Capitec Bank is also using a smartphone app, linked to a user\u2019s smartphone, for the same purpose as the token.<\/p>\n
Security expert Regardt van de Vyver explains what can be done<\/h3>\n![\"Regardt](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2012\/10\/Regardt-van-de-vyver.jpg\")
<\/a>Regardt van de Vyver<\/p><\/div>\n
MyBroadband asked Neology<\/a> CEO and security expert Regardt van de Vyver<\/a> what he thinks could be done by the banks to improve on their current Internet banking security. Here is what he said.<\/p>\nBanks have a difficult conundrum – how to make their service secure enough while still keeping it remotely usable for their average customer.<\/p>\n
Every layer of security added to the system ups the likelihood of the customer having issues – or even giving up on using the service all together.<\/p>\n
Going back to the basics of security it is typically about:<\/p>\n
\n- Something you know <\/strong>(like a password)<\/li>\n
- Something you have <\/strong>(like a cellphone)<\/li>\n
- Something you are <\/strong>(like a fingerprint)<\/li>\n<\/ol>\n
Traditionally banks focussed on \u2018something you know\u2019 as this was the simplest. Attackers however just as easily and quickly found ways to counter this \u2013 simply look over your shoulder or steal your information \u2013 remember the Javascript keypads that standard bank came up with to prevent key loggers?<\/p>\n
So, we naturally evolve towards \u2018something you have\u2019 \u2013 this is a \u2018out of band\u2019 or \u2018two factor\u2019 authorisation in that its more complicated for an attacker in this case. Not only must they capture your initial info (something you know) but they must also get access to the (something you have) one time code.<\/p>\n
Locally the SIM swap has been the simplest but there\u2019s also a fair bit of malware out there (see Moneyweb article regarding this issue<\/strong><\/a>).<\/p>\nWorking on getting \u2018something you are\u2019 integrated is a tough call at this point as we\u2019d have to likely evolve additional technology to get this done. So, back to \u2018something you have\u2019.<\/p>\n
SMS is used since it is the most widely usable technology across the full customer base \u2013 but we may need to look at more specialised approaches.<\/p>\n
A number of the providers have introduced the one-time-pin FOB (details here<\/strong><\/a>) but those are expensive and unlikely to get the type of uptake one needs.<\/p>\nAt this stage the next \u2018evolutionary\u2019 step may be a combination of the SMS and a local phone app.<\/p>\n
The app would receive the SMS and use that as the seed for a new one-time code \u2013 which the user then actually enters into the website. The application gets is keying material during a phone registration session (similar to what FNB already does with its App).<\/p>\n
This would force the whole phone to be taken for the attack to work, meaning that as long as a person has a simple\/quick way to disable the app on theft it would dramatically reduce the window of opportunity.<\/p>\n
An alternative \u2013 which is something Neology is starting to use for some of our high security clients – is a far cheaper version of the \u2018key fob\u2019 component combined with the SMS potentially.<\/p>\n
Basically a one-time-pin is generated via the USB\/NFC device (see details here<\/strong><\/a>) and you still enter the SMS key as well.<\/p>\nSadly all these approaches have downsides in either complexity or availability to users at large.<\/p><\/blockquote>\n
More on SIM swap fraud and Internet banking<\/h3>\n
Shocking reality about SIM swap fraud and money lost<\/strong><\/a><\/p>\nSIM swap fraud has been happening for years<\/strong><\/a><\/p>\nSerious ABSA Internet banking security concerns<\/a><\/strong><\/p>\nSIM swap banking scam: what you should know<\/a><\/strong><\/p>\n
<\/a>Regardt van de Vyver<\/p><\/div>\n
MyBroadband asked Neology<\/a> CEO and security expert Regardt van de Vyver<\/a> what he thinks could be done by the banks to improve on their current Internet banking security. Here is what he said.<\/p>\n Banks have a difficult conundrum – how to make their service secure enough while still keeping it remotely usable for their average customer.<\/p>\n Every layer of security added to the system ups the likelihood of the customer having issues – or even giving up on using the service all together.<\/p>\n Going back to the basics of security it is typically about:<\/p>\n Traditionally banks focussed on \u2018something you know\u2019 as this was the simplest. Attackers however just as easily and quickly found ways to counter this \u2013 simply look over your shoulder or steal your information \u2013 remember the Javascript keypads that standard bank came up with to prevent key loggers?<\/p>\n So, we naturally evolve towards \u2018something you have\u2019 \u2013 this is a \u2018out of band\u2019 or \u2018two factor\u2019 authorisation in that its more complicated for an attacker in this case. Not only must they capture your initial info (something you know) but they must also get access to the (something you have) one time code.<\/p>\n Locally the SIM swap has been the simplest but there\u2019s also a fair bit of malware out there (see Moneyweb article regarding this issue<\/strong><\/a>).<\/p>\n Working on getting \u2018something you are\u2019 integrated is a tough call at this point as we\u2019d have to likely evolve additional technology to get this done. So, back to \u2018something you have\u2019.<\/p>\n SMS is used since it is the most widely usable technology across the full customer base \u2013 but we may need to look at more specialised approaches.<\/p>\n A number of the providers have introduced the one-time-pin FOB (details here<\/strong><\/a>) but those are expensive and unlikely to get the type of uptake one needs.<\/p>\n At this stage the next \u2018evolutionary\u2019 step may be a combination of the SMS and a local phone app.<\/p>\n The app would receive the SMS and use that as the seed for a new one-time code \u2013 which the user then actually enters into the website. The application gets is keying material during a phone registration session (similar to what FNB already does with its App).<\/p>\n This would force the whole phone to be taken for the attack to work, meaning that as long as a person has a simple\/quick way to disable the app on theft it would dramatically reduce the window of opportunity.<\/p>\n An alternative \u2013 which is something Neology is starting to use for some of our high security clients – is a far cheaper version of the \u2018key fob\u2019 component combined with the SMS potentially.<\/p>\n Basically a one-time-pin is generated via the USB\/NFC device (see details here<\/strong><\/a>) and you still enter the SMS key as well.<\/p>\n Sadly all these approaches have downsides in either complexity or availability to users at large.<\/p><\/blockquote>\n Shocking reality about SIM swap fraud and money lost<\/strong><\/a><\/p>\n SIM swap fraud has been happening for years<\/strong><\/a><\/p>\n Serious ABSA Internet banking security concerns<\/a><\/strong><\/p>\n SIM swap banking scam: what you should know<\/a><\/strong><\/p>\n\n
More on SIM swap fraud and Internet banking<\/h3>\n