The Failure of Two-Factor Authentication
In 2005, I wrote an essay called "The Failure of Two-Factor Authentication," where I predicted that attackers would get around multi-factor authentication systems with tools that attack the transactions in real time: man-in-the-middle attacks and Trojan attacks against the client endpoint. This BBC article describes exactly that: After logging in to the bank's real site, account holders are being tricked by the offer of training in a new "upgraded security system". Money is then moved out of the account but this is hidden from the user. [...] Called a Man in the Browser (MitB) attack, the malware lives in the web browser and can get between the user and the website, altering what is seen and changing details of what is being entered. Some versions of the MitB will change payment details and amounts and also change on-screen balances to hide its activities. How to spot if you have been infected If your transaction seems to be taking longer than normal, there is a chance it is going via a fraudster's system If you are asked for more information than normal, especially entire passwords where previously you were only asked for part, your machine may have been infected Computers that have been infected often slow down while malware monopolises both the processor and the internet connection The solution is to authenticate the transaction, not the person. ...
Source: Schneier on Security - Monday, 6 February
Related articles:
- Older News
- 4Vote! Fujitsu develops world's smallest and slimmest palm vein biometric authentication sensor deployable in tablet devices
PhysOrg - Wednesday, 2 May
- 6Vote! Password Security at Linode
Schneier on Security - Wednesday, 18 April
- 6Vote! Explaining heart failure as a cause of diabetes
- 7Vote! NIST special publication expands government authentication options
- 13Vote! Can nerve growth factor gene therapy prevent diabetic heart disease?
- 18Vote! Healthy lifestyle habits lower heart failure risk
- 22Vote! Why kidney failure risk 4x higher for blacks
Futurity.org - Tuesday, 6 September, 2011
- 28Vote! 'Smelling' heart failure: Evaluation of an electronic nose
- 18Vote! Not faster, but longer -- new drug changes beat in treating heart failure
- 17Vote! Heart failure: Doing what your doctor says works
