* Still much to be done to better secure financial and e-commerce transactions
In October 2005, the Federal Financial Institutions Examination Council (FFIEC) issued updated computer security guidelines to financial institutions. The guidelines called for stronger user authentication controls to be in place by the end of 2006. While the guidelines were not a legislated mandate, most organizations under the purview of the FFIEC did implement stronger security measures involving multifactor authentication.
That’s a good thing, right? Well, yes, and no. Due to the short timeframe allotted to comply with the guidelines, many institutions such as banks and brokerage houses implemented solutions that are still vulnerable to increasingly sophisticated man-in-the-middle (MITM) phishing attacks. This has led to a false sense of security.
In a MITM phishing attack, a criminal places a computer – usually part of a botnet – in between the end user and the legitimate business computer the user wants to reach. The rogue computer then proceeds to steal passwords and other secret identity information as it gets passed between the user and the legitimate computer. The phisher in the middle siphons off the data it wants, and passes compromised or fraudulent data to the other parties.
Several popular forms of multifactor authentication implemented not only by financial institutions, but also e-commerce sites, are now very vulnerable to this type of MITM scheme. Passwords, IP geolocation, device fingerprints, cookies, tokens, verifying text or pictures, and single-use passwords can all be compromised. The TriCipher white paper, “The Perfect Storm: Man in the Middle Phishing Kits, Weak Authentication and Organized Online Criminals” (registration required), describes how these and other securities work, and what their vulnerabilities are to MITM attacks.
How big is the problem? Gartner conservatively estimates that phishing attacks cost consumers and businesses $2.7 billion in just the first half of 2005. The Network World article, “Sport phishing turns into cybercrime wave” outlines how phishing, no longer the domain of amateurs, is now big business for cybercriminals.
But wait, it’s worse than you thought. The article, “Do-it-yourself phishing kit offered for sale” reports that cyber criminals can purchase a software “kit” to set up MITM attacks in just a matter of hours. Now even non-technical criminals can get into the act for an investment of as little as $1,000 for the kit.
Although 92% of the phishing attacks reported in January affected financial-industry sites, MITM attacks are on the rise, and they are affecting e-commerce sites as well as financial sites. Just last month, Amazon.com was hit with a MITM attack that appears to have used the phishing kit. What’s more, it appears that the phishing kit has been set up on several servers, indicating various scammers might be sharing the “program” to intercept Amazon.com customer information.
Under the scheme, an Amazon customer is sent an e-mail that warns the recipient of unauthorized activity on his account, and he is directed to reset the account’s credentials. The catch is that the scheme uses the legitimate Amazon.com Web site, and private information like user names and passwords are intercepted by the phisher.
This attack shows that any e-commerce Web site is vulnerable, and that users should not be comforted by the use of weak multifactor authentication or even the familiar “yellow lock” at the bottom of a supposedly secure site. While the user could be seeing a legitimate Web site, his data could be siphoned off without his knowledge.
MITM attacks can be reduced or eliminated if companies deploy stronger security measures that don’t rely on shared secrets (e.g., a password or temporary token) that are sent over the Internet. Two-way SSL also would be useful, so that not only is an end user authenticated to a host server, but that server is authenticated to the user, and there is assurance that no one is in the middle.
Clearly there is still work to be done to better secure financial and e-commerce transactions. So for all those financial companies that just finished installing security measures to comply with the FFIEC guidelines – get ready for round two!
