Comments on MITB (Man in the Browser) Protection Layers

Johan commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-02T17:11:56Z

Well, I do keep my banking application on its own virtual machine that I use for nothing else (I only have it turned on for the time I'm using the banking application). I'm sure this is very good practice but not everybody is a sysadmin...

Atif Mushtaq commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-01T19:47:54Z

Johan
------
End of the day there will be some application running on the vulnerable system making all these transactions. You are assuming that this application would be more secure than browser. I don't think so! It's not very difficult in windows to change values in the memory of any external process. Attacker can hook into windows message queue and wait for the user to do some transactions, and right before these values are going to be encrypted, change the legitimate account information with one of his money mules accounts. Similarly it's not difficult to launch this application in hidden mode and problematically perform the complete transaction.

Atif Mushtaq commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-01T19:40:19Z

Daniel
------
Paper based codes are just like 'Safety Pass' based random code. We already know how attacker might hijack such codes with simple social engineering. Apart from that, it can't protect user against transaction manipulation MITB.

Atif Mushtaq commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-01T19:31:58Z

Thanks guys for these suggestions. But I find slight problems with each of the above techniques..Let me explain one by one.

Ali
----
The only problem I found is that user might also end up handing this secret question to the attacker.

1. User gets a fake SMS from the attacker, pretending to be bank and asking about this secret question. Just like user fooled into giving these secret questions to the attacker while MITB attack. He may hand it over again.

2. User might select a secret question which is already compromised or already known to the attacker.

But yes this technique would further improve things a bit but on the cost of more inconvenience to the user. If user would have to enter it again and again. He might get used to it so much that he would simply learn to enter it always.

Johan commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-01T14:28:33Z

Am I more secure using an application that establishes its own VPN tunnel with the bank server, instead of using a web browser? I have always felt more secure, because there is no browser involved...

Daniel Lohin commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-01T13:37:06Z

I think an easier method is what some European banks do. Send a One time key paper to the user. This paper just contains random keys like xcdse23. A user starts at the top left and each time one of these keys is used, they cross it out and move on to the next one. This has a few benfits, it is pretty cheap. I think it is easier then having the user do a Ceasar Cipher. I know that this One Time key approach is using the definition a little off, because you would need enough characters to encrypt all the data.

Ali Islam commented on 'MITB (Man in the Browser) Protection Layers'

2010-03-01T13:30:14Z

Atif,

Good article, you have treated the topic very well. I would like to propose another solution to technique_1.

Solution --> Instead of just asking for plain acknowledgment via SMS, the bank should ask for an answer to a "secret question". With that done, even if the attacker successfully changes the Safety Pass (using MITB) to his own mobile, he cannot answer that secret question and hence can't do the illegal transaction.

It may not be the perfect solution but so far I don't see any problem with it.

cheers,
Ali