on with your compromised mouse input.

All that does is inconvenience you further.

Re:VM?

[grahamsz]

Wouldn't that just lead to a chain of mouse clicks that could be recorded my a mouse logger in the host os?

Re:VM?

[iamhassi]

"Keyloggers could still capture the input from the Host OS."

What about a Windows XP Live CD? I can understand why businesses are afraid to run Linux, it's unfamiliar to their IT and their employees, but I don't understand why they still deal with XP running from hard drives.

Even 10+ yrs ago when I was in college they'd re-image the OS onto the hard drive within seconds over the network with every boot-up on PCs in the computer lab, and this was back on Pentium II PCs and 100mbit. Sounds like a pain for IT but it really made things much easier, just have one image of XP on a central server and update that and every PC that's rebooted throughout the entire campus pulls the same image over the network. Why don't they have a system like that? No virus or malware or problems with crashing, just reboot the PC and everything's back to normal.... hmm, actually this is starting to sound pretty good, I should do this at home.... thanks slashdot!

Re:VM?

[Techman83]

"Keyloggers could still capture the input from the Host OS." What about a Windows XP Live CD? I can understand why businesses are afraid to run Linux, it's unfamiliar to their IT and their employees, but I don't understand why they still deal with XP running from hard drives.

Does the licensing allow it? I don't think OEM licensing does. Maybe for Businesses with OBLs etc, but what about home users? What about getting a live disc, as far as I'm aware you have to create it, which isn't exactly hard(I use BartPE to speed up making our system images), but it isn't exactly a walk in the park, especially if you have painful network card drivers.

IMO, the path of least resistance in this scenario is certainly a linux LiveCD. Download, put in drive, boot up, open a browser and hey presto your banking.

Even 10+ yrs ago when I was in college they'd re-image the OS onto the hard drive within seconds over the network with every boot-up on PCs in the computer lab, and this was back on Pentium II PCs and 100mbit. Sounds like a pain for IT but it really made things much easier, just have one image of XP on a central server and update that and every PC that's rebooted throughout the entire campus pulls the same image over the network. Why don't they have a system like that? No virus or malware or problems with crashing, just reboot the PC and everything's back to normal.... hmm, actually this is starting to sound pretty good, I should do this at home.... thanks slashdot!

All well and good if all your PC's are in labs, doesn't quite work so well for a distributed work force. It's a battle we face at work and something we ponder everyday on how we can do it better.

Re:VM?

[Straker Skunk]

What about a Windows XP Live CD?

"Sir, there are some gentlemen here who say they are from an organization called the BSA. They want to see the license certificates for those Windows CDs we've been handing out..."

Re:VM?

[binarylarry]

That's great and all until a hacker shows up and is like:

"Yo dawg! I heard you like DRM, so I put a TPM in your TPM!"

and then he has access to whatever he wants.

Re:VM?

[functor0]

Ok, so what about using the *host* OS for banking use, and the *guest* OS for daily use?

Re:VM?

[buchner.johannes]

Agreed, I think it is a good idea. Maybe Windows-users will also like the Linux Desktop on the LiveCD and ask themselves why they can't have it as a default.

At the point where you add everything onto the LiveCD you create security issue though that should be mitigated with SELinux/PaX/.... Are there user-friendly OpenBSD live CDs? If yes, that might also be a good choice.

Re:VM?

[innocence18]

What if you randomised the virtual keyboard layout each time it was displayed?

Re:VM?

[buchner.johannes]

If the malware is in BIOS, it will probably not be network capable to send collected keystrokes. Drivers and networking is just too complex to do that. I'm also not sure where it would store them to survive a boot (on some hard disk sectors?).
AFAIK some antivirus programs do check the BIOS, but I guess smart malware may circumvent that.

Re:VM?

[roman_mir]

But it's the only way to be sure of a clean environment, unless your BIOS has been hacked.

- have you tried nuking it from the orbit though?

Re:VM?

[Anonymous Coward]

What if you randomised the virtual keyboard layout each time it was displayed?

That, or just run native fucking Linux. The world will come around, don't worry, you won't die without Office.

Re:VM?

[marciot]

The keylogger also could take periodic screenshots. Then what? If your host OS is compromised, you're screwed no matter what.

Re:VM?

[iamhassi]

"I don't think OEM licensing does. Maybe for Businesses with OBLs etc"

Aren't we talking about businesses?
"He tells a story of two businesses that lost $100K and $447K, respectively, when thieves — armed with malware on the company controller's PC"

"All well and good if all your PC's are in labs, doesn't quite work so well for a distributed work force."

Distributed how? As in not in a office? Again, I thought we were talking about businesses.

Re:VM?

[iamhassi]

"Sir, there are some gentlemen here who say they are from an organization called the BSA. They want to see the license certificates for those Windows CDs we've been handing out..."

"Sure no problem, here's the legal copies of Windows XP"

"A BartPE system image is created using PE Builder, a freeware program created by Bart Lagerweij. It requires a legal copy of Windows XP or Windows Server 2003."

Why did you read "Windows XP Live CD" and jump to OMG HAX OS WTF!?!!!!

Re:VM?

[Techman83]

Aren't we talking about businesses?

Just putting my 2c in regarding the summary and the comments

Distributed how? As in not in a office? Again, I thought we were talking about businesses.

Indeed and having all the PC's in labs might have worked 15 years ago, but I can tell you right now out of the 200 machines we support directly, about 20 are desktops that never move, about 80 we see regularly and about 100 we don't see until the lease expires. So your proposal to send an image at boot time is (with no risk of failure, because failure in the outback of Australia is not an option)

Re:VM?

[DaVince21]

That does sound like a good idea, but will cost a lot more on the company's side.

duh.

[Anonymous Coward]

title says it all

Car analogy incoming!

[Loomismeister]

You could also avoid getting in a deadly crash by using the city's free buses to get to the bank, instead of driving your Jeep. My hole-filled analogy to online banking is that you don't necessarily need to drop the entire operating system in order to be safe while banking online. There must be a ton of idioms that support me on this.

Re:Car analogy incoming!

[Shakrai]

You could also avoid getting in a deadly crash by using the city's free buses to get to the bank,

You've never seen how the bus drivers around here drive ;)

And which city has "free" buses, anyway?

Re:Car analogy incoming!

[catscan2000]

The Emery Go-Round? http://www.emerygoround.com/

Re:Car analogy incoming!

[Mountaineer1024]

One that's smart enough to realise that if you do away with the ticketing system (ticket creation, distribution, ticket machines on busses, policing people not using tickets) the entire bus system can be run for the same money the local government subsidizes the system ANYWAY.
And because the entire system is free, more people use it, reducing congestion on busy city street.
Who loses out on this deal?
People who pay tax and don't use the bus. But at least when they are driving, their roads are easier to navigate.

Re:Car analogy incoming!

[Anonymous Coward]

But what if I live in a basement and never leave my house?

Just Linux?

[bughunter]

How about BSD?

Or even better, how about a modified build of BSD underneath a GUI based on a 25 year tradition of Human Interface Guidelines?

(Just askin')

Re:Just Linux?

[sqrt(2)]

We're trying to SAVE money here

Re:Just Linux?

[RiotingPacifist]

BSD lacks any sort of inter process security, so BSD is not secure for the desktop (granted nobody makes use of these tools for the linux desktop (i plan on fixing this and becoming your god when i get round to it), but BSD doesn't even have them).

AFAIK it is also a lot harder to find signed BSD images where as almost all linux iso come with a sig to verify them against.

Note: I have nothing against BSD but it does have its deficiencies.

Re:Just Linux?

[AvitarX]

I think the point is Boot CD, not Linux.

This would preclude any with an intelligent GUI (actually I am quite fond of Gnome at this point, but that wasn't what you meant).

If I am correct, using a Linux boot CD would make sense for Linux users too.

Re:Just Linux?

[Anonymous Coward]

Huh, what are you smoking?

Re:Just Linux?

[bughunter]

So far, you seem to be the only one to "get it."

Have a cookie! (_)

Re:Just Linux?

[Anonymous Coward]

wtf

Re:Just Linux?

[Anonymous Coward]

MacOS is the only major operating system that hasn't come up with a security solution yet.
Windows Vista and higher got some defenses built in (noexec, randomization, sandboxes, ...)
Red Hat et al. have brought PaX, SELinux, jails, ...
OpenBSD got defensive programming, W^X, jails, ...

You may disable them, but what has Apple come up with?

Re:Just Linux?

[Requiem18th]

Big Whoosh, parent is urging users to use an expensive and extremely overrated OS based on BSD, can you name it?

Re:Just Linux?

[dakameleon]

oblig. whoosh.

Re:Just Linux?

[Anonymous Coward]

> BSD lacks any sort of inter process security, so BSD is not secure for the desktop (granted nobody makes use of these tools for the linux desktop (i plan
> on fixing this and becoming your god when i get round to it), but BSD doesn't even have them).

What exactly is "inter-process security?" Please define this. I want to know exactly what you're talking about.

> AFAIK it is also a lot harder to find signed BSD images where as almost all linux iso come with a sig to verify them against.

Wrong -- MD5 and SHA-256 checksums of all the FreeBSD ISOs are provided. Look at CHECKSUM.MD5 and CHECKSUM.SHA256. This has been in place since *at least* the 4.x days.

Next time, take a little time out of your Linux-centric day to educate yourself before making yourself look like a complete git.

Re:Just Linux?

[juventasone]

Indeed, the article title is misleading. The point is not to use Linux, the point is to use a clean, read-only operating system. You could a "live" Windows CD (Bart, Windows PE, etc). You could use Deep Freeze. Or as one of my linux-using friends recommends, use a console like a Wii.

Re:Just Linux?

[Blakey Rat]

Too bad they've been flushing the HIG down the toilet for the last 8 years.

But if you're going to use an alternate OS, you're still better off using Linux-- once the Windows market dries up, (or whatever), they'll be moving to the next-largest install base, which is OS X. You also get a teeny "security-though-obscurity" bonus in that every Linux distro is different from every other one, wheras OS X and Windows installs are all virtually identical.

Re:Just Linux?

[fwarren]

Does it come on a live CD?

How much will it cost the Windows PC user to run it?

For someone with a CD burner in their computer the cost to download and burn a linux CD is anywhere from 30 cents to 2 dollars.

If you don't want to download and burn it, you can get a linux CD for anywhere from free to 13 bucks

Free https://shipit.ubuntu.com/
$3.80 http://www.osdisc.com/
$5.99 http://shop.cheapbytes.com/
$6.05 http://www.linuxcd.org/
$6.30 http://linboo.com/
$13.00 http://www.amazon.com/gp/product/3937514775

Re:Just Linux?

[Anonymous Coward]

I think the point is Boot CD, not Linux.

This would preclude any with an intelligent GUI (actually I am quite fond of Gnome at this point, but that wasn't what you meant).

If I am correct, using a Linux boot CD would make sense for Linux users too.

Well, I wouln't recommend booting an XP cd with no Service Pack for logging into your bank account...

Re:Just Linux?

[RiotingPacifist]

What exactly is "inter-process security?" Please define this. I want to know exactly what you're talking about.

Provisions to run multiple processes under the same user privileges in such a way that if one gets compromised it cannot compromise others. This sort of thing is mainly used for daemons (apparmor, selinux, etc) but there is no reason that it can't be expanded to the desktop apps. Under BSD you can jail a process but that (short of complex setups) prevents any sort of inter-process interaction.

terrible advice

[QuantumG]

Ya, it stops key loggers, and that's great, but it aint going to do much for your browser security unless you keep your LiveCD up to date, and hey, who says your CD burning software isn't infected - implications on trusting trust and all.

Re:terrible advice

[wizardforce]

Most of the problem is malware and the live cd protects against that threat very well. Also, if your cd burning software is so compromised that it some how manages to corrupt the live cd without the integrity checking program finding it then you probably shouldn't be banking on that computer anyway.

Re:terrible advice

[fuzzyfuzzyfungus]

Unless your browser is listening for incoming connections, or your bank is running third party banner ads(in which case, switch right the fuck yesterday), does a browser vulnerability really matter?

If you are using the LiveCD as a dedicated banking only environment, the only input your browser will see is your bank's website. If you can't trust user behavior, and want to really be sure, you could have it set to reject anything that doesn't have the bank's SSL cert. If your bank wants to 0wn you, you are already doomed. If no other site can reach your browser, your browser cannot be owned, no matter how buggy.

Re:terrible advice

[Anonymous Coward]

Ya, it stops key loggers, and that's great

Yeah, it is great, because a huge part of on-line fraud is from keyloggers. Modern ones even record 'screencast' movies of you using your computer.

but it aint going to do much for your browser security unless you keep your LiveCD up to date

Between booting up and getting a DNS record for your bank how are they going to exploit a browser security problem? You could safely use unpatched IE5 to do online-banking. There might be some null-prefix type problems, but in reality going directly to your bank's site is pretty hard to get in between.

who says your CD burning software isn't infected - implications on trusting trust and all.

There are lots of different CD burning software, lots of different distributions, lots of AV software that might detect the modifications, and high risk of some paranoid geek with sha1 finding it out. Compared to just setting up a 'enter your password and win a free chocolate bar' site, it's not cost effective to do this.

Re:terrible advice

[black3d]

Browser security is only an issue if you're visiting other sites, in the same session, on the same boot, on your LiveCD. Browsers on LiveCDs don't magically download malware from the internet by themselves - you have to direct them to. And most conventional malware must install itself - which won't happen on a LiveCD. There are a very few flash/js based attacks that work live in the same session - but really, if your either (a) your bank has third-party inline flash ads or (b) you don't trust java content from your bank's own website, then why are you banking with them online?

And going as far as questioning whether your CD burning software is infected is ridiculous. You can't be any more certain that your mouse doesn't have imbedded circuitry tracing your movement pattens, or your keyboard doesn't have a keylogger built directly into it, or the aliens aren't tapping directly into your cablings electromagnetic intereference patterns to directly access your bank account as you do. You're going to extremes purely for the point of argument, but although it may have passed you by, it was established several thousands years ago that "nothing is certain".

If you can imagine up scenarios like malware built into your cd-burning software specifically to target LiveCDs being used for online banking, I can't fathom how you trust a banks own employees enough to actually keep your money with them instead of under the mattress.

Re:terrible advice

[QuantumG]

sigh. Just off the top of my head I can think of about a dozen attacks one could direct against a bank user who thinks they're bulletproof because they're using a Linux LiveCD. For example, booting off a LiveCD won't save you from the truncated SSL cert attack that was demonstrated in the direction of PayPal the other day.. only having an up-to-date browser will do that. Encouraging people to use unpatched known-vulnerable software to do their banking just so they can avoid malware on their regularly patched machines makes no sense at all. Of course, that's the extreme case.. suggesting people use a LiveCD of Linux instead of an unpatched copy of Windows XP SP1 is a different kettle of fish.

Re:terrible advice

[grahamsz]

Honestly, you'd be as good if not better with a windows XP bootable PE disk. It's a factory minted CD that's been time tested.

Re:terrible advice

[John Hasler]

What does it cost? Where does Joe Ordinary get it? Does it include a current browser?

Re:terrible advice

[black3d]

A dozen? I can only think of three. Excluding such fanciful attacks as "camera over the shoulder". Indeed, a forged cert combined with DNS poisoning could be used as a possible MITM attack. However, as in my post below, you can explore possible attack vectors for the sake of argument into infinite regression. Opposite to your argument is the fact that my bank always requires the latest version of Java to be installed to use its online banking. Each time Java is updated and my LiveCD thus becomes out-of-date, I'd be forced to burn a new LiveCD which would throw in all the browser security improvements that go along with it. My argument is, it's not "terrible advice". At worst, it's "good advice which could be improved upon."

Re:terrible advice

[Amazing Quantum Man]

I thought the truncated SSL was only affecting those using the MS crypto library?

Re:terrible advice

[Draek]

hey, who says your CD burning software isn't infected - implications on trusting trust and all.

I understand there's only a fine line between safety and paranoia, but the idea of a CD burning software having been compromised to detect Linux LiveCD ISOs and add a software keylogger to the system included therein is so far up in 'paranoia' territory it already got full citizenship and is considering running for president against "Elvis is hidden in Area 51" and "9/11 was planned by Israel to draw the US into the middle east".

Re:terrible advice

[QuantumG]

If you regularly have to create a LiveCD, and you're the kind of person who is susceptible to malware attack, then:

  1) You're not going to do it, and
  2) You're likely going to get owned during the LiveCD creation chain..

It kinda seems like all the value of using a LiveCD disappears as soon as you start trying to update it.. which is why I was bothering to object to suggesting to people that they use a LiveCD, as they necessarily contain software that is not patched up-to-date.

None of this is new BTW, it's just that a pundit has stumbled into this old discussion.

Re:terrible advice

[QuantumG]

Oh please, there's a lot of malware out there that checks to see if you're making a bootable CD and adds itself to the boot chain.

There's also malware out there that modifies your bios so it doesn't matter if you boot off a CD or a hard drive.

Re:terrible advice

[black3d]

As you would expect, my explanation was from a hypothetical view of "if I was using the LiveCD method as discussed."

Personally I'm happy with the security I already have in place, which certainly doesn't involve LiveCDs, but this isn't meant to be a discussion on three-factor authentication or the like, it's about the pros and cons of a regular user using a LiveCD as opposed to their regular PC to log in.

I believe the benefits for the average user would outweight the risks. Certainly the idea can use an improvement - a possible business direction for some budding entrepreneur out there - however it's far better than the status quo users who are constantly, on a daily basis, infecting millions of machines worldwide with malware through their own ineptitude. And it is indeed malware and phising (both vectors which are mitigated through this method) which are the primary sources of the scourge of stolen information. If 99% of attacks are malware/phising and 1% are MITM, don't you also think it better for people to knock out those 99%?

If we see other vectors increasing in popularity, I'm certain we'll see the response from the security community increasing in equal measure. But remember - the users being focused on here are those who simply don't know any better. Though - I can see it coming already.

Email from: yourbank@internationalbanks.cc
Subject: Use LiveCDs to safeguard your internet banking!
Attachment: LiveCD.exe

Re:terrible advice

[jhol13]

How does those malware affect live Linuxes?

Re:terrible advice

[lee1026]

how about a physical keylogger? Live CD won't help there, as it is hardware, not software.

Re:terrible advice

[black3d]

An example is a hypervisor level rootkit, such as SubVirt or BluePill. http://www.eecs.umich.edu/virtual/papers/king06.pdf http://en.wikipedia.org/wiki/Blue_Pill_(malware)

Re:terrible advice

[QuantumG]

Yes, because everyone else has patched the bug.. Microsoft hasn't. But if you're using a LiveCD from before they patched the bug, then you are no more protected than the bozos using IE5.

Re:terrible advice

[Anonymous Coward]

If a physical keylogger can be placed on the machine then the attacker already has everything he needs.

Re:terrible advice

[kd5zex]

He who has physical access to the box; owns the box.

Re:terrible advice

[Anonymous Coward]

Between booting up and getting a DNS record for your bank how are they going to exploit a browser security problem? You could safely use unpatched IE5 to do online-banking. There might be some null-prefix type problems, but in reality going directly to your bank's site is pretty hard to get in between.

Its not hard at all. DNS poisoning, Man in the middle attacks, not to mention the bots constantly spamming attacks for known vulnerabilities would probably massively increase if this sort of misinformed quasi security practise was adopted. anyone browsing a banks site using an unpatched OS and browser (Even a liveCD) is a moron plain and simple, security through obscurity is NOT enough when you are talking about your financial details, even a patched windows box.....shudder... is BETTER than an unpatched liveCD.

Re:terrible advice

[SanityInAnarchy]

Except that CD burning software, and OSes, can both become very corrupted without touching the software. Barring crazy things like hacking the firmware of your keyboard -- and some keyboards (including Apple ones) have firmware -- the software is completely irrelevant.

If you mean, it's probably not my computer, you're right. But the point here is, I can give Grandma a livecd to use for her internet banking, and she now cannot screw up her normal OS to the point where the livecd is unsafe for banking.

Re:terrible advice

[SanityInAnarchy]

Unless your browser is listening for incoming connections,

Or it autoupdates itself, or its extensions, or its malware list, in an insecure way...

Or maybe something else is listening. While they have to compromise you quick (before your next reboot), most LiveCDs, out of convenience, provide a read/write filesystem.

If you are using the LiveCD as a dedicated banking only environment, the only input your browser will see is your bank's website.

Unless you're MITM'd. Or unless the default homepage is something that could potentially be host to something malicious. Or unless the user visits other websites.

If you can't trust user behavior, and want to really be sure, you could have it set to reject anything that doesn't have the bank's SSL cert.

That'll work right up until said cert expires. Or until there's an SSL vulnerability which requires browsers to be patched.

If no other site can reach your browser, your browser cannot be owned,

I agree, but the statement in bold is a pretty big assumption. Remember: Never trust anything you don't have to.

Re:terrible advice

[SanityInAnarchy]

Browser security is only an issue if you're visiting other sites, in the same session, on the same boot, on your LiveCD.

Wrong. Any security compromise on the same boot lends a possibility of compromising that session. Not all vulnerabilities will lead to that, but some can.

And going as far as questioning whether your CD burning software is infected is ridiculous. You can't be any more certain that your mouse doesn't have imbedded circuitry tracing your movement pattens, or your keyboard doesn't have a keylogger built directly into it,

No, the question is not whether the software came pre-0wned. The question is, once this practice becomes widespread, won't malware authors target the ISO downloading and/or CD burning process? If malware attaches itself to Nero, and Nero injects something into your shiny new livecd, what are you going to do? Ask it to verify itself?

or the aliens aren't tapping directly into your cablings electromagnetic intereference patterns to directly access your bank account as you do. You're going to extremes purely for the point of argument,

Which is exactly what you just did, right there.

See, keyboards with embedded keyloggers do exist, though mostly as proof of concept. While I'm not sure a mouse-movement-logging-mouse exists, it's not hard to imagine how one might be built.

There isn't any convincing evidence that aliens exist, and if they are here, we have no idea how they could be monitoring our thoughts.

All beside the point, of course, which is that this truly is security through obscurity, in two ways:

First, because it'd be much harder to write malware that compromises all burning software and rootkits your new LiveCD and rootkits your current Windows system such that you won't be able to detect the rootkit on the LiveCD...

But "harder" just means, they won't do it until it's worth it -- it's an obvious vulnerability.

The second kind of security through obscurity is the fact that this technique is relatively obscure -- that is, not well known. If users never use LiveCDs a lot, this will probably work well, because someone fishing for account info will go for your neighbor's (who accesses his bank from IE6) rather than you.

But neither kind is actually secure.

Re:terrible advice

[Anonymous Coward]

Its not hard at all. DNS poisoning, Man in the middle attacks, not to mention the bots constantly spamming attacks for known vulnerabilities would probably massively increase if this sort of misinformed quasi security practise was adopted

Poison DNS. Requires the name server for your ISP to be misconfigured or unpatched.
-AND-
MITM a cert that verifies as the bank (using null character hack). Requires a vulnerable browser and a CA that will issue it with a NULL, or some new unseen hack.

Not hard? Each is fairly difficult and you have to do both. That's hard-core.

The other 'vulnerability' you mention is rehacking a linux livecd running with no services and almost certainly behind a firewall or some kind during the time they are doing their banking? Good luck with that. Can you link to even *one* remote hack for the IP stack, that didn't require a service being run?

security through obscurity is NOT enough when you are talking about your financial details, even a patched windows box.....shudder... is BETTER than an unpatched liveCD.

Total BS. It's not security through obscurity, it's security though non-exposure. It doesn't matter that we are all vulnerable to hiv, you aren't going to get it if you don't exchange fluids. Even a ten year old livecd is better than a patched Windows that's been promiscuous.

Re:terrible advice

[bloodhawk]

Its not hard at all. DNS poisoning, Man in the middle attacks, not to mention the bots constantly spamming attacks for known vulnerabilities would probably massively increase if this sort of misinformed quasi security practise was adopted

Poison DNS. Requires the name server for your ISP to be misconfigured or unpatched. -AND- MITM a cert that verifies as the bank (using null character hack). Requires a vulnerable browser and a CA that will issue it with a NULL, or some new unseen hack.

Not hard? Each is fairly difficult and you have to do both. That's hard-core.

The other 'vulnerability' you mention is rehacking a linux livecd running with no services and almost certainly behind a firewall or some kind during the time they are doing their banking? Good luck with that. Can you link to even *one* remote hack for the IP stack, that didn't require a service being run?

security through obscurity is NOT enough when you are talking about your financial details, even a patched windows box.....shudder... is BETTER than an unpatched liveCD.

Total BS. It's not security through obscurity, it's security though non-exposure. It doesn't matter that we are all vulnerable to hiv, you aren't going to get it if you don't exchange fluids. Even a ten year old livecd is better than a patched Windows that's been promiscuous.

You are talking about bank details being hacked, the people doing this ARE ORGANISED AND HARD CORE and will and DO spend a great deal of time and money coming up with hacks to get money, give them a nice juicy target like a known bank that distributes liveCD's to customers and I doubt it would last more than a month or 2 before millions started walking out the door. don't like DNS poisoning then how about a brided ISP admin or how about a nice botnet ready to spam packets at a vulnerability when it is found, not hard to write in memory loggers and pretty damn easy to pick a time of day people will use the CD (eg. if doing it where I live I would run it at 6-8pm on a thursday night as I know that is pay day for a large percentage of the town and people logon to there bank here to pay bills)

Re:terrible advice

[sconeu]

How can someone using a Linux LiveCD be affected by the MS crypto library bug?

Re:terrible advice

[QuantumG]

Every implementation of SSL had this issue.. some just fixed it faster than others.

Re:terrible advice

[QuantumG]

I didn't bother replying to the other guy as he's obviously uninterested in security, but you seem to care a little.. so am I the only person around here that remembers that remote kernel level exploits are not exactly unheard of? They happen, and you don't need any ports "listening" to be affected by them. Similarly, browsers have flaws in them that can be exploited by any old transparent proxying technology you care to mention.

The point of my post, which unfortunately has been lost in the "Linux is the secure" advocacy is that Linux is only as secure as the administrator who is diligent enough to apply the latest security patches. And LiveCDs are, necessarily, not patched up to date.

Re:terrible advice

[rantingkitten]

There comes a point of diminishing returns. I don't think anyone here is going to seriously suggest that using a drive-installed Windows is safer than a live-CD Linux.

To be clear, this is not merely a Windows-vs-Linux thing. It's also a function of the medium. Exploits are often installed on a user's computer because some script kiddie was scanning large ranges, found some targets, and did his thing. The keylogger or whatever could have been sitting there for days before the victim logged into his bank account. Same deal with trojans.

With a live CD, of any type, this problem is virtually eliminated, assuming you only keep it booted for a short time to do your business and then remove it, which is not only what the guy is suggesting, but also how people actually use live CDs in the real world.

As you and others have pointed out there are various vulnerabilities that can still be attacked but the CD itself removes a huge number of attack vectors, and what few remain are almost inconsequential. At some point you have to say "This is as much precaution as can reasonably be taken."

You could design a 100%, absolutely secure OS for accessing your bank, have it tested and verified by every security expert in the world, and be given all sorts of awards for your genius, and still die in a random earthquake.

Total safety just isn't a part of this life. Take the reasonable precautions and keep living. Using a live CD fits that viewpoint.

Re:terrible advice

[misnohmer]

And this is exactly why this advice of using a bootable live CD (Linux, Windows, Solarix, QNX or anything else) as a cure-all is so dangerous. People like yourself believe they are invincible, and therefore careless. Number of people mentioned in this thread that you can get compromised, even with LiveCD. Here is an example - SSL certificate NULL-prefix vulnerability - there was recently a slashdot article on that, but if you want to see yourself how it works, search for sslsniff tool - comes with a complete howto too. Unless you have the latest patched browser, you are open to this. There are other ways also - just read through this slashdot thread for some hints.

Re:terrible advice

[smoker2]

The bug that can be totally avoided by typing the url into the address bar, instead of clicking links in random emails ?

Just make sure that when you create the live cd, you don't have any bookmarks in the browser. And complaining about obscure vulnerabilities in software that can't be updated is a bit lame. People don't fix vulnerabilities on systems they CAN update. At least with a live cd, you can get the latest version, which is going to be as up to date as can possibly matter. And the advantage of the live cd is that its state cannot be changed. A rogue website can't do a drive by install and have it run next time you use the cd. It limits the window of exposure and that is all that matters.

There are some things you can never protect the user against. A live cd prevents software keylogging, but if the users machine has a usb keylogger installed then all bets are off anyway. That is not a failing of the live cd, it is a failing of the user. So is clicking random links in emails. Live cds are a good way of reducing the risk. Your whole objection relies on a perfect storm of possibilities, which are extremely unlikely to occur, especially with a image that can't be corrupted. Do your objections take SELinux into account ? While SEL might be a pain on a general purpose pc, on a live cd it's perfect. I think you have another motive for these objections, either anti-linux or maybe just egotistical.

Re:terrible advice

[jhol13]

OK. I'll wait for actual implementation.

P.S. I have been waiting for the invasion of Linux viruses for over 15 years, how long you expect I need to wait for this?

Re:terrible advice

[b0bby]

booting off a LiveCD won't save you from the truncated SSL cert attack that was demonstrated in the direction of PayPal the other day.. only having an up-to-date browser will do that.

I fail to see how that attack would affect me if I boot to my vulnerable browser and go straight to my banks website. Yes, If I typed the wrong address I might happen onto a cleverly constructed duplicate of my bank's site, but otherwise I'm safe. If you're careful enough to go to the trouble of booting into the live cd, you'd hope that you could type bankofamerica.com correctly. It's really moot anyway, because the people who most need to do it are the least likely to.

Re:terrible advice

[cenc]

yea, fairly obvious you are not familiar with how linux works. More importantly, the malware writers would have to be very very familiar with exactly how your particular disto and bios works together, how you write the cd (including the os you are working on), among other things, and get lucky with a sort of probability that if you have that sort of luck you should be at a casino in vegas not trying to steel some random persons code. Basically you would have a better chance of just guessing the password on the first try.

Its not just Linux, its trusted boot...

[nweaver]

Its not just "linux vs Windows" but "trusted boot": All you need to rely on is that the live CD is OK and your BIOS is not corrupted and you can effectively safely connect to your bank.

I use it myself for my Schwab account, with the added bonus of there is enough math to show active traders lose big, so don't trade active, which goes into play here.

Re:Its not just Linux, its trusted boot...

[zindorsky]

Its not just "linux vs Windows" but "trusted boot": All you need to rely on is that the live CD is OK and your BIOS is not corrupted and you can effectively safely connect to your bank.

ORLY? What about hardware key stroke loggers? They do exist you know.

Re:Its not just Linux, its trusted boot...

[zindorsky]

Not to mention TEMPEST (http://en.wikipedia.org/wiki/TEMPEST)

Re:Its not just Linux, its trusted boot...

[slimjim8094]

If either TEMPEST or hardware keystroke loggers are in play, I'd wager you have bigger problems than someone transferring your money around.

Re:Its not just Linux, its trusted boot...

[Anonymous Coward]

No kidding. The people on this site never cease to amaze me. It's astounding how detached from reality some of these paranoid idiots purport themselves to be.

Re:Its not just Linux, its trusted boot...

[houghi]

I was thinking that this was about the "live CD" part. What if there excisted a "Live Windows" Would that be OK to use? Would a "real Linux" so not via live CD be OK?

Re:Its not just Linux, its trusted boot...

[Yvanhoe]

I say, banking institutions should provide some pocket money (like a few millions) to projects like Open BIOS. It is their security and a service to their customers to offer a solution to safely connect to them.

Re:Its not just Linux, its trusted boot...

[Anonymous Coward]

Live CD for existing desktops perhaps, but this is a wicked application for those instant-on http://en.wikipedia.org/wiki/Splashtop machines that we can buy nowadays?

Alternate Headline

[Minwee]

"Washington Post Urges Thieves To Distribute Linux LiveCDs"

A few racks full of CDs in a highly visible place, or even cheap preloaded USB drives delivered right to the mark's front door along with a friendly letter explaining how running Linux would help improve security and thwart The Bad Guys could make your job of stealing from the clueless even easier than before.

Re:Alternate Headline

[fermion]

Exactly. The problem is that many users click on any thing that is bright and shiny. While some problems are caused without user interactions, other clearly come from users navigating towards "carefully constructed web pages". There is really no way to stop this. One CD with 'naked women version of secure linux' on it, and it would be open season for the office bank accounts.

The only real solution is to make banks liable for online bank fraud, just like credit cards are liable for credit fraud. The customer has to pay $50, the bank covers the rest. This is really the value of credit cards. You are using someone else's money, so they take the risk. Once it is your money, your are at risk even if the banks security is at fault.

Re:Alternate Headline

[mlts]

That actually might be a viable attack vector. I could imagine someone giving out ready to install media for popular distributions, except that a few key binaries would be modified (including gpg so it would say that things are signed when they really are not.)

The main defense to this is for Linux distribution makers to make media with anti-counterfeit features like holograms, or for a person to burn the media themselves after checking that the signatures match on a machine they know is not compromised.

Re:Alternate Headline

[Anonymous Coward]

You don't have the slightest idea how credit fraud works. The CC company isn't liable for any of the fraud. In fact, they make money on it. The way it works is, once you report fraud, they chargeback all the fraud, so the retailer eats the charges. Further, the CC company charges for this "service", they also keep the transaction fees from the first fraud payments, and then slap on new transaction fees for the charge backs.
 
At the end of the day, the CC company made more money off the fraud than they would have off the actual purchase. Unless of course you have crazy high interest and don't make payments, in which case you are moron and shouldn't be using a CC in the first place.
 
Banks will NEVER try anything like this, because they have no one to pass the buck off on. They would have to eat it, but they aren't going to do that.

Re:Alternate Headline

[SanityInAnarchy]

There is really no way to stop this.

There's one, but no one wants to hear it:

EDUCATION.

That is the only solution, and it is a complete solution, when used properly.

The only real solution is to make banks liable for online bank fraud,

And what would that solve? It isn't as though most bank websites are terribly insecure at the moment.

I would say, if the user was 0wned, make the user liable. They might learn something. Making the bank liable just opens the door for shit like a "super secure mode" app that only runs on Windows, thus decreasing security, or other equally-annoying measures that either do nothing for security, or worsen it.

Re:Alternate Headline

[fwarren]

Why is the purchase price of wisdom in the hand of a fool seeing he has no heart for it? - Proverbs

I have spent the last 26 years immersed in computers. Computers I know about. Cars, even though I drive one, I do not know about.

I can re-gap a spark plug, do a tune-up on an older model car, change my oil and change a flat. However, I am vastly ignorant about troubleshooting and doing most work on a car. Am I stupid? No. But I have no skill, no knowledge and no real inclination to learn everything I would need to know about a car to be an expert and be able to do most of my own repairs. Yet I can still drive a car just fine, even if I can't fix it. I know the difference between a computer and a car. There are people actively trying to hack into my computer or tempting me to run software that will let them hack me. The same is not true for cars. There is no one tempting me to drive to the bad side of town to be mugged. Tempting me to pour water in my gas tank or running around and cutting my break lines.

There are plenty of other domains that holds true for as well. Medical, fine arts, producing music, how to perform stand up comedy, etc.... I go to the doctor and take advice, I appreciate some sculptures, music and paintings. I listen to CDs and MP3's. I enjoy watching stand up comedy. Just because I have not learned how to do these things does not mean I do not have them in my life. It just means I am not an expert at understanding them, their ins and outs. Nor am I willing to invest the time to learn. I may pick up a fact here or there, but for the most part if you shoot to much information at me about these things it will just bounce off my head and I won't absorb it.

Sadly, this is the way it is for "Joe Sixpack" and most other average computer users. They can use a computer to some degree, may know an interesting fact or two about them. However they lack the knowledge to properly be able to secure a computer or tell if it has been compromised.

The average user is just not going to allow themselves to be educated about computers. As I said I have been doing this stuff for 26 years. I have one adult child and 2 kids still in high school. None of them remember a world before the Internet. They can all touch type. But none of them ever had the desire to learn how to program or how a computer works at a deep down level. They are more computer savvy than most of their friends and that frightens me. To them a computer is an office suite and a web browser with adobe flash player. We have lost the battle. Most users won't learn how to find files they have saved when working with said office suite or something downloaded with their web browser. They also will not learn enough about computer security to be safe. Microsoft does not help either. Every 3 years we hear "This is the most secure version of Windows Ever" and people think it must be safer. Education will not get the job done...people have for the most part decided NOT learn about computers.

Re:Alternate Headline

[SanityInAnarchy]

I have spent the last 26 years immersed in computers. Computers I know about. Cars, even though I drive one, I do not know about.

Me too.

I can re-gap a spark plug, do a tune-up on an older model car, change my oil and change a flat. However, I am vastly ignorant about troubleshooting and doing most work on a car.

The same cannot be said of most people about computers.

Indeed, most people have to go through driver's education of some sort. We understand what a turn signal does. We understand that we have to change our oil, even if we don't know how to do so. We understand that driving over sharp objects is probably a Bad Idea.

It's one thing to not understand how a computer works. But there are basic things everyone should know. You don't need to understand how SSL works, but you should know to look for the https, and look at the domain, before entering sensitive information -- and you should know not to click through SSL warnings.

Nor am I willing to invest the time to learn.

Obviously, you're willing to invest some time.

For instance, you're not a doctor, but you probably know how to eat right, and you at least know that exercise is good for you and too much sugar isn't. You're not a mechanic, but you know that you need to change your oil, check your tire pressure, and keep gas in the tank.

This is all far more than most people understand about computers. How many users know to defrag?

none of them ever had the desire to learn how to program or how a computer works at a deep down level.

I'm not suggesting they should.

Education will not get the job done...people have for the most part decided NOT learn about computers.

That's like saying condoms don't work, because people won't use them.

It's actually more akin to saying abstinence doesn't work -- but see, we do have an alternative to abstinence that does work. There really isn't a good alternative to educating users -- the best we really have is antivirus or draconian system administrators, both of which provide a worse user experience than a compromised machine, and neither of which provides much help for Internet banking.

And for that matter, neither condoms nor abstinence works very well without sex education.

So I'm not saying everyone should have any kind of depth of understanding, just enough to understand how to keep themselves secure. And that wouldn't take much more than driver's education.

Re:Alternate Headline

[Anonymous Coward]

Anybody who gets a boot-able CD or USB drive from an anonymous character along with a letter on how to use it to do on-line banking and uses it is probably too dumb to have anything worth stealing.

Or how about Websites being smart with NoScript?

[Anonymous Coward]

It would be great if a Website would give it's IP Address on every login prompt and not direct to any other domains for it's login process. Then with NoScript, allow what Applecodescript to execute and what domains may interoperate on the page. Instead, Washington Post gives a false generalization that a Linux live CD will defeat all Phishing attempts.

Typical dead-beat wrong journalism. The next thing you'll know, the New World Order crowd will arrive to demand everyone get a License to use a computer, and then I'll start the GNU World Oder crowd that will dispel the New World Order crowd's false legal representations of Statutory law.

To be safe...

[Antony-Kyre]

Well, don't do online banking.
Or, use a totally separate computer to do online banking. Only use the web browser to access one's bank account.
Or look for those "freeze" type software, which makes the harddrive essentially read only.
Also, it doesn't hurt to check which processes you are running, and whether any of those are unusual.

Re:To be safe...

[Anonymous Coward]

And while you're at it, you might want check each process's loaded dlls and file handles and each of their checksums and tcp connections. Not that any of that will help against a compromised OS or hardware.

Re:To be safe...

[al0ha]

If your box is rooted checking processes will do no good nor will antivirus alert you to the fact.

Better to create multiptle VMs, which do not share the host IP, to be used for different purposes. 1 VM used for only banking, 1 VM used for only web browsing...

Re:To be safe...

[antdude]

I don't bank or do anything involving with $$ online.

Phishing already solved.

[Anonymous Coward]

My bank implemented a system that asks you for three numbers from a physical card in addition to your regular password. This is so sucessful at blocking phishing attacks that such two-factor authentication has all but wiped out such security breaches to the point they now made it mandatory for all online banking. I have the inside word that they have not had a single case of sucessful (conventional) phishing since this has been introduced.

Re:Phishing already solved.

[grahamsz]

Can you clarify how that works? If it just asks you to enter the 3rd 9th and 12th digits from your card then it seems like it would be susceptible to a classic MIM attack

Free Software not Linux

[Statecraftsman]

There is nothing special about a "Linux LiveCD" that ensures that the programs on it can be trusted. Most distributions still include binary blobs in their corresponding source code that can bring the kinds of problems for which Microsoft Windows is advocated against in the article. Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software. Depending on the value of your target and the determination of your attacker there is a software solution for you.

Re:Free Software not Linux

[SanityInAnarchy]

Most distributions still include binary blobs in their corresponding source code that can bring the kinds of problems for which Microsoft Windows is advocated against in the article.

You won't find the word "proprietary", "open source", or "source code" in the article. The reason Windows is advocated against is simple: Malware is written to target Windows. Malware could as easily be written to target any operating system which is vulnerable.

Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software.

And 100% proprietary hardware, unless you've got schematics for all of it.

Never mind that you're connecting to a webserver running the bank's proprietary software...

Thankfully at this point, you can get machines that run a free bios, support wireless, and run 100% free software.

Which you've of course scrutinized every single line for security vulnerabilities... ...what's that? You haven't?

Why is it that you think free software is inherently more trustworthy than proprietary software, in that way? Or that the binary blobs in question are inherently compromising your security?

And, conversely, if you're a valuable enough target that you can afford to (and should) scrutinize every line, wouldn't you also have a budget to enroll in Microsoft's "Shared Source" program, and gain full access to the Windows source code, also?

No, you're right, there's nothing special about a "Linux LiveCD". But the magic word here isn't Linux, or even the implied "Free Software", but "LiveCD". From the point of view of the article, it could be a Windows PE disc, it's just that Linux CDs are free (as in beer), and Windows offers no real advantage in an environment which will only run a web browser.

I agree with many of the goals of software freedom, and I agree a solid open source process can yield more robust software than a closed one. But not every article with the word "Linux" is an appropriate place to bring it up. You sound kind of like this guy.

Re:Free Software not Linux

[Sycraft-fu]

Not just analyzed the code, but are you sure that the binaries you are running were made form that code? Did you compile them yourself? If you did, did you do it on a system that was checked to be sure it was clean? Are your sure that the compiler you used isn't putting anything in the binaries? Remember it could be inserting malicious code in any binary it builds, even though that was never in any source.

If you really want to have the "I'm 100% sure this can't possible be compromised," approach, you really have to do everything from the ground up. You have to build everything from a known clean setup. So just in the software realm (assuming you'd already dealt with all the hardware checking) you'd have to make your own assembler, by hand. Once that was done you could get the assembly code for a simple OS and C compiler, verify that they were clean, and assemble those. Running those you could then get the C code for more complex stuff, verify it was all clean, and compile it.

The only way to be 100% sure is to go back through all that. If at any time you took an up and running system, well you can't say for SURE that someone didn't sneak something in there to poison things built on it. This isn't a pure thought exercise, Ken Thompson actually did a proof of concept on this (http://cm.bell-labs.com/who/ken/trust.html).

Realistically, you can trust a fresh OS install from a trusted source, be it a Linux ISO downloaded from an official site or a Windows DVD purchased from a store. That is about as certain as you can be.

Re:Free Software not Linux

[Anonymous Coward]

No, you're right, there's nothing special about a "Linux LiveCD".

Until their is an OS X live CD pushed by Apple and a Windows live CD pushed by Microsoft, there is something special about it.

Re:Free Software not Linux

[selven]

It has to be a free OS - otherwise there would be too many copyright implications to worry about.

Re:Free Software not Linux

[Anonymous Coward]

Like what?

Re:Free Software not Linux

[SanityInAnarchy]

Minor nit:

you'd have to make your own assembler, by hand.

Or you'd have to analyze an existing hex editor by hand. Still hard, but not as hard.

you can trust a fresh OS install from a trusted source, be it a Linux ISO downloaded from an official site or a Windows DVD purchased from a store.

Or build on a system that you already necessarily assume is trusted. For example, it should be possible to establish at least a web of trust between the signing keys for your packages and the signing key for the CD... or, if you have a CD, between that CD and the next.

Both of these are trusting external sources, but trusting a minimal amount -- for example, while I did have to download the very first install CD I used, after that, I no longer have to trust that I'm not being MITM'd. Much better to trust a distro than to trust the distro plus the connection between me and the distro.

Re:Free Software not Linux

[SanityInAnarchy]

The OS X install CD was a LiveCD, last I checked.

And while it's not pushed by Microsoft, nor is it particularly easy, you can build a Windows PE CD, which is a LiveCD. Google BartPE.

No, what's special about it is that it's free and easy -- you can just download and burn an ISO.

Re:terrible advice (akamai and cross site?)

[Anonymous Coward]

What about financial sites which use Akamai and javascript?

And require you allow javascript from Akamai....

The browser may be out of date

[HalAtWork]

The browser on a LiveCD may be out of date. How about a USB flash drive that can save your ISP settings and can update the browser? Banks could distribute them for the price of the flash drive as a safer option for online banking.

Re:The browser may be out of date

[Mr. Roadkill]

Who cares if the browser on the LiveCD is out of date? What really matters is that it provides a known clean OS and browser. Provided they do their banking before visiting russianmafiasite.com they're safe.

Same goes with most of the rest of the software, especially these days when the machine is likely to be protected from the big bad internet to some extent by the ADSL router and the magic of NAT. If someone uses a two-year-old Ubuntu disc for their online banking (and only their banking), they're still safer than if they use XP and Internet Exploder for banking and surfing porn and downloading warez and downloading movies and...

A USB-based installation that allows the browser to be updated can also be subverted, at least in theory. The beauty of a LiveCD is that it's static.

Re:The browser may be out of date

[Anonymous Coward]

The fact a liveCD cannot be updated is a plus here. If anything can be changed by the good guys, it could be changed by the bad guys. This is especially true if there is an exploit on the liveUSB - the attackers could attack before it gets patched and patch it themselves.

Not that this in any way changes the fact the liveCD could have exploits, and that regular replacements for the CD's could be intercepted and altered by the bad guys.

The only real solution to this that I am aware of is to actually teach people how to use computers properly. Of course people are stupid and lazy, so that may be a bit impractical as well.

Re:The browser may be out of date

[thePowerOfGrayskull]

First, what if it is? You're not going ANYWHERE but your bank's web site with that browser. Whether or not it's up to date only matters if your bank desupports an older browser. Second: a USB flash drive is changeable - so if the user gets stupid and does something /other/ than go to their bank site, any change is persisted for all future reboots. I suppose a "ro" mount option could take care of that- but then you're not saving your ISP info either, defeating the purpose.

Re:The browser may be out of date

[Anonymous Coward]

Click jacking, cross site scripting, buffer overflows that install keygrabbing services, any number of reasons.

Re:The browser may be out of date

[Mr. Roadkill]

Click jacking, cross site scripting, buffer overflows that install keygrabbing services, any number of reasons.

Of course, but I think you missed my bit about "Provided they do their banking before visiting russianmafiasite.com they're safe" and my comments on why data persistence can be a bad thing.

People are big on rituals. Make one "You boot this CD, you type www.anz.com.au in the browser, you do your banking, then you shut down AND DON'T DO ANYTHING ELSE WITH THIS, EVER" and you've got Safe Internet Banking for Grandma. I'm not suggesting that you wouldn't want to keep a general-purpose environment up to date, but an environment being used solely for banking and which is completely volative and loads from read-only media on each start is a huge step up security-wise from the usual malware-ridden PC. If you can convince Grandma to do her banking off the "special CD", it shouldn't be too hard to convince her that that's ALL she should do through it.

Devil's advocate: Deepfreeze?

[mlts]

Devil's advocate here:

Of course, a diskless system running Linux would reduce the chance of malware on clients, but perhaps if a company is dependent on Windows, almost as good security (and I state almost) would be obtained from denying admin access and using something like DeepFreeze, Windows SteadyState, or similar?

Combine DeepFreeze with AppLocker, some decent enterprise antivirus utilities, BitLocker, and the usual physical and BIOS protection on a machine, and one can make a decently locked down terminal that can cleanly run Windows apps. Should additional software be needed, no need to install it, just use something like VMWare ThinApp and have it runnable from a central location.

There is nothing wrong with a diskless system and booting from a CD-ROM. However, unless one creates a custom image with reliable enterprise level auditing tools, it becomes difficult to extract data from a group of PCs (and this is important for larger businesses come tax season, or regulatory compliance), and it is definitely an issue to add or update software without a reboot, unless it is a precompiled binary on a central server that people run.

Also, instead of running live CDs, why not consider going to a vendor like Wyse and going with truly thin technology? This way, there is little to no fiddling with the client side. If a thin terminal has a problem, just swap it out for another one, chuck the old one in the RMA box and be done with it. This is arguably a lot easier than the cost for maintaining standard PCs [1].

[1]: I'm primarily intending enterprise level here. For some SMBs, it is a lot cheaper to go with a boot CD and a generic PC, but for larger companies, it may mean more futzing around with stuff for their IT staff, especially on the scale of thousands of endpoints. If I had a startup with a call center of 5 people, PCs are a lot more economical. However, 500 to 1000 people in a non-technical call center, then I'd take a serious look at thin terminals and a beefy internal network fabric.

it's not a matter of Linux vs. Windows...

[SuperBanana]

...it's more a matter of a read-only medium. If people start doing this is greater numbers, all the evil people will do is start distributing hacked ISOs pretending they're legitimate. This also doesn't do much for machines which have been hacked at a BIOS/bootloader level. In fact, if the PC is set to boot to the hard drive and the trojan supervisor is smart and puts up a boot menu that looks bios-ish (ie, allowing you to select the boot device), 95% of users would never notice. So unless Linux LiveCDs start running checks to see if they're being virtualized, this isn't a very good safety net.

Also, honestly, how many people do you think check the MD5 sum on an ISO? Hell, I've never had a RedHat/Fedora disc that passed its self-check. I gave up on that ages ago.

Re:it's not a matter of Linux vs. Windows...

[mlts]

I have always checked the PGP/gpg signature on any ISOs I download from anywhere, but once burned, this becomes a lot harder, as one can't just tell immediately if a disk has a copy of the OS that hasn't been touched.

Another round of attack, should some malware be able to get root-level would be to not bother with the ISO and similar to what the parent poster stated, perhaps install a modified BIOS. If an attacker is sophisticated, has a lot of intelligence on the business he or she wants to compromise, then they could write malware targeted just for that model of client PC alone, or perhaps just a device (like a keyboard with a flashable HID controller) to make it log keystrokes and store them in a safe place for easy retrieval later on.

What might be a solution would be to have motherboards with a flash drive of 32 to 64 GB directly on the board. Then someone can install or image an OS to this, and set it read only. This way, no external media readers would be needed, and a PC could pre-image the OS on there, and ship the machine with just the PS/2 keyboard. PS/2 mouse port monitor port, and a NIC (no USB connectors). However, at this stage, this is essentially a thin client with a custom OS.

Re:it's not a matter of Linux vs. Windows...

[Miner Willy]

Why bother to find a perfect solution that will protect the masses for ever and always? Surely if we're safe then that's good enough -- this Linux thing can just be our little secret (right guys and gals??)

Re:it's not a matter of Linux vs. Windows...

[Anonymous Coward]

Also, honestly, how many people do you think check the MD5 sum on an ISO? Hell, I've never had a RedHat/Fedora disc that passed its self-check. I gave up on that ages ago.

You are a lier. I've never got a wrong MD5 sum with a correct ISO.

SecureID token

[Anonymous Coward]

Out here in Singapore, DBS gives everyone a secure token. Its by far the safest way to bank online. No one save the most sophisticated of hackers could subvert a random number dependent login (definitely secure enough to keep away all the script kiddies).

Re:SecureID token

[symbolset]

Oh really?

A smart bank would be ALL over this...

[davide marney]

A bank with any technical savvy would be immediately preparing a LiveCD/USB distro that boots as quickly as possible into a browser pre-configured with the bank's portal page set as the home page. The distro would contain nothing extraneous -- just enough for fast, safe banking. It would, of course, be thoroughly branded, but completely legit vis a vis source code and license notices. Give them away in the mail, or even sell USB drives.

Re:A smart bank would be ALL over this...

[slimjim8094]

Problem is, banks can't just say "you're too stupid to not fuck up, here do this and it'll be less likely". But they can hint at it.

Banks aren't the ones with the security problems here. People with cracked PCs are handing over the key, and surprised when the lock is open. I think a bank could get away with it, but with some good marketing. I'm not a marketer (thank God) but something along the lines of "do you know your computer is safe? Use this disk instead, we know it's safe". But less insulting.

Re:A smart bank would be ALL over this...

[Anonymous Coward]

No. Expecting the user to be educated about computers is the wrong way to go. Fix the process, not the user.

The client is in the hands of the enemy. Deal with it.

Re:A smart bank would be ALL over this...

[Anonymous Coward]

do you know your computer is safe? Use this disk instead, we know it's safe"

That would be financial suicide, just imagine a month after distributing when all the latest vulnerabilities are unpatched in your "safe" CD (and there will be new vulnerabilities EVERY MONTH if not every week, it is a fact of software development), One of those vulnerabilities is a Certificate vulnerability that allows MITM attacks, attackers could combine that with some simple DNS poisoning and clean out millions from the stupid idiots that believed a LiveCD was a "safe" way to go.

Re:A smart bank would be ALL over this...

[fluffy99]

I pity the person with the job of building a LiveCD that supports all permutations of hardware. Hardware compatibility is still not perfect with Linux.

Re:A smart bank would be ALL over this...

[davidshewitt]

Huntington was giving away free flash drives to new account holders. It would be so easy for them to put a LiveUSB distro on these.

Re:A smart bank would be ALL over this...

[orange47]

except that it would have to (sometimes) guess your ip address, DNS, gateway, proxy.. I also wish it would save user/pass, yeah lazy.. so, liveUSB is better in my opinion even if somewhat less secure

Re:A smart bank would be ALL over this...

[Anonymous Coward]

It's not even the perception of insecurity. It's how much of a PITA it would be to check your bank balance. Imagine having to shut down, get (find!) the CD, put it in, restart, go through the boot-up, check balance, take the CD out, shut down, and reboot windows every time! Most people don't even like to touch their computers for fear of "screwing something up". This would be too much for many average Joe/Jane types.

Re:A smart bank would be ALL over this...

[davide marney]

I see your point, but perhaps such a negative reaction is something the consumer base is growing out of. I do think people are becoming more security conscious; certainly, everyone has heard tales of identity theft (products guarding against it are on heavy rotation on the local radio where I live), have seen tons of suspicious-looking emails and web sites.

Perhaps its just the idealist in me, but I think customers would appreciate their banks getting more serious about protecting online banking. Widely publicized stories such as the FBI Director no longer using online banking will have their impact on the culture.

Your point about the PR angle, however, is well taken. This would have to be done delicately.

This Story is Not Credible

[Anonymous Coward]

"Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit told the hearing that he uses two rules to protect himself from cybercriminals when banking online. The first rule, he said, was to never click on hyperlinks to the banking site and the second was to avoid Microsoft Windows."

I mean look at this a cop is saying something reasonable and sensible. That quote is obviously faked and it calls the rest of the article into question.

Re:terrible advice (akamai and cross site?)

[fuzzyfuzzyfungus]

In the immediate term, that seems like a terrible plan. Akamai are a reputable outfit; but they carry stuff for all sorts of people. Any domain-level trust/validation mechanism isn't going to tell you very much about something from them. Barring a fix, the financial site should host their own javascript.

In the broader term, it might be worth looking into further cryptographic mechanisms. For instance, with debian packages, you can safely download from an untrusted mirror or an http mirror that might be subject to man-in-the-middle attack because the packages themselves are signed by the original distributor. Cryptographically, putting forged packages on a 3rd party mirror would be as difficult as man-in-the-middle attacking an SSLed connection to the original distributor. At worst, you disclose the fact that you downloaded package X to a hypothetical adversary(that isn't optimal; but it is far less than it might be).

If, for economic reasons, web sites that need to be secure wish to use 3rd party hosting for some of their material, a similar signing mechanism might be employed.

I connect to https://www.hypotheticalbank.com/ SSL assures me that I am in fact talking to the right people. hypotheticalbank.com says "Please obtain 'functionsandstuff.js' from '3rdpartyhosting.org', 'functionsandstuff.js' has been signed with our key and has SHA-1 hash XYZ, verify before loading." This would still be incrementally less secure than pure 1st party hosting, since 3rdpartyhosting.org can, by looking at my requests, infer that I am likely accessing hypotheticalbank.com at a given time; but it prevents an attacker, even if they control 3rdpartyhosting.org, from mucking with the code that my browser will end up executing.

Be Safe

[Anonymous Coward]

Tinfoil Hat Linux may be your best choice. THEY ARE WATCHING YOU.

Non-random bits on LiveCD can compromise security

[QuantumV]

Since a LiveCD doesn't save anything between reboots, it doesn't have a random seed that it keeps changing. Therefore the random number generator is initialized to the same state every time a system is booted (and probably to the same state for all computers using a specific LiveCD image). When the random number generator is in a predictable state, isn't the security of SSL essentially gone? To work around this, one can add some randomness to the random number generator on boot, but it is extra hassle. Something like "echo ssj s lsl sfi random hits on keyboard shdflsh sl fhlinaw nvnai dnsi >/dev/random"

What's safety?

[ndik]

Nothing is safe, even with Linux. The banks however can do much more to prevent attacks by improving their processes, not to mention educating the common user.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Inept network admins

[realmolo]

Seriously. How in the WORLD was a keylogger installed on a bank machine?

This isn't rocket science. Securing Windows workstations is a problem that has been solved. Where are the IDS/IPS systems? Why are the users allowed to install ANYTHING? Why aren't they filtering the download of *any* executables from non-trusted sources?

The problem isn't Windows, the problem is the VAST majority of businesses that are running Windows aren't concerned about security. At least, not enough to pay for it (as in, paying competent admins and paying for the hardware/software necessary to secure the network).

In fact, in my experience, your average banks have some of the most insecure, cobbled-together, waiting-to-be-hacked systems around.

Re:Inept network admins

[Renraku]

"Hey, man, I found a USB drive in the parking lot."

"Fuck yeah, plug it in and see what's on it!"

Excellent idea!

[Anonymous Coward]

I agree, make people use linux, that way they wont know how to do anything!

Less users on the internet = less botnets.

I see what your sayin, I got yer message.

Re:Non-random bits on LiveCD can compromise securi

[ceoyoyo]

If you're relying on a seed that's saved from boot to boot your random number generator is vulnerable anyway. At least use the startup time to provide all or part of the seed.

LiveCDs? Way too risky!

[Interoperable]

LiveCDs are far to insecure to even consider using. Tin Hat Linux is an improvement but it's still far too unsafe for me to use; not with the Illuminati hiding around every corner waiting to perform cold boot attacks. That's why I choose to live in the Google opt-out village.

Re:LiveCDs? Way too risky!

[Anonymous Coward]

I hope this isn't an elaborate prank, but Tin Hat (I hadn't heard of it) actually looks cool. You need a 64-bit machine with 8+ gigs of ram, and it can take hours to "boot", but after that you've got a pretty interesting machine...

Although we provide an i686 release, in our lab we run the amd64 version on 8 GB boxes in which we reintroduce portage/kernel and add the entire Open Office suite. One gets spoiled when your word processor pops up in mere seconds!

It's like the exact opposite of all of the fast boot distros.

a Glorious Waste Of RAM

Hehe.

Re:LiveCDs? Way too risky!

[Interoperable]

It's a real distro. I haven't gotten around to trying it out but I agree, it seems like a fun one to try (once I put 4 more GB of RAM in my box).

I use Linux

[MrKaos]

To avoid Windows.

I suppose I'm gonna get modded a troll for that...

Re:Non-random bits on LiveCD can compromise securi

[PhrstBrn]

Huh? Random number generators can be seeded with other data from your hardware, such as the system clock time, reading PCI devices, or some random data off your hard drive. Every single time you reboot your system clock has changed. If you have a hard drive, the data on there has probably changed too, so you can just read some information off the drive at the block level (you don't need to mount it). Every user who uses a live CD has different hardware.

The problem is trivial at best to solve. It may not be the absolutely perfect solution, and probably not good enough if you need a true random number generator, but good enough for this purpose. You definitely won't be in the same state every time you reboot (at the very least the time changed).

Re:Non-random bits on LiveCD can compromise securi

[slimjim8094]

Not Linux. Randomness comes from the time (hardware, persistent), but also from the randomness of network traffic and other driver miscellanea such as HDD head seek times, mouse movements, keystrokes, CPU temperature data, electrical noise on the power supply (with the right hardware)...

I can't say for sure, but I think Linux actually has the most secure random-number generator of any OS - excluding dedicated hardware. Enough that it can probably be fairly called true RNG instead for PRNG, as long as you use /dev/random instead of urandom.

It could be worse

[Anonymous Coward]

I've seen tellers browsing MySpace in IE on the terminals where they process deposits.

Do not 'bank' on MS - budda ching!

[nermaljcat]

I never use Windoze for online-banking, can't even trust it with my files. First preference is Linux (simply because that is my desktop OS) and then Mac. Been doing this for years.

Just be smart

[Murdoch5]

A live cd's a good idea but whats stopping an attacker from an ssh drop in? If you really need to be secure go into a teller!

Doesn't matter

[Weaselmancer]

Once your machine is compromised whatever you do with it is never secure. All someone has to do is install something like VNC and watch you log in. Copy your keys, snoop your keyboard, record mouse clicks, whatever. Two factor authentication won't help at that point.

This secure CD idea is probably more effective advice.

Re:Non-random bits on LiveCD can compromise securi

[tomhudson]

Every single time you reboot your system clock has changed.

My battery is dead, you ignorant clod!

Actually, something like that happened at the Montreal Casino. The machines were shut down every day, so they would end up generating the same sequence of numbers. A guy named Daniel Corriveau noticed, played the numbers, won $600,000.

He initially claimed that he used chaos theory, and the casino claimed it was a bad random number generator. The reality was that the cmos batteries had been removed during development to make testing easier, and nobody put them back in, so every day, they started with the same seed. Simple incompetence. They paid the money after 2 weeks.

Fraud...

[Anonymous Coward]

I really hate it that they always do this, blame it on windows. Instead of insinuating people on how to use windows and stay secure instead of distrusting it without good reason. I code for a living so I'm not unfamiliar with Mac OS X and several Linux distro's. And I know that both of them are as insecure as Windows if the same people use it without good knowledge of how to work secure with it.

I'm from the Netherlands, here 90% of the payments go by a debit bank card instead of credit. The advantage here is that fraud is a lot harder, since it is required to have a special device, my bank-card and my PIN number before being able to do an online transaction (some banks require a cell phone instead of this special device). Where as using a credit card only a 16 digit number and a 3 digit confirmation number are required, no hardware or secret code that is not on the bank card. So in my opinion usage of a credit card is way to simple and fragile and that's why there's so much fraud and it's so easy to catch by a simple key logger. (Using a key logger gives you only a small advantage in trying to fraud my debit card)

Trying to prevent fraud would be easier if banks came up with a good solution and stop using credit cards. It's great that using a credit card you can make an online transaction with just a few clicks but it is less secure and makes you spend money much more easier!

Just my 2 (or more) cents....

Too late

[Anonymous Coward]

China is already doing this. Nearly all of the hardware arrives with spyware.

Bank of America does

[Sycraft-fu]

They have an optional system you can sign up for called SafePass. With this you either get a credit card sized smart card, or you use your cellphone (or both). When you want to perform an activity you've specified as needing SafePass (you can set what, including login) you have to enter the correct code. The card is one of the "push the button to get the code" things, the cellphone it sends a text message to. The code is valid for that login only.

It isn't the best two factor system I've seen, but it is pretty good and easy to use. It also has the additional confounding factor that your password is just a HTTP field, the SafePass code goes over Flash so there's two different systems for the different authentications.

Other banks may have it too. Don't assume they don't unless you've looked in to it. They often don't push it, but it is available. Another company I know that does it is Paypal. They'll sell you a key fob to secure your account if you want one.

No it isn't

[Sycraft-fu]

So in the case of a properly designed security token, it ISN'T just data on the Internet. The reason is that it isn't as though the "something you have" is a card with a number on it or the like. If that were the case then yes, discover the data and you are good. However they don't work like that. There are two related systems that I've seen:

1) A card that gives you a number. What happens is when you want to log in, you push a button on the card/device and it hands you a number. However the number isn't fixed, it changes with time. You need the right number for the right time. The way it works is a crypto system. It uses the time and a key in the device to provide the output. The other end then can calculate the correct number needed. The only want to get the number is to have the device, or find out what the key is on the particular device.

2) A challenge/response system. Here you plug in a USB key or smart chip. The device you are connecting to then sends a challenge to your device, usually something in the form of "Sign/encrypt this message." Then again, public key crypto comes in to play. Your device encrypts the challenge or signs it or whatever and sends it back. The server checks that result against what it ought to get. If the answer is right, in you go.

In either case, the only way to get the data is to either find out the key, or to get your hands on the device. A simple intercept won't do it.

As for your "gun to the head" thing, well of course that gets around it. There is NO SUCH THING as perfect, unbreakable security. I think some geeks delude themselves in to thinking there is because you can build a computer that is at least seemingly perfectly secure. However in the real world there is no such thing as perfect security. There is only security that is better than what anyone is going to try.

I mean I can secure against your gun to my head thing: I hire armed, trained, guards. You try to come at me with a gun, they take you out. So you can counter that, you get trained snipers to kill them at long range. So I counter by traveling only in secure armored vehicles, so you counter by kidnapping my family, so I counter by securing the too, and so on. However at some point, I got past what you could reasonably do, and more importantly what you'd reasonably do. In fact, with good two factor authentication, I am already past it. You will not come and put a gun to my head to get at my bank account. The money isn't worth the risk. So I don't need to worry about that kind of attack. My security is good enough.

That's all it is ever about. That's even what it is in the case of extreme security. The government does not delude itself in to thinking that having tons of armed guys around, say, the CIA headquarters makes it impervious to attack. There are always ways to attack it. So why bother? Because it makes it impervious to any attack that anyone might actually be able to try to pull off. Yes, in theory you could find a way to kill all the guards, take the right people hostage, etc, etc. In reality, you couldn't even come close, you know this, and thus you won't even try.

It is secure against REAL threats, and that is what matters. Same deal applies to your bank account, however since you are protecting a small amount of money and not national secrets, two factor authentication and some vigilance on your part will suffice, armed guards are not necessary.

Re:No it isn't

[AuMatar]

Either of your methods can be broken by a simple man in the middle or a compromised computer. Once again, negligible increase in security over a better or second password.

Remember you're dealing with internet banking here. Untrusted network. Untrusted client. Your device reader is only as good as the computer its connected to.

Re:No it isn't

[Sycraft-fu]

No, it only breaks it if you are ready to intercept and make use of that session right then and there. So yes, if you manage to interdict the communication and when the auth from the SecureID is given take over the connection and use it, sure. However if you simply capture the information and try to use it later, sorry, it is too late. The code from the SecureID was valid for that login only, it is useless later.

I also like how you call a man in the middle attack "simple". Oh really? Well go ahead then, show me how to do a simple man in the middle attack for an SSL encrypted connection. This is anything but simple. Turn out there aren't big rooms that say "Internet traffic goes through here," that you can just hook up in. Even if you do successfully get data flowing through a system under your control, you run in to that pesky SSL thing.

You again seem to be making the mistake that since it isn't perfect security, it isn't useful. If you believe that, well then just do away with ALL security because none of it is perfect. Is a two factor system unbreakable? No. However it is much, much harder. With a password only system, all you've got to do to get in is find out my password. What's worse, you can then access things without me knowing. The password hasn't been taken, it has been copied, so to speak. You can clandestinely use it.

When a second factor comes in to play, your job is much harder. You need that number. You could steal the device that generates it, but then if I notice I have the access shut down and you are screwed. You could try to compromise my computer, but that is an additional problem (since it is defended). Even if you succeed in compromising my computer, you can only use that if you are ready to take things over right when I log in. You have to take control of my computer form me and use that session right there. If not, it is useless to you. You try and log in from a different location, sorry, the code is invalid. You try and log in later, sorry the code is invalid. You needed to use it right then. For that matter if you try to transfer money, oh well that needs a NEW code from the device, so you have to get me to enter another one, not noticing what you are doing.

Is that impossible? No, but a hell of a lot harder than nabbing my password. Same deal as a virus scanner or firewall or heck a door lock. None of these things are invincible, however they all make a certain kind of break in harder.

As I said in my first post, security is NOT about achieving perfection because you can't. It is about making attacks so hard that they aren't worth trying. It is also about defense in depth. You don't rely on a single point of failure as being the only check. So you have a strong password AND a second factor. You have a firewall on your router, and your computers, and you patch your systems, and you run a virus scanner, and you do security audits, and so on. You do not rely on a single step and say "This is all our security here."

Genuine Linux CD?

[Anonymous Coward]

Here comes the issue of trusting the code that is distributed. Obviously, any program included onto the CD itself won't help.

Doesn't work in certain areas in the world

[euyis]

For example, Mainland China, where all banks use the super-secure ActiveX technology to build their own authentication systems...

well, duh

[commodoresloat]

if your computer's already compromised, your computer's already compromised. But that doesn't mean banks shouldn't properly authenticate. Most of us are presumably not already compromised with keystroke loggers and whatnot.

A whole new market

[marqs]

I can see a whole new market for "Live banking CDs".
Hell I'm thinking of making my own, complete whith keylogger and spyware.

Made me giggle

[Alarindris]

[you need] a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible

Yep, sounds like Linux to me :P

Linux Live CD dedicated entirely to online banking

[stirz]

To make sure that you can use your computer for online banking without any data being read/written from/onto your harddrive, you might check out "Bankix" from Germany-based "Heise Online" (of H-online.com fame). They modified an Ubuntu-Live CD to keep the system from accessing the hard-disk using a modified kernel. Heres the original description (in German, of course). Follow this link, if you prefer a robot-translated English version.

This is easy.

[kpurintun]

Be broke like me. Have very little money in there.

Simple truths

[fwarren]

Yes the title says it all.

We need to keep it simple people.

Facts:

1. Banks are keeping their costs down, they are not issuing hardware to all of their customers to generate one time keys.

2. Most people (more than 90%) run windows.

3. That the average user can not be sure that their computer running a Microsoft OS has NOT been compromised in some way.

4. A Linux LiveCD is able to solve the problem.

Put the CD in, reboot the computer, open Firefox, type in the URL for the bank and enter your user name and password. Simple and secure. Reboot and you are back to Windows. Nothing stored, nothing cached, and nothing saved.

When I say simple and secure. I am talking real world Joe six-pack security. If you have decided to bank online you have already given up worrying about DNS poisoning, compromised routers, man-in-the-middle attacks. If you don't want to spend the money for a Mac or a new PC just for banking, a Linux Live CD is a great choice. Not to mention you know it is secure, because you can't infect a live CD.

Linux in VM for me then

[majorme]

I am no expert. This should work just fine, right?

Re:Linux in VM for me then

[ledow]

How's that going to help if your host operating system is compromised and reading your keystrokes?

Banks Should get involved

[fwarren]

All a bank would need to do is set up their own live CD. All ACPI type stuff disabled and a boot menu that makes it easy to try normal video or framebuffer. Use a lite desktop like xfce, icewm or lxde and configure it to look as much like XP as possible. They could even use a custom firefox skin, have firefox autorun and the banking site set as the homepage. They can set custom DNS servers. Have a 2nd tab on the browser set up for "Help, with videos that show how to log into the bank, how to set up a printer if they want to print. How to save a printout as a pdf and save it to a drive or email it. The bank can keep them behind the counter where folks can't put altered CD's. Run a few Ads on the radio, have a few banners hung up in the bank. The CD should make note that there is NO SUPPORT if it works for you it is safer than windows and use it, if it does not work for you then don't use it. The CD jacket should also recommend a few CURRENT usb wireless adapters that will just plug-and-play with the LiveCD.

And banks do just that

[Sycraft-fu]

My bank (Bank of America) has optional two factor authentication. The way it works is you specify what it is used for. So login is an option (off by default when you get it), login on an unrecognized computer is an option (on by default when you get it), money transfer, adding a new bill pay recipient and so on. Now it asks you each time for the code when you do any of these things. So if you had everything on and logged in from a new computer you'd have to enter the code first to validate the new computer (along with answering a question). Then you'd have to enter a new code to actually do a login. You'd have to then enter a third code to add someone new to billpay. You choose when it asks (and for that matter if you want to use it in the first place).

So they already do as you suggest. Really, two factor security with banks is pretty good. It's not perfect, but no security is. However, it'll stop nearly all the attacks you can think of. You have to get MUCH more complex to get around it. Well, the harder you make a target, the less tempting that target is.

After all if someone has $5000 in savings and you can steal that with a 4 line Perl script, a thief probably find that worth it. However if to get the same $5000 you need a series of extremely complex custom programs that aren't even guaranteed to work and maybe increase your risk of exposure, well perhaps that $5000 isn't so worth it after all.

Compare it to money on the street. If there's a $100 bill laying on a bench with nobody around, maybe you just pocket it. Easy, risk free money. If that same $100 has a camera watching it, a strong guy by it, and a snarling dog on a chain near it, you probalby give it a miss. Could you take out the camera, guard, and the dog? Maybe, but it probalby really isn't worth the risk.

Amish protection

[Anonymous Coward]

We use the old "Amish" type protection, almost full proof, but not so good on bad weather days...most MS windows users would not have a clue but the rest of you may know what I am talking about !

Re:Amish protection

[Profane MuthaFucka]

What would that be? Ugly inbred women that won't put out unless you've got a really SWEET buggy?

I'll tell you what...

[bdwoolman]

What in the holy hell do people who make costumes have to do with any of this?

If you are going to rob a bank anonymously you absolutely need a costumer. The costumer is the person who dresses up the bank robber in his archetypal stripped shirt and handkerchief mask. Costumers are typically blond with big... ideas.

Re:I'll tell you what...

[Rudeboy777]

If you are going to rob a bank anonymously you absolutely need a costumer. The costumer is the person who dresses up the bank robber in his archetypal stripped shirt and handkerchief mask.

Right, but is it the bank or the costumer responsible for the sack with the dollar sign on it?

Re:I'll tell you what...

[socceroos]

I think those are distributed by the costumer that does all the policeman stuff. They're always short on whistles.

That rather assumes everyone has a mobile phone

[Viol8]

And that they have it to hand when they're doing the transfer. I suppose you could say that anyone who's doing internet banking is likely to have one but even so, it seems a bit presumptuous.

ban computers without smart card slots

[wkk2]

One thing that might help would be to ban the import of desktop and laptop computers without smart card reader slots. Spyware can't take PKI data off of a smart card and there is only a small cost to add a chip to a bank card. If all computers had readers, banks would have a difficult time explaining why they don't use smart cards. My Dell keyboard has a reader and it works fine with PC/SC when I ssh to a remote computer. It also works fine to sign email, etc. This would limit the risk to an active exploit when the card is in the slot and a pin has been entered.

Re:Devil's advocate: Deepfreeze?

[Rennt]

Yes, a hardened single-purpose Windows machine is almost as resilient as a Live CD. Almost. It is also infinitely harder to set up correctly and significantly less useful all those times you aren't banking. It is understandable why it is not the solution recommended for non-technical users or people who only want one computer.

When you can get your hands on a Windows Live CD..

[Rennt]

...you might have a point.

Live CD's only exist because of the open (with a capital "O") nature of Linux.

I haven't really been keeping score recently, but this is still very much a case of "Linux 1 : Windows 0"

If done right - yes, absolutely.

[amn108]

If booted from a relatively modern (and hence a bit faster and bigger) USB stick, to a OpenBox-like lean&mean window manager, no bells and whistles, right down to an open browser session window, that would do it. It will probably boot orders of magnitude faster than their crapware-ridden Windows box anyway. In fact I think that will turn heads faster than Steve Ballmer throwing chairs.

Re:If done right - yes, absolutely.

[couchslug]

A live CD image can easily be booted to ram from a USB stick, and unless the user specifies a persistent home directory or saves data to a separate partition, is secure as a live CD.

IE

[bruthasj]

Beyond multi-factor authentication, there's another fundamental problem with many Bank websites. They only work in IE. It's difficult to convince non-power-users to drop a bank and go with another that works in Konqueror or even Firefox. This is especially a problem in a non-US country where every bank has the same problem.

Re:IE

[MollyB]

there's another fundamental problem with many Bank websites. They only work in IE.

As an Ubuntu user, my bank (FCU, actually) just sprung this "Windows/Mac only" policy lately. I've complained loudly to Member Services to no avail. They even said blankly that my "Lynux" system would no longer be able to access Online Banking because they were "beefing up security"!?!

I have CrossOver Office installed and it is simple to open IE8 and do my banking, but when I pointed out this flaw in their thinking, they had no comment.

Another point: I live in a rural area and have banked at this location for 15 years. I like all the tellers and ordinary staff. Changing banks would be a real hassle and there's no guarantee the new institution might not do the same thing...

A better solution:

[MtViewGuy]

Keep the security software on your Windows PC up to date.

That's why I have a subscription to Norton Internet Security, and I was able to download and install Norton Internet Security 2010 for free. NIS 2010 constantly tracks and stops all the major types of malware (viruses, worms, spyware and keyloggers) and also includes monitoring to stop you from entering known malware and phishing sites. And NIS 2010 constantly updates itself with the latest malware definitions if you're connected to the Internet.

Also, look at how you configure your home network router. It's possible that with proper configuration, you can stop a LOT of these malware attacks before it is stopped by a Internet security program.

Re:A better solution:

[MtViewGuy]

I should note that what I wrote also applies to the latest versions of commercial Internet security products from Grisoft, Kaspersky, McAfee, Panda Software and Trend Micro, and ZoneAlarm, all of which should automatically update itself on the Internet to keep ahead of the latest threats.

Re:Devil's advocate: Deepfreeze?

[Anonymous Coward]

If a Windows machine is hardened correctly, the security issues between it, and a Live CD would be almost identical. Someone using a malformed app to get to root/Administrator and then reflashing the BIOS, a nvram change to point to a hidden hard disk or the network, etc.

For more security, I would give the nod to the Live CD in this case. In theory, some malware could get in as a user, find some privilege escalation vulnerability, disable DeepFreeze's state process, and then be able to store persistent data, all the while running under a vetted program's process image that is whitelisted under AppLocker while being able to defeat ASLR and other security mechanisms.

Re:Devil's advocate: Deepfreeze?

[Rennt]

I'm confused, are you supporting or disagreeing with my post?

Re:Non-random bits on LiveCD can compromise securi

[QuantumV]

Not Linux. Randomness comes from the time (hardware, persistent), but also from the randomness of network traffic and other driver miscellanea such as HDD head seek times, mouse movements, keystrokes, CPU temperature data, electrical noise on the power supply (with the right hardware)...

If you start the LiveCD only to use online banking there isn't much time between the startup and the time you need randomness for a secret key. The question is if there is enough time to gather sufficient entropy from the environment.

Others have suggested to seed with the current time, but that is easy to guess for an attacker. Netscape's original SSL implementation was broken because the PRNG used only the current time (in microseconds) and the PID as a random seed ([1], [2]).

[1]: http://marc.info/?l=bugtraq&m=87602167418753&w=2
[2]: http://www.cs.berkeley.edu/~daw/papers/ddj-netscape.html

What about people with no cell phone?

[tepples]

The Commonwealth bank in Australia (and probably many others) sends you a random code via SMS to your phone

Chase.com does that when I log in to an online bank account from a computer that I haven't used recently. Except Chase.com can be set to use voice instead of SMS because some people still prefer a land line instead of exclusively using a cell phone or paying two phone bills.

Re:What about people with no cell phone?

[zuperduperman]

People with no cell phone can go screw themselves. I'm not kidding, my (Australian) bank *requires* an SMS code and won't authorize a transaction to a new account without it. Not only that, they won't allow duplicate cell numbers so my wife is unable to use my cell phone since we use the same bank and I already set it up. Sucks :-)

Others need to use Linux, too

[apexwm]

This really isn't news, many companies, organizations, and even individual users are using Linux because of the slew of issues with Windows. Just look at the huge list of 34 issues that came out this month from Microsoft. Granted, there are many issues with Linux, too, but when you look at security issues with Windows/Linux, the number for Linux are far fewer. Personally, I use Linux for both my personal business and at home for everything I do. I only fire up my Windows XP VM in VirtualBox when I absolutely need to, which is hardly ever. I've found an open source program for each and every proprietary Windows program I used to use, and I couldn't be happier. Now, I can focus on using the computer instead of maintaining Windows and wasting time/money. http://members.apex-internet.com/sa/windowslinux

I use a Live CD

[rockbottoms]

I boot into my Linux Live CD, but then I don't have any of my favorites. I just login to my email and use the link that my bank sent me

Say what you like about the Germans...

[vorlich]

But the banking system here, requires the use of single use numbers for each online banking transaction. Your bank provides you with a unique sheet of them and if you lose it, you have to request a new one. Nor are credit cards popular with German consumers. Sites such as Amazon.de allow payment by bank transfer (Uberweisung). You can manually complete the transactions slip and give to your bank or do the same thing with your online banking. Any issue and the transfer has to be reversed. There are an awful lot more banks too - one just around the corner from me and at least three within a few minutes walk with real people working there and very, very friendly managers - if you're liquid!

BIOs level bare-metal virtualization

[marciot]

We need a bare-metal virtualization solution for computers, so we can easily switch from OS to OS without rebooting. I'm not talking about a guest OS running on another host OS, as others have already pointed out the flaws in that, but really something like ESX for desktop computers (ESX would itself be perfect, except that it does not have a usable console). I'ld say they should have this feature built in to the BIOS of every computer, that way malware can't infect the hypervisor.

FREQUENCY

[shis-ka-bob]

If you are trying to be safe, you have to realize that 'safe' is a probability, not a certainty. What is the frequency of this vulnerability relative to the frequency of compromised computers? If you want absolute safety,well you can't. If you decide to bank in person, you have to drive to the bank - risking your life by getting behind the wheel. If the average user has a choice between using his 'regular' browser that was downloading free porn and free photoshop via some torrent, or using a clean browser from a bootable CD, I'm willing to bet long odds that the frequency of attack will go way down with the live CD option. A frequently updated Live CD would seem to be a fairly practical solution for most users. I would also suggest that a bank supplied live cd that prevents surfing to other sites would be even better. The CD could have a jailed browser and a jailed 'something you have' key/value map that allows the bank to ask you for the value for their key. There may still be attacks, but the frequency with such a 2-factor authentication must be quite low, but not zero.

Re:FREQUENCY

[misnohmer]

My point was that people should not treat the live CD as the ironclad "I am now safe" option. It should be treated as "I am safer now, but as the CD gets older I am loosing that safety margin".

Your suggestion of a jailed browser is also just another step, there are more - you can hardwire the certificate the browser trusts (so need a new CD for every new cert on banking site) as well as provide the browser it's own client certificate to authenticate both ends. The next safer step is to use a bank provided hardware locked to only boot from that CD (signed boot loader). This is in case if the user was to get his hard drive infected, then reboots via some method which either doesn't actually fully reboot (they clicked on shutdown restart but the malware did a warm boot instead) or if the malware changes the boot device priority and loads itself first from HDD before booting from CD.

This being said, I don't know the costs due to banking hacks - is it worth $200 per customer in hardware costs to provide them with a dedicated client? Maybe something like Kindle but for banking only, locked down to a particular user? If the bank today is loosing $400 per customer per year, here is a great business opportunity!

Now if only...

[SCHecklerX]

...we could get the bank employees to do that, so that I can be sure my money is safe. I'm not worried about my own use, but those that control my information, that's downright frightening.

What is it that they do when they have your accnt?

[Fastfwd]

The very worse I can see from what my bank lets me do on the web would be to transfer money from one of my accounts to another or maybe pay a utility bill for an exceedingly big amount. There is no way they can steal any money unless they can register as a bank approved billing and then pay themselves like I would be for the utility company.

Two things to get to the root of the problem

[SCHecklerX]

1) firefox + adblock plus
2) effective spam filtering

1 is in the user's control. 2, hopefully handled well by the mail provider.

Of course, it's all about education, but the above two things will stop a lot of the cruft coming in, regardless of being on windoze or linux.

Re:Devil's advocate: Deepfreeze?

[mattb47]

And if you're using a Windows system (locked down and using SteadyState or DeepFreeze or something similar), you can then easily print statements and results, save them locally, etc.

You can't do that (well, easily) with a Linux LiveCD.

And yeah, this Windows system isn't useful except for those times you're banking, contacting ADP, or other high-risk online activities. But it doesn't need to be anything high-horsepower. Any 5 or 6 year old used/surplus system you picked up for $100 (or if you're an established business, any of your old systems) can handle this. Add a $20-30 kvm to your main system.

For an individual, this setup is expensive or technically challenging. For a business with at least a semi-decent IT department, it should be easy.

(But I'd still want to a *REAL* two factor password system to make it proper!)

Re:Devil's advocate: Deepfreeze?

[Anonymous Coward]

Of course, a diskless system running Linux would reduce the chance of malware on clients, but perhaps if a company is dependent on Windows, almost as good security (and I state almost) would be obtained from denying admin access and using something like DeepFreeze, Windows SteadyState, or similar?

Combine DeepFreeze with AppLocker, some decent enterprise antivirus utilities, BitLocker, and the usual physical and BIOS protection on a machine, and one can make a decently locked down terminal that can cleanly run Windows apps. Should additional software be needed, no need to install it, just use something like VMWare ThinApp and have it runnable from a central location.

Excellent idea. Once you have finished paying for all that, you might reflect you could have had as good or better security for the cost of a download and a CD, or alternatively just a single magazine purchase, most Linux friendly mags include a LiveCD of one sort or another.

I don't believe the article was aimed at enterprise level solution and costs, but rather how Joe Noob can access his online account safely.

Note that a security token alone is not enough...

[Anonymous Coward]

You must use a security token and you MUST make the bank account number of the recipient (say for any transaction bigger than 'x', and put a limit on the number of transactions per day, etc.) part of the cryptographic challenge the security token answers.

Do that, and it's good-game lowlifes.

There are banks in western Europe doing that as of today.

If it's done correctly, good luck hacking that. Basically you need to break cryptography as we know it today to defeat that scheme.

How retarded are the developers/managers/etc. in all the banks that do not have that implemented yet?

You're being totally silly

[Anonymous Coward]

Sure they exist. And none of the common attacks use them.

Oh, and using a standard PC (like people do now) is also vulnerable to hardware loggers, so this isn't a step back.

Get friggin real. One can always come up with a hypothetical attack on any security system. It doesn't mean that you've weakened your security or that it's a step backward.

This posing as semi-technoliterate doesn't move things forward, and that's where we need to be.

Re:Or how about Websites being smart with NoScript

[thePowerOfGrayskull]

Instead, Washington Post gives a false generalization that a Linux live CD will defeat all Phishing attempts.

How is that a false generalization? If you are using the LiveCD (any OS), and do not use it for ANY purpose other than directly logging into your banking web site... then you're immune to phishing simply because you are not exposed to it on that LiveCD.

which bank? Re:What about the banks?

[cadience]

which bank? This is a huge sale point. I am looking to switch banks soon, so this would be a huge influence on which I choose.

Re:which bank? Re:What about the banks?

[Eivind]

Any :-)

Atleast I don't know of -any- bank in Norway that doesn't use two-factor authenthication for online banking. Most of them even use bankID, a compatible system, that means you can authenthicate on 2 different banks using the same fnob. (YES, this means if you lose the fnob and password, both accounts are compromised)

The bank offering SMS-ed one-time-passwords as an alternative to that is Skandiabanken.

If you're in the US, I can't help you. I don't know what banks there use, sorry.

Re:Devil's advocate: Deepfreeze?

[thePowerOfGrayskull]

I thought the target audience of the article was small businesses and consumers running Windows who need something simple. For many medium and large businesses, the things that you describe are becoming common practice anyway.

What if my bank doesn't let me do it?

[GPLHost-Thomas]

Please tell this to my bank. The ONLY reason why I still have Windows running on my laptop is because this stupid bank needs me to use a USB device (from Gemplus) that is, by the way, recognized by Linux. The issue is that the site uses a stupid ActiveX to check for the internet token. What is my alternative here? Change bank? Thanks, but no thanks ...

Re:Devil's advocate: Deepfreeze?

[cenc]

Let's see (even for the enterprise), $0.10 cent cd (max $50 deployment cost for stack of a thousand cds) vs thousands of dollars in hardware, software, and support. All that money and time, and it is not clear exactly how those solutions would still solve the security problem. I might go so far as to buy some sort of virtual machines with read only images, and the cost of just one machine in the office dedicated to being the secure machine.

I think I would rather be the guy in a board room pitching the $50 solution rather than the $1,000,000 solution.

Personally, I went with an all linux / opensource office from the start.

Replace os or replace computation device

[DRACO-]

Well if a linux live cd works, why not have each bank build their own live cd and certified application? Add in a required token as well while you are at it. Drop the web browser completely. Only give the discs out through the bank teller visit, never by mail and iterate that fact.

Even better, completely eliminate the disc (to keep random thieves from mailing random cds to random people for phishing) and make a secure boot from usb iron key type system with it's own processor that can verify upgrades and a separate authentication dongle. Since the iron-key can be securely writable, have it written at the bank teller a user id that has no use but for authentication internet banking already entered.

Much better, develop a bank pad.. Like a crunch pad but does nothing but banking. Require a usb dongle to plug in to authenticate. Export data by email if needed but otherwise offer no other way to access.

We mostly dont want to trust the operating system that can be compromised.

No you can't.

[Anonymous Coward]

I'll be that you can't think of a single attack against a live-cd that isn't applicable to a normal PC.

So put up or shut up, dude.

On the other hand, I can think of a number of attacks which are prevented by this.

But the bottom line is that you're passing out extremely bad security advice.

Regressive Argument. Re:terrible advice

[pyrr]

Sure, your burning software may be infected. It could've been infected by malware on the intarwebs, the developers who coded it may have infused it with malware. Your BIOS EEPROM in your brand-new computer could've been corrupted with malware by a delivery guy, someone in the store, or even someone at the computer factory. Your imagination is the only limit as to the ways anything might be somehow corrupt and be a security risk. Regressive arguments, assumptions, and circular reasoning are the way with security, nothing illustrates the Münchhausen Trilemma better.

So no, there's no way you can ever be 100% confident you're secure. You simply have to take reasonable precautions, make reasonable assumptions, and hope you're not overlooking something that's reasonably possible.

Do you understand SSL certificates?

[jotaeleemeese]

Just wondering.

I call false ad

[tepples]

People with no cell phone can go screw themselves.

If your bank advertises "free checking" but requires that each account be associated to a unique mobile telephone service contract, what is the law about false advertising in Australia?

eCommerce == fail

[ToasterMonkey]

The Financial Services Information Sharing and Analysis Center, an industry group supported by some of the world's largest banks, recently issued guidelines urging businesses to carry out all online banking activities from 'a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible.'

This is not the success of Linux, but the utter failure of... I blame all involved... to deliver a secure eCommerce platform.

When yahoo will render a perfectly forged email from "ebay.com" in two thousand-fuckity NINE, you know the Internet is a joke. SSL certificate policies are jokes. Web apps are a huuuge joke. Web browsers are a joke... it's just a really big toy. God I hope it dies. How about some GD regulation instead of proving once more that left to itself, the 'market' is a nice word for lots of greedy people who don't give a fuck.

I hope my grandchildren can use computers for business and pleasure -safely- without needing to understand the technical underpinnings of the entire electronic ecosystem. Usability needs to trump the desires of computer nerds. When you ask, "What will this be used for?" "Anything" is the wrong fucking answer, _EVERY_ _TIME_.

Let the banks supply a disk

[DeBaas]

Like I suggested in August: http://slashdot.org/comments.pl?sid=1347481&cid=29198657&art_pos=4

The banks should distribute a locked down version themselves. Then they can even build in extra authentication in the browser and minimise other programms with possible weaknesses

Bootable click drive

[minstrelmike]

Make a bootable Ubuntu click drive and boot your windoze PC from it to do on-line banking. If you dare.

How about virtualization instead?

[Vrtigo1]

Instead of trying to get people to use a LiveCD, why not simply package a LiveCD as a VMware Player (or similar) appliance? Speaking from a support perspective, I think the feasibility of getting your average user to comprehend downloading and burning an ISO, figuring out how to select the CD as the boot drive, getting networking up and running, and understanding that there's no "Big Blue E" to click on in Linux is significantly less than what the author of the article thinks it is. An appliance with a hardened OS would eliminate three out of those four problems, and if banks would customize appliances for their users, then the operating system could be configured to automatically open Firefox and direct them to the online banking site.

Re:When you can get your hands on a Windows Live C

[Anonymous Coward]

You can get Windows live CDs, though you either have to build it yourself with tools like BartPE or download a pirate copy from somewhere.

Hottest Selling Thousands Of Creative Recreation

[Anonymous Coward]

Http://www.tntshoes.com

we are a prefession online store, you can see more photos and price in our website which is show in the photos.
          All of our product is best quality, but the price is so cheap, we are selling all new nike shoes, t-shirt, handbag, hats ,sunglass.
    we accept paypal as payment service , and offer free shipping. T-shirt : A&f polo lacoste coogi Bape evisu D&g BBC LRG ed hardy JUICY etc $11-$17free shipping If you are interested please chat with me or email me by , we open a online shipping store, hellow our website is see our website in the photos attached, you will find all we have in our website and the price for them.

OUR WEBSITE:

                                                  YAHOO:shoppertrade@yahoo.com.cn

                                                                MSN:shoppertrade@hotmail.com

                                                                          HTTP://www.tntshoes.com