Wednesday, November 28, 2007

The man in the browser and how to starve him

According to Computerworld, the 'Man in the browser' is a new threat to online banking, but we have a solution. Here is the problem:  
Criminals infecting PCs with malware that is only triggered when they access their bank accounts are the latest threat to online banking, according to security software supplier F-Secure.
Perpetrators act as a 'man in the browser' by intercepting HTML code in the Web browser. As bank security measures curb more traditional threats such as keystroke logging, phishing and pharming, F-Secure warned, the 'man in the browser' attack will increase.
Once a user's PC is infected, the malicious code is only triggered when the user visits an online bank. The 'man in the browser' attack then retrieves information, such as logins and passwords, entered on a legitimate bank site. This personal data is sent directly to an FTP site to be stored, where it is sold to the highest bidder.
Security products using behavioral analysis were the best solution against such attacks, because the malware was only distributed to the users of specific banking sites, said Mikko Hypponen, chief research officer at F-Secure. This meant anti-malware software vendors were unlikely to be able to quickly release code to tackle all the new threats.
Following the enhancements that banks have made to authentication on their sites, "phishing attacks are becoming less and less effective and attacks of the 'Man in the Browser' are set to increase," he warned.
The man in the browser is just a variant of the horse in the browser. The thief in the browser, human or equine, gets cusomers' identity information and uses it to empty their bank acount or stock brokerage account. The thieves can invent new software devices faster than the problem can be fixed for the most part.
There is one solution that is thief-proof: IDentiWall from Made4Biz-security. IDentiWall can require users to insert a unique one time password that is sent by SMS to the user's cellphone. If a thief tries to access the account, the user will get the same SMS with the one-time password, and has the option of blocking access to the account until username and password can be changed.
IDentiWall can also send users a summary of the transaction for confirmation:
"You asked to debit acct # ____________ by $999.
Press Yes to continue or No to cancel"
The prinicple implemented by IDentiWall is that it gives users control over their online account through a separate, secure channel - their cellphone.
The man installed by thieves remains in the browser, but he isn't being fed anything.

Made4biz Security Translating real-world security knowhow into state of the art security systems.
Made4biz Security

Turn on Sound for Demos:
Bill Gates Demo (Location-based)
Elvis Demo (Location/Context-based)
Clint Eastwood Demo (Temporal-based)

Powered by Blogger

Subscribe to
Posts [Atom]

Technorati Profile

RSS Syndication

Made4Biz Security Inc