Happy Birthday to You, Mr. "Social Networking User"

RBI has now mandated that every credit card transaction must enforce the user to enter a secure PIN pre-registered with the banks. Of course I read it in the paper and thought I will register when I will be forced to do so.
Today when I logged into my bank account, the new flashing option on the site reminded me to register my two credit cards. I followed that and got my two cards registered.

But to my surprise I was able to login into the site for registration of secure PIN by just entering my credit card no.
It happened once and I re-registered the PIN and this time it asked me the PIN before I could login into the registration page.

Now that was serious, I registered my credit card for the secure PIN , restart my PC and I was still able to login entering the secure PIN....as I said it happened only once.... but if it can happen with my it can happen with other people also....

Actually that incident motivated me to write this blog....
But then I found a more serious problem.. "Forget 3D secure PIN"

Here is how someone can keep doing credit card fraud if your card is issued by ICICI bank (at least)

1. You loose your card which is already registered that ICICI for 3D secure PIN
2. Some one finds it and he plans to use to buy some stuff online. But he can not as he does not know our secure PIN
3. He goes to ICICI bank website and tries to login ...on login page, he selects "FORGET 3D SECURE PIN" (See snapshot)















4. He is then prompted to enter the card validity date , which is printed on the card ...so that was easy ..... He is also asked your date of birth. ... see the snapshot..



The whole security of the so called 3D secure PIN is based on how easy is it to get date of birth of a person .
I might go to google and just search for the name ....I can find 1000 results for this person, which sites he has been registered to and where can I find more information about him.

The most easy target will be to find it on the social networking sites where people just give out their date of birth without thinking that even an average mischievous person can use that information to mess up your financial and personal life.
I might find 10, 100 or 1000 people with same, but it will be easy to reduce this no. to very small based on some other parameters like city or region....
Wikimapia can even tell me how many person with the target name lives in the region and what is their exact location..wow!

Oh, may be I am reacting to this because of this RBI's official enforcement to all banks, but the whole user authentication system is flawed which is based on easily available personal information.

Did I tell you that Visa has another special security feature which they call as Personal Assurance Message (PAM), where they flash you a pre-registered message by you whenever you are about to do an online transaction. This way you can make sure you are really authenticating to the real bank website and not a fake website.
Surprising, they dont show you PAM when you go to ICICI bank website to change your Secure PIN. That means ICICI assumes that they dont need to prove their identity to you if you are visiting ICICI website.
Someone, rather than faking the merchant website can just simply fake the ICICI PIN registration page and then he will know most of the details he needs to know to use your card.

Conclusions:

1. Once you register your credit card secure PIN,make sure to test it on the bank website

2. Do not publish your personal information on sites which can be browsed by other online users...the sites make money using your information, you are just getting inviting people to mess up your life

3. Do not loose your credit cards. If you do, make sure to block them asap.

Read More...

The NULL Character: A black hole into Internet Security

Do you know anyone can hack your bank account or just any secure site that it to be protected using standard or Extended Validation certificates from the most trusted CA "Verisign"?
that too just using one character....the NULL character : '\0' ..

Here is googles search page...




















Here is the detailed version in PDF if you want to understand how it happens
http://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf

The attack is targeted to how CA (Certificate Authorities) issues certificates to domain owners. Since its an online process automated, the CA never meets the domain owner or verifies the hardcopy of password or DL ....

The domain owner goes to CA website, creates an account, generates a CSR and requests for a SSL server certificate for the domain. The CA verifies if its a valid domain and is registered on the name of the person who is requesting for the digital certificate by sending an email to the registered domain owner's email ID.

To implement the newly found attacks, I can simply register a domain like www.mydomain.com and then generate a CSR for www.icicibank.com\0.mydomain.com
The CA will see my domain name as mydomain.com which I own and hence can successfully verify my identity. Then I hack your DNS request and redirect you to my site which is a look alike of your bank. I then present you my new certificate that I got from verisign and which perfectly looks ok to your browser as your browser is going to see www.icicbank.com as the certificate "issued to" name.

So what does it mean to a usual online banking user:

She might be providing her bank account no. and password to a fake bank website which looks perfectly as the original bank website ...Even the site is protected with a valid certificate signed by Verisign... The browser will not complain of anything that can be suspicious

What all a hacker can do once he has you on the fake bank website:
1. Change your profile details so that later on he can reset all security PINs and passwords
2. He can find your personal information and then call the bank to make transactions to any account using tele-banking
3. Initiate an online trasaction using your credit cards and ask you for the two factor authentication system PINs as some fake security check drill


Precautions:
Make sure when you visit any secured website, do check following things:

1. the URL in the browser is "https:///...
2. Check that the yellow SSL lock is visible in the status bar of the browser
3. click on the SSL lock and check the details of the certificate that it is issues by a known CA and most importantly there are no suspicious intermediate CAs
4. Check the details of the certificat and find the common name in subject field. See that the common name is the same as the website address you visited.
5. Do not enter your password anywhere unless you initiated a transaction
6. Check your past transactions regularly to see there are no unknown transactions that you never made.


ICICI bank has put up a warning message for the users to make sure they dont fall victim to new SSL attacks:


















Have a safe surfing!

Read More...