Smart card with LCD
This company is presenting a smart card with built in display. I do not know the underlying protocol for making debit/credit card payments by smart card instead of using the magnetic stripe but if the protocol is sophisticated enough this could help blocking some of the known attacks of those. As Chip and SPIN points out the smart cards has some issues. One of them is that if the terminal is compromised you as a customer have no way to know that you are actually confirming the transaction you think you are while entering your pin code. If your smart card shows the amount, you could at least not be deceived into emptying your account.
Huge number factored into primes
Recently 2^1039-1 were factored. Is this the end of 1024 RSA encryption? Lenstra, one of the researchers, addresses this question: "Last time, it took nine years for us to generalize from a special to a non-special hard-to factor number (155 digits). I won't make predictions, but let's just say it might be a good idea to stay tuned."
2^1039-1 is a special number that the RSA algorithm would never use so 1024 RSA might still be secure for the time being but if you want to be future safe 2048 bits or more would be the way to go.
Client side security
Recently a friend of mine got problems while trying to book a hotel room online. The JavaScript-driven calendar was IE-only and he is on Mac OS X. My friend then checked the source and saw that the JavaScript actually just set a value to an hidden input field. He fired up Firebug and edited the field manually and then submitted the form. When he got the confirmation of the booking he saw that he accidently had typed 2006 instead of 2007. The only protection against booking at dates in the past, already fully booked or in the year 2100 were the JavaScript that ran the calendar.
When building a web application you can never ever trust that any of the data from the client will be untampered with.
Some problems I've seen in the past:
Relying on JavaScript-validation. JavaScript can be turned off or ran through a debugger.
Having sensitive data in hidden input fields.
Storing sensitive data in cookies.
- This is not a very common problem since almost all web application frameworks handles this for you by only storing a session id in the cookie and the actual data on the server.
Simple security tokens needed 2
In an earlier post I mentioned that a security token that lets you sign your transactions is one way to go to get more secure Internet banking.
Now a couple of swedish students have shown (by also using the problem I mentioned in this post) that a security token both needs to be used in a secure manner and that it also needs to be simple for the user to know what he is actually signing. According to the press it seems that they did this as a man-in-the-middle attack. This is just speculations but it seems the reason that this were possible were that the user did not have a clear view of what he was signing.
It could have been done something like this:
- Redirect the user to a fake site (and hope that he does not investigate the certificate).
- Ask for username and challenge the user with the verification code and then login to the bank in the background.
- Try to add a new account for transfers and then tell the user he mistyped and has to login again while challenging him to verify the new account.
- Transfer money the same way.
The bank has solved the problem by adding a 9 before all login codes. I'm not convinced this is simple and obvious enough for the users. One way to make it simple could be a security device with buttons labeled "login", "sign account" and "sign amount" or such.
EDIT: Now it has started to arrive phishing mails that asks the customers of Swedbank to install ssl3.exe...
