Was reading the newspaper today, and my eyes caught the headline titled ‘Banks on track to fully use online ID security‘ in The Star (Sat 14/10/2006). Briefly, all banks in Malaysia are required to implement ‘two-factor authentication’ on their online banking website before 1 Dec 2006, following regulation set by Bank Negara Malaysia. Being a guy who is interested in computer security topics, this sure caught my eyes.
As far as I remembered, I read and discussed the importance of multi-factor authentication in my final year project. One-factor authentication is like the use of password alone to enter a system. One would consider the use of username and password as a two-factor authentication, although I quite disagree with that. For me, username/password combination is like a one-and-a-half-factor authentication, because the method of transmitting the values are still the same. A truly two-factor authentication for me would be like what the current ATM machines implement, a bank card and PIN code to authenticate the person.
However, this is not what I’m gonna discuss here. What I’m interested is the reaction of public as well as security experts with regards of this matter. As for public, yeah, they’ll come out with all the cliche answers. Ask any ordinary civillian, and the answer that’ll come out would be ‘hackers, system not good, not secure enough yada yada‘. Generalization tends to come in all of living aspects, without the feeling of researching for information before conveying the conclusions. Frankly speaking, I’ll give my respect to those who says ‘I don’t really know about the matter‘ rather than the jocks that keep on blabbering to show that they keep updated with the IT scenario and do know stuffs about online thingy. It fails to come to their mind that the banking industries are trying their hard to make online transactions as secure as possible. Most of us wouldn’t notice the layers of protection we go through while logging on to the system, but the background processes are thorough. From secure channel (SSL), cache, cookies, last login time and date, all these are implemented as an additional steps to delay hacking process. I wouldn’t say that online banking is bulletproof, God no, the moment a security analyst says a system is hackproof is the moment he/she is no longer a security analyst. But what they the banking industries are doing show that they are keeping up with the current technology. Sadly, we failed to recognize and affirm the things they are doing.
Based from the news, the victims of this so-called ‘online banking tragedy‘ was due to their inability of detecting a phishing attack. In layman terms, phishing means the act of getting information (usually sensitive data) through the means of bogus websites, spoofed e-mails/SMS, data-mining and so on. These phishers are actually continuing what Kevin Mitnick had done years ago, online. If you’re to analyze the steps done to steal the money from online banking, you’ll realize none of these involves hacking processes (as per current case). All they did was to set up a bogus site which kept the login information of the victim, sending e-mail/SMS to the victim saying he/she has won something and required to login to the online banking system to redeem bla..bla.. and just waited for the victim to fall for the trap. And this victim, being joyous from the prospect of winning something, dutifully logged in to the website given by the phishers failing to realize the website was actually fake. What this website did was to capture the login info, and then redirects the victim to the real online banking website. The victim will fail to detect any difference from this point on, because he/she is now in the real online banking system.
Victim –> Fake website (captures login info) –> Redirected to real website
I personally believe this wouldn’t happen if the victim took his/her time to check the validity of the message received. All the security that is provided would be useless if the mindset of the public doesn’t change. It’s like giving some stranger the key to your house, and later you’re mad because things in your house are stolen. Sounds stupid, but that’s what really happened nowadays. To those asking the steps to prevent phishing attacks, I would say if you have the time to read this blog then you should have time to google it yourself.
And to that so-called ‘pakar komputer‘ who said he has lost his trust with online banking because he too once become a victim of phishing, I would like to ask this: You call yourself a ‘pakar komputer‘ and you fell for phishing attack? D’oh!
p/s: I am too lazy to check for grammatical mistakes, so if you have something to correct please click here to inform me through my personalized website. Thanks.
[additional]
Further info can be viewed here and here.