NatWest mobile banking fail and why real innovation in security is needed

Sun, Oct 14 2012 08:31 | mobile telephony, 2FA, cloud security, data privacy, device fingerprinting, mobile, internet security, identity theft, Man in the middle, device ID, authentication, hack, hacking, NFC | Permalink

Not a good week for NatWest innovative banking services.

NatWest Get Cash fraud (Get Cash Pulled)

A combination of a simple phishing attack and a fundamentally insecure service led to many users of the Get Cash service ( a sub set of the NatWest mobile banking app – powered by Monitise) being defrauded of cash from their accounts.

The system allows users to get cash from an ATM by keying in a ‘secure cash code’ into the terminal. The assumption is that once you have logged in to your app you are legit and so you ping the system for the code. A user name and password level of security – that’s it!. No better than 99% of all apps on the Net today.

Needless to say the service was shut down once the fraud started becoming rampant.

Does the drive for customer convenience completely outweigh basic security rules. ? The problem with this kind of solution and others that rely on the presentation of self reported credentials i.e. user name and password are that these stateful artifacts are vulnerable to interception and re-use by a non-legitimate party i.e. the hacker, in this case through a phishing attack. The system does not know that the credentials being presented are being done so by the ‘wrong’ person.

Any security system worth its salt (pun intended) thus needs to rid itself of the baggage of years and years of ‘traditional’ security solutions such as certificates, tokens, java-script scraping, cookies passwords, keys and OOB. All shared secrets - incarnations of ‘security by obscurity’. (The problem with Passwords ) (The end of passwords)

Modern day hackers can crack passwords in seconds and bypass the defences laid by these solutions. The conundrum for CIO’s and CSO’s is to find the balance between usability and efficacy. As I stated in a previous blog – I am sure that most sites and custodians of your security are actually indifferent to your privacy and your security, hence the weakness of the solutions implemented. Here is an example of just how weak the ‘latest’ technologies are :
(The failure of RFID )

Imagine if there were solutions that harnessed the ubiquity of SSO’s but were also strong in the 2FA sense. In order to have universal appeal new solutions need to work in the BYOD / mobile domain. No more needs to be said about the proliferation of smart mobile devices. Effective solutions need to be easy for decision-makers to get and try out. Gone are the days of lengthy POC’s and trials. In the same way that consumers can try out tracks on iTunes and return unwanted products to sites like Zappos, so security solutions should be as easy to try out for free and get if they work and cancel if they don’t. I think that professional services will take a big hit in the enterprise arena. No longer required with SAAS.

We have already seen RSA take a big hit last year when its own defences were breached. We are now at the stage that the Lance Armstrong’s of the security industry (i.e. those who have pulled the wool over the eyes of their customers for many years ) are going to be exposed as their solutions fail on an ever increasing basis.

It is time for security to come clean. Only those solutions that are truly innovative will succeed. When someone like the founder of Wikipedia says that a security failure could bring down a company like Facebook (Security breach could bring down Facebook) maybe its time to wake up.

Ross

Comments (1)

The End of Passwords

Sun, Jan 1 2012 02:22 | IBM, password, 2FA, one time password, two factor authentication, security, authentication, NFC | Permalink

Finally it seems … the penny has dropped. Passwords are a poor substitute for real online security. There is more and more ‘chatter’ about it. Robin Henry writing in the Sunday Times on New Years Day talks of the end of ‘password hell’ invoking solutions in the pipeline from the Web Gods – Apple and Google. The talk is of new biometric solutions such as facial and hand movement recognition. Even IBM is talking this way. (http://www.forbes.com/sites/thestreet/2011/12/20/ibms-tech-predictions-for-the-next-5-years/)

I agree with the notion that passwords are a dying breed but not that biometrics will become vogue. They are fraught with problems of their own such as reliability, accuracy and the need for referencing of data-bases ( fail !) . Why are passwords defunct? Basically they are difficult to remember and they are easy to steal.

The solutions needed are those that require no cognitive load for the user ( the most unreliable participant in this enterprise !) and which will leverage the emergent technologies like smart-phones and tablets. These technologies enable mobile based solutions like SMS out of band and character recognition solutions as well as wireless solutions like NFC. In fact these technologies have created a challenge for the enterprise with these devices being brought into work by employees frustrated with working on antiquated PC’s.

What is Nirvana ? The user not having to remember anything apart from having his smart-phone on him. Well it seems that people are more inclined to leave their keys or wallet at home than their smart-phone. So all you will need is something that you already have and one which you wont leave at home.
The first step is to log in to the site with your email address (as the identifier). You then engage with a QR code that is delivered to the screen of the device you are logging in on ( even your smart-phone).. A line of sight interaction – you have to present your phone to scan the QR code on the screen. There is no wireless interface a la NFC which is vulnerable to interception. The phone delivers the scanned code back to the site, closing the loop ( triangulation) thereby proving your identity and allowing you to transact.

Nirvana exists. It is called Live Ensure. (http://www.liveensure.com)

Happy New Year.

Ross

Comments (5)

See Older Posts...