The WiKID Blog

Viewing posts from January, 2009

shame-ostracism-blogs-and-xss-flaws

Posted by: admin 16 years, 3 months ago

There is an excellent post on Security Fix Blog about cross-site scripting flaws at major financial institutions pointed out by Lance James (author Phising Exposed.

short-sighted-critiques-of-two-factor

Posted by: admin 16 years, 3 months ago

There are two things to keep in mind when discussing two-factor authentication:

sitekey-study-released

Posted by: admin 16 years, 3 months ago

And the results are not good.

“The premise is that site-authentication images increase security because customers will not enter their passwords if they do not see the correct image,” said Stuart Schechter, a computer scientist at the M.I.T. Lincoln Laboratory. “From the study we learned that the premise is right less than 10 percent of the time.”

The article also points out that perceived user convenience is more important than security:

Banks immediately knew what they did not want to do: ask customers to download new security software, or carry around hardware devices that feed them PIN codes they can use to authenticate their identities. Both solutions would add an extra layer of security but, the banks believed, detract from the convenience of online banking.

This is a problem, though, because their opponent is more than willing to install software on the user's computers. Moreover, they are willing to attack an ISP's computers in the middle. This asymmetry will cause problems for financial institutions.

spear-phishing

Posted by: admin 16 years, 3 months ago

IBM released the results of a security study showing a dramatic increase in phishing attacks that target specific individuals and institutions have increased dramatically.

spies-in-the-phishing-underground

Posted by: admin 16 years, 3 months ago

There is a great article on the current state of phishing on net-secrurity.org. The article discusses phishing kits with backdoors (phishers phishing phishers), the market for identity information, the lack of sophistication of phishers and some recommendations:

We aren’t going to solve the problem of online PII (Personally Identifiable Information) and identify theft just by writing even more secure code (although it certainly helps), or by continuing to play whack-a-mole with phishers. The system of relying on static identifiers to commit financial transactions needs to be rethought.

And:

Commercial financial institutions such as credit card companies and banks realize that the cost of implementing a new system that does not merely rely on static identifiers is higher than the fraud committed, so they decide to accept the cost. This is the reason why the system has not changed. Unfortunately, financial institutions only take into account their cost when making this decision, but it also ends up affecting the lives of millions of people who have to pay with their identities when such fraud is committed (this cost is also shared by other companies that want to have the capacity to process transactions. The PCI standard is a good example of this situation).

The expectation is that the band-aid approach will continue to be applied until the costs exceed the expense of two-factor authentication.

• Page 68 of 86
• ←
• 61
• 62
• 63
• 64
• 65
• 66
• 67
• 68
• 69
• 70
• 71
• 72
• 73
• 74
• 75
• →