Happy Birthday to You, Mr. "Social Networking User"

RBI has now mandated that every credit card transaction must enforce the user to enter a secure PIN pre-registered with the banks. Of course I read it in the paper and thought I will register when I will be forced to do so.
Today when I logged into my bank account, the new flashing option on the site reminded me to register my two credit cards. I followed that and got my two cards registered.

But to my surprise I was able to login into the site for registration of secure PIN by just entering my credit card no.
It happened once and I re-registered the PIN and this time it asked me the PIN before I could login into the registration page.

Now that was serious, I registered my credit card for the secure PIN , restart my PC and I was still able to login entering the secure PIN....as I said it happened only once.... but if it can happen with my it can happen with other people also....

Actually that incident motivated me to write this blog....
But then I found a more serious problem.. "Forget 3D secure PIN"

Here is how someone can keep doing credit card fraud if your card is issued by ICICI bank (at least)

1. You loose your card which is already registered that ICICI for 3D secure PIN
2. Some one finds it and he plans to use to buy some stuff online. But he can not as he does not know our secure PIN
3. He goes to ICICI bank website and tries to login ...on login page, he selects "FORGET 3D SECURE PIN" (See snapshot)















4. He is then prompted to enter the card validity date , which is printed on the card ...so that was easy ..... He is also asked your date of birth. ... see the snapshot..



The whole security of the so called 3D secure PIN is based on how easy is it to get date of birth of a person .
I might go to google and just search for the name ....I can find 1000 results for this person, which sites he has been registered to and where can I find more information about him.

The most easy target will be to find it on the social networking sites where people just give out their date of birth without thinking that even an average mischievous person can use that information to mess up your financial and personal life.
I might find 10, 100 or 1000 people with same, but it will be easy to reduce this no. to very small based on some other parameters like city or region....
Wikimapia can even tell me how many person with the target name lives in the region and what is their exact location..wow!

Oh, may be I am reacting to this because of this RBI's official enforcement to all banks, but the whole user authentication system is flawed which is based on easily available personal information.

Did I tell you that Visa has another special security feature which they call as Personal Assurance Message (PAM), where they flash you a pre-registered message by you whenever you are about to do an online transaction. This way you can make sure you are really authenticating to the real bank website and not a fake website.
Surprising, they dont show you PAM when you go to ICICI bank website to change your Secure PIN. That means ICICI assumes that they dont need to prove their identity to you if you are visiting ICICI website.
Someone, rather than faking the merchant website can just simply fake the ICICI PIN registration page and then he will know most of the details he needs to know to use your card.

Conclusions:

1. Once you register your credit card secure PIN,make sure to test it on the bank website

2. Do not publish your personal information on sites which can be browsed by other online users...the sites make money using your information, you are just getting inviting people to mess up your life

3. Do not loose your credit cards. If you do, make sure to block them asap.

Read More...

The NULL Character: A black hole into Internet Security

Do you know anyone can hack your bank account or just any secure site that it to be protected using standard or Extended Validation certificates from the most trusted CA "Verisign"?
that too just using one character....the NULL character : '\0' ..

Here is googles search page...




















Here is the detailed version in PDF if you want to understand how it happens
http://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf

The attack is targeted to how CA (Certificate Authorities) issues certificates to domain owners. Since its an online process automated, the CA never meets the domain owner or verifies the hardcopy of password or DL ....

The domain owner goes to CA website, creates an account, generates a CSR and requests for a SSL server certificate for the domain. The CA verifies if its a valid domain and is registered on the name of the person who is requesting for the digital certificate by sending an email to the registered domain owner's email ID.

To implement the newly found attacks, I can simply register a domain like www.mydomain.com and then generate a CSR for www.icicibank.com\0.mydomain.com
The CA will see my domain name as mydomain.com which I own and hence can successfully verify my identity. Then I hack your DNS request and redirect you to my site which is a look alike of your bank. I then present you my new certificate that I got from verisign and which perfectly looks ok to your browser as your browser is going to see www.icicbank.com as the certificate "issued to" name.

So what does it mean to a usual online banking user:

She might be providing her bank account no. and password to a fake bank website which looks perfectly as the original bank website ...Even the site is protected with a valid certificate signed by Verisign... The browser will not complain of anything that can be suspicious

What all a hacker can do once he has you on the fake bank website:
1. Change your profile details so that later on he can reset all security PINs and passwords
2. He can find your personal information and then call the bank to make transactions to any account using tele-banking
3. Initiate an online trasaction using your credit cards and ask you for the two factor authentication system PINs as some fake security check drill


Precautions:
Make sure when you visit any secured website, do check following things:

1. the URL in the browser is "https:///...
2. Check that the yellow SSL lock is visible in the status bar of the browser
3. click on the SSL lock and check the details of the certificate that it is issues by a known CA and most importantly there are no suspicious intermediate CAs
4. Check the details of the certificat and find the common name in subject field. See that the common name is the same as the website address you visited.
5. Do not enter your password anywhere unless you initiated a transaction
6. Check your past transactions regularly to see there are no unknown transactions that you never made.


ICICI bank has put up a warning message for the users to make sure they dont fall victim to new SSL attacks:


















Have a safe surfing!

Read More...

Are you "you" ... authenticate to me...

Today a user gets all information and services on his mobile. Cellular service providers have taken the next step to enable credit card services on mobile devices. In future, users would like to get all information on their mobile and do most of their online work on mobile devices. They will go online using GPRS to do financial transactions, update a contract, access a CRM application to get customer status, etc., etc. It is very clear that single static password based authentication mechanisms have outlived their usefulness. The need for a second authentication factor has become clear and strong now. As users spend more time online via their mobile devices going over an open wireless network to Internet, the probability of password thefts and spoofing, man-in-the-middle attack increases. The two factor solution requires a user to use a hardware token to generate an OTP (one time password) and use that to authenticate. If the user goes online 3 times in a day, and accesses 5 sites that implement OTP based 2 factor authentication, the user will have to generate the OTP on hardware token 15 times, read the OTP from hardware token and enter that on screen and then authenticate. After a couple of month the token needs to be reinitialized or changed. This is not the normal way a user accesses Internet or online services today. We are definitely reducing the risk of password theft but at the cost of user inconvenience. Imagine a user will have to carry bunch of tokens and stick a note on each device to identify which one to use where. Hardware token based two factor authentication solution doesn’t seem to work for a common user. We think the perfect solution must make use of existing infrastructure. Nowadays every user carries a mobile device with him. Mobiles generally have got more computation power than hardware OTP tokens and are expected to become more powerful in coming years. Exploiting the mobile’s computational power to generate OTP is not new. There are solutions available that provide authentication services via mobile. These solutions solve one problem, the cost factor. Also a user need not carry a number of different tokens for different services. But again, the software has its own problems. The mobile device client is specific to a vendor. A user needs to use one client software for one company and a different one for another; Again the client deployment and re-synching are some of issues corporate IT departments need to take care about. A user needs to read the OTP from mobile and enter on website to authenticate. Reading from a small screen sized mobiles is not so convenient. Also the count of digits in OTP has to be limited to a small number, typically 6-8 so that it is not hard for users to read from screen and type on login portal. This limits the strength of the OTP and the time duration for which a seed is valid. Issues related to client software on mobile device can be correlated to issues with having software on a user PC. Corporate IT departments need to take care of software updates, deployment, revocation and other issues. In today’s time, for PC based users, enterprises prefer a solution that doesn’t have such issues. Web-based solutions and smart solutions that don’t have many support issues are preferred. The same trend we are going to see for mobile users. A smart solution that is transparent to users yet secure enough to stand against next generation attacks. The solution needs to build a trust so that users are confident that they are secure when they access online services over un-secure Internet connections. If such a solution is not found, the Internet will soon cease to be used a medium for online transactions.
© Copyright, Vij

Read More...