Delfigo Security - Strong Authentication

  • Increase font size
  • Default font size
  • Decrease font size
Home Identity Theft
Identity Theft

The End of "Swipe and Sign"?

"Beginning later next year, you will stop signing those credit card receipts. Instead, you will insert your card into a slot and enter a PIN number, just like people do in much of the rest of the world. The U.S. is the last major market to still use the old-fashioned signature system, and it’s a big reason why almost half the world’s credit card fraud happens in America, despite the country being home to about a quarter of all credit card transactions."

Tom Gara's article in the Wall Street Journal discussed the impending shift from swiping a credit card and signing the receipt, to swiping the card and entering a PIN. This is the way credit card transactions happen across the globe, and we will now begin to see this model adopted in the US as well. 

 What will this mean for the PIN and the security of using one each time we do a transaction? Most of us have PIN numbers associated with screen locks on our devices, or the access applications. It's not an unfamiliar concept, but there has been much discussion about how easy PINs are to crack - and how often we choose insecure PINs to make our lives easier. With this shift will come a need to implement security on top of PINs to that is transparent to the end user, and secures these transactions in order to extend protection to end users against identity theft, and continue to combat fraud.

 

Using Keyboard Biometrics to Detect Automated System or BOT

The recent Wall Street Journal article, Accounts Raided in Global Bank Hack, discusses the latest example of the Zeus Trojan being used to steal credentials and access user accounts. Nearly $3 million was stolen in the scheme in which accounts were illegally accessed at J.P. Morgan Chase & Co., Ally Financial Inc. and PNC Financial Services Group Inc. Funds from the accounts of those financial institutions were then  transferred to "mule" accounts at the Bank of America Corp. and TD Bank Financial Group before being sent to Eastern Europe. 

“Hackers used malicious computer software known as Zeus Trojan, disguised in seemingly benign email. When the email recipient clicks on a link or attachment in the email, the virus monitors the victim's computer activity to grab user names and passwords.”

This is exactly the type of cyber attack that Delfigo’s authentication platform, working in conjunction with a banks existing security ecosystem, is designed to address. First off, keystroke biometric technology would have detected an automated system or BOT. The reason, mathematically the keystroke timings of an automated system or BOT are too pure and clear. For example:

kestroke biometric ekg comparison

The top half of the picture to the right demonstrates the keystroke timing vector for a human being. It looks sort of like an EKG (all over the place), therefore, unique.  However, the bottom part of the picture demonstrates the keystroke timing vector of an automated system or BOT. The signature would look very square and perfect. This is particularly true for the “dwell” times since there will be no variance.

A series of “triggers” would detect the BOT in real time and deny access.  However, what if the stolen credentials had been manually typed in? Once again, keystroke biometrics would have identified a mismatch between the human hacker's keystroke ID and that of the legitimate user on record.

In addition, also consider that the legitimacy of the hacker's login attempt,  whether manual or automated, would have been challenged based on other factors as well. The ID and password would have been flagged as being delivered from a IP address that did not match the user profile; and elements of the device ID would have conflicted with existing attributes on record. In almost any scenario that involved a high risk activity such as a change to an account profile or a transfer of assets, the system would have challenged the transaction and either denied access on the spot, or escalated to a secondary authentication layer.

Despite the well known fact that “first factor” authentication, in the form of a standard login (username and password), provides little in the way of security, many institutions continue to rely upon it as a primary option. This is for the most part a result of older two factor authentication solutions that required cumbersome hardware that inconvenienced users and escalated support costs. A keystroke biometric solution provides a lightweight alternative that requires no change in user behavior, and substantially eliminates maintenance and support costs because there is no hardware or software to distribute or maintain.

 

FTC Pushes Back Identity Theft Red Flag Rules Again

The Federal Trade Commission announced that it is once again pushing back enforcement of the “Red Flags” Rule. This time through December 31, 2010 so that Congress can consider legislation that would clarify and fix affect the scope of entities covered by the Rule.

Federal Trade Commission statement:

The Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008. The Commission has issued several Enforcement Policies delaying enforcement of the Rule. Most recently, the Commission announced in October 2009 that at the request of certain Members of Congress, it was delaying enforcement of the Rule until June 1, 2010, to allow Congress time to finalize legislation that would limit the scope of business covered by the Rule. Since then, the Commission has received another request from Members of Congress for another delay in enforcement of the Rule beyond June 1, 2010.

The Red Flags Rule is part of the Fair and Accurate Credit Transactions Act of 2003 (FACTA). It requires “creditors” and “financial institutions” to address the risk of identity theft.

 

Identity For Sale Online

Symantec points out the most frequently advertised items for sale on underground economy servers.

Source: Symantec Intelligence Quarterly: APJ October - December, 2009

 

New Generation Trojans Counter Token Based Temporary Passwords

A recent New York Times article once again draws attention to potentical vulnerabilities of token based temporary passwords. Saul Hansell describes in the article how hackers use new trojans to capture passwords in real time, thereby by-passing the security of offered by a token based device that utilizes a complex algorithm to generate a new temporary password every minute.

Source: How Hackers Snatch Real-Time Security ID Numbers


 


Page 2 of 3