The battle against cyber-fraud gets fiercer

On the internet, danger is lurking everywhere. The internet user has to be careful at all times. This was proven once again recently when the Mumbai police rounded up a fraud affair. A large amount of money was undeservedly transferred through the RTGS system. A cyber criminal was able to intercept the user name and static password of an unsuspecting victim at an Indian bank.

A lot of problems arise when static passwords are used. First of all, the average computer user is not that imaginative when it comes to inventing a password. Names of the children, loved-ones or pets, dates of birth and plain combinations on the keyboard, such as 123456 are warp and weft. If passwords are too simple, it is easy for hackers to uncover and intercept them. However when passwords are too complex, they are forgotten or written down. Moreover people tend to use the same passwords for different accounts. A difference between private and working applications is seldom made. For hackers, it is a piece of cake to intercept these passwords.

Common Threats

Adequate security is indispensable, because the internet bristles with danger. Dictionary attacks, phishing, key-ware, and man-in-the-middle attacks are the most common ones. Just because most internet users keep their passwords simple or reuse their passwords for different accounts, hackers execute so called dictionary attacks. In this manner, they try to break through encryption techniques with a composed, limited list of possible passwords. These lists are tuned to the country in which the attack is executed or to the victim's interests.

Phishing is also a common technique to illegally obtain passwords. Crooks send a bogus e-mail to the user or lead the user to a fake website that incites him to fill in username and password. An attack against a carefully selected target is called spear phishing.

Furthermore, criminals make use of key loggers. This malware registers the keys struck on the keyboard to detect the password, which is then sent to the hacker over the network. The user is oblivious of any harm. This malware can enter the computer through any possible file and is often disguised.

Dynamic Passwords Circumvent Online Threats

Strong authentication and one-time passwords give an answer to the previous problems. Two-factor authentication, as it is also called, expects the user to dispose of 2 elements. Firstly, he has to know something-such as a PIN code-and secondly, he has to possess something, such as a hardware device or an application to generate a one-time password (OTP).

An OTP, as the name suggest, can only be used once during a limited period of time (eg, 32 seconds). This means that fraudsters cannot reuse the passwords at a later time, as it will have expired. An OTP can be generated by a hard- or software token, which implies that the password will not be exposed over the internet.

Man-in-the-Middle Attacks

Another form of online fraud is the so called ‘man-in-the-middle attack' (MiTM). This type of fraud scheme is still on the rise. Man-in-the-middle attacks typically are attacks on online banking systems and can be described as a way of eavesdropping. The hacker is able to read the messages between 2 parties, to add things or to change the message. The sender does not realize that the link between him and the receiver is disrupted.

E-signatures Guarantee Transaction Security

In the continuing fight against cyber criminals, the attacks become increasingly sophisticated. So how can a bank protect its customers? Again, 2-factor authentication is the answer. But here, security goes beyond the use of dynamic passwords. Where dynamic passwords do identify the user when he logs on, they cannot prevent transaction content from being changed. This is where electronic signatures come into the picture.

E-signatures allow the bank to verify whether a transaction was initiated by the genuine end-user and was not altered in transit. It prevents the fraudster from submitting transactions or modifying existing transactions. To calculate an electronic signature, crucial data such as the beneficiary's account and the amount of the transaction are used. Should a fraudster alter the amount or account number of the transaction, the electronic signature will become invalid.

Conclusion

Internet fraudsters have upgraded: they regularly operate with phishing, spear phishing and man-in-the-middle attacks. Banks should take precautions and must strengthen access control to their online banking applications. Only with modern 2-way authentication and electronic signatures, criminals do not stand a chance. However the end user also needs to be acquainted with internet street smarts. He must learn which kind of behavior entails security risk, recognize the signals and be cautious.