Slashdot Mirror
Australian Telcos Declare SMS Unsafe For Bank Transactions
littlekorea writes "Australia's telcos have declared that SMS technology should not be used by banks to verify identities for online banking transactions, in a bid to wash their hands of culpability for phone porting hacks. But three of Australia's largest four banks insist they will continue to use SMS messages to carry authentication codes for transactions."
I'm not at all surprised that the banks here don't follow that advice. :-(
Westpac seems to think that a six digit password (upper-case characters and digits only) is enough for online banking.
Geek by Nature - Linux by Choice.
technology, motivation, stupid
Ugh, captcha: diploma.
From the department of No Shit Sherlock!
For those that were not previously aware, banking via email or smartphone is begging to have your account emptied.
Architecturally, 'smartphone' is pretty much identical to 'pc', possibly more secure in practice. If a phone is 'smart' in any serious sense, it will support the same HTTP+SSL arrangement that you'd use on a computer. SMS, on the other hand, combines the very finest weaknesses of email with those of a direct connection to your local malevolent telco's billing infrastructure...
Imagine if your thumb / palm / eye was worth ten million dollars to someone. In this sort of situation, it's better to implement 'somewhere you are', (Especially if that somewhere is somewhere people can look at you and confirm you are you visually.
Not always just you. Some years ago, the local media interviewed a member of Bill Gates' security team. It seems that Bill travels with minimal security. Meanwhile, his family is heavily protected. When asked why, the guard said, "Bill has to be free to visit the bank to make a withdrawal. We need to make sure his family is safe when he does so."
Have gnu, will travel.
It would be nice if one could add a standardized encryption/signing layer on top of MMS (or SMS if one stitched together multiple messages.) That way, an app from the bank could look at incoming messages, verify they were genuine (regardless of what the phone number states), decrypt them with the user's key, and pass the authentication info to the user.
Fake SMS attempts would be detected/ignored, and an attacker able to get access to text messages wouldn't have the ability to decode them unless they also had access to the phone and the app's private key (which would be unique and generated on each device.)
It should be a federal offence to use "symantec" and "security" in the same paragraph..
Oh guess that would mean I'm going to jail... WOOO free roof over my head with free food!
The best answer to this was IBM's ZTIC. The ZTIC is a simple device, and the KISS principle is important when it comes to security.
You plug it in to a USB port, it authenticates and has a direct secure channel to the bank regardless how compromised the computer it is plugged to might be.
Then, when you do a bank transaction, the ZTIC will pop up a display confirming the transaction, the parties involved, the direction, the time, and the amount. A transfer of a complete bank account to Nigeria is fairly obvious unless someone just blindly hits the "approve" button like the guy on the Drivetime commercial.
The worst malware can do is cut the path between the ZTIC and the bank's computers which means the transaction doesn't get confirmed and thus doesn't happen.
Secure Computing and iTnews.com.au have led a campaign to convince Australia's telcos to include extra security questions during the mobile phone number porting process to ensure fraudsters can't take control of a victim's phone number to gain access to SMS verification codes.
Let me guess. Secure Computing and iTnews.com.au work closely with Telstra and Optus right?
Here in Australia, thanks to consumer protection legislation changing mobile providers is a breeze. You ring up the provider you wish to change to and you ask to be ported. They send you an SMS and ask your personal details and old providers account number and then switch you over. It's both secure and easy (they need your phone number, old provider details and personal details to switch you over). You're now with another provider. You don't need to cancel with your old provider, they do that for you. Your number stays the same. The two biggest Telcos (Telstra and Optus) hate it as there's no lock in. They have to compete on price and service.
So Telstra and Optus lobby hard to ban number porting. They make up bullshit such as "OMG allowing people to switch phone providers is dangerous!!!!". They get their friends in the media to chant the same thing. "Ban number porting!!!"
The reality is that the banks don't use SMS confirmations for anything more than a 3rd layer of security. They don't ask you to transmit anything over the SMS service, it's simply used by them to send you message that a transaction is taking place along with a key that you have to type into online banking (after logging in securly) to allow that transaction to proceed. Essentially it's traditional "login over https" style banking with an extra layer of SMS notifications when you do transactions. It doesn't need the SMS security itself to be bomb-proof as that's just the last step.
So all this talk of restricting number porting is ridiculous. Good on the Communications Alliance (who are mostly made up of smaller Telcos that like number porting) for not bowing to the pressure and bullshit spouted by here by iTnews.com.au. It really isn't an issue, in fact i think other countries should adopt similar consumer protection laws where switching providers whilst retaining the old mobile number is a breeze.
Hell not just that. SMS is one small step of internet banking. You still need the banks userID and password to log into online banking before you even make use of the SMS transaction confirmations. There's also a lot of requirements for number porting as it is too - accountID and details with the old provider and there's SMS notices sent when the porting is attempted too.
So this woman was socially engineered out of the following - Her real name, address and DOB (fair enough, this is publically available), her old mobile providers details and accountID (someone go through her bin?), her banks clientID and password (she fall for a fake bank email?), she didn't notice the SMS announcements that she'd be ported to a new provider next month (wtf?) and finally she didn't notice a lack of calls coming in.
At some point you have to say fuck it, there's no way to protect people like this. Even if it was made more difficult to port numbers she's clearly stupid enough to give away any and all information asked of her.