Re: SMS Banking

[NetEvil <netevil () hackers it>]

Hi,
Maybe i'm too much paranoid ..and never seen an app like this before...
So i'm just pointing some thoughts about it...
SMS can easily been spoofed (once you have obtained the pin of  
course...) and many "Smart" phones have often vulnerabilities to  
exploit...
And i'm quite sure there are other weakness ..as you are describing  
the communication and authentication...
maybe others can point you better on the subject...
However in the first release i would not allow the transfer of funds ...

Hope this helps
David


Il giorno 04/feb/2010, alle ore 17.20, "M.D.Mufambisi" <mufambisi () gmail com 
> ha scritto:

> Hi All,
>
> Im designing an SMS baking application but i need to research on the
> security risks involved first. Im thinking of subscribing mobile phone
> number along with a pin. eg Number 222-222-222 PIN 20029. So when the
> individual wants to enquire his balance, he sends a text messgae like
> Bal 20029 i.e. BAL PINNUMBER. The control here is that the sms and pin
> has to come from the subscribed number and only that number. I also
> want to be able to allow subscribers to tranfer funds to pre
> determined service providers such as utility companies etc.
> What are the risks around this application? How are such applications
> normally subverted? Are there any case studies someone can point me
> to? What are the various authentication methods as i appreciate mine
> can not be the best?
>
> Your help will be most appreciated.
>
> Munyaradzi
>
> --- 
> ---------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification  
> Review Board
>
> Prove to peers and potential employers without a doubt that you can  
> actually do a proper penetration test. IACRB CPT and CEPT certs  
> require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> --- 
> ---------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------