Re: Nordea Sweden shuts Internet banking due to targeted phishing

[Drsolly <drsollyp () drsolly com>]

On Tue, 4 Oct 2005, Blue Boar wrote:

> Drsolly wrote:
> > Banks could fix the phishing problem if they had the incentive. It isn't 
> > bad enough yet to make them want to fix it.
>
> I wonder whether it can be solved.  The fundamental problem is that 
> people can be tricked into going to a web site that looks like something 
> they use, and putting in their creds.

The fundamental answer is to accept that people will do this no matter 
what you try to teach them, and build your systems on the assumption that 
they will. It is a fundamental error, that security people have been 
making for as long as I remember (20 years?) that you can teach users 
stuff that will stop security problems. If that were possible, it would 
have worked by now. 

It's all about authentication, and you have to use an authentication 
system that the user *cannot* give to a third party, no matter how hard he 
tries.

Example, off the top of my head (you could spend five minutes on this and 
make it much better).

User goes to bank site. Bank site sends a challenge code (different each
time, based on who the user is, user's IP address and date/time). User
keys that challenge code onto a credit-card sized calculator-type gizmo,
and gizmo gives user a response code. User keys in response code, bank
site knows he's legit.

Suppose, now, user goes to phish site. Phish site gives challenge, user 
gives response code, same as above. Now phisher tries to use this on bank 
site, but bank site gives a *different* challenge code, phisher doesn't 
have the response for that, phisher gets no access.

Certainly this can be compromised via a man-in-the-middle attack (although
that could be made really more difficult to do), or by reverse-engineering
the algorithm that the gizmo uses (but maybe you make the gizmo
programmable, so the algorithm changes each month) but it eliminates the
phishing problem, which is, like, 99.9% of the problem, and anything that
handles 99.9% of a problem is a Good Thing.

The cost to the bank, is the cost of that credit-card sized gizmo, but 
that's probably under a dollar (I get given this sort of thing as 
freebies, such as an exchange rate calculator).

Hopefully, the banks are working on a user-proof authentication system, 
probably not as per above (there may be holes in that I haven't thought 
of), but certainly phish-proof.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.