Managing identity frauds
Upcoming SlideShare
Loading in...5
×
 

Managing identity frauds

on

  • 506 views

identity frauds,managing identity frauds, treats, Trojan Horse, Virus, Keyboard sniffer, Soliciting Email, Pharming, Session Hijacking, Man-in-the-Middle, Man-in-Browser attack, Replay Attack, Offline ...

identity frauds,managing identity frauds, treats, Trojan Horse, Virus, Keyboard sniffer, Soliciting Email, Pharming, Session Hijacking, Man-in-the-Middle, Man-in-Browser attack, Replay Attack, Offline Dictionary Attack, Masquerading as customer, Masquerading as technical support, Masquerading as organization

Statistics

Views

Total Views
506
Views on SlideShare
471
Embed Views
35

Actions

Likes
0
Downloads
21
Comments
0

1 Embed 35

http://www.linkedin.com 35

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    Managing identity frauds Managing identity frauds Presentation Transcript

    • Managing Identity Threats May 2010 1
    • Where are the threats ? Web/App Server Session Vulnerabilities: Customer •Replay attack •Offline dictionary attack Vulnerabilities: •Password sniffed in transit •Session hijacking •Man-in-the-Middle / Man-in-Browser attack Vulnerabilities: •Trojan sniffers •Soliciting Email to enter credentials Vulnerabilities: •Fake Phishing website •Masquerading as customer •Masquerading as tech support •Masquerading as organization Helpdesk 2
    • Threats at the Customer (1/5) Attack Objective:  Collecting ID & Password of end-user to impersonate as customer Types of attacks  Trojan Horse / Virus Keyboard sniffer  Soliciting Email (Pharming)  Fake Phishing Website 3
    • Threats at the Customer (2/5) Trojan Horse / Virus Keyboard sniffer  What happens:  Malicious program that capture the end-user’s ID & password while it is entered by the user and send it to the hacker.  More complex sniffers may target knowledge-based authentication (KBA) to capture the questions-answer pairs or target visual-based authentication (VBA) to capture visual-pattern+password pairs. 4
    • Threats at the Customer (3/5) Soliciting Email (Pharming)  What happens:  User receives an email (or message) prompting them to enter their ID & password in some hacker website in order to “win” some prizes, “re-check” their account, etc.  Hacker website will collate captured IDs and Passwords and send it to hacker 5
    • Threats at the Customer (4/5) Fake Phishing Website  What happens:  User is redirected to a fake website through a compromised DNS, or invalid Wireless Gateway, or similar-looking URL (e.g. www.citi6ank.com)  Fake website will have a similar look-and-feel to the actual website, and may fool user to entering the ID and password  Fake website will collate captured IDs and Passwords and send it to hacker 6
    • Threats at the Customer (5/5) Best Practice:  Use 2-factor authentication at login to render the captured ID and passwords and other KBA, VBA information useless in the hands of the hacker. Web/App Server Session Customer DS3 Authentication Server Vulnerabilities: Best Practice: SMS •Trojan sniffers •Strong 2-factor •Soliciting Emailusing authentication to enter credentials SMS OTP tokens or •Fake Phishing website 7
    • Threats in the Session (1/7) Attack Objective:  To fool the application server to believe that the incoming connection is a previously validated session Types of attacks  Session Hijacking  Man-in-the-Middle / Man-in-Browser attacks 8
    • Threats in the Session (2/7) Session Hijacking  What happens:  Users unknowingly rely on a malicious or compromised gateway to access the application.  After the user has logged in, the malicious gateway may transfer the authenticated session to the hacker’s browser 9
    • Threats in the Session (3/7) Man-in-the-Middle / Man-in-Browser attack  What happens:  The user’s web session is directed via a malicious reverse proxy which masquerades as the application server in real-time, while connecting to the actual server to maintain a valid SSL user session.  The proxy will re-enact the exact sequence of inputs from the user to the application, and render the same output back to the user.  Such an attack can render 2-factor authentication (using OTP tokens) useless  To attack applications using PKI tokens, the malicious reverse proxy is run within the end-user’s PC to gain similar access to the PKI token. This attack is also known as Man-in-Browser attack. 10
    • Threats in the Session (4/7) Man-in-the-Middle / Man-in-Browser attack  The Man-in-the-middle is able to defeat 2-factor authentication User: Alice, Pwd: XXX User: Alice, Pwd: XXX What’s your OTP ? What’s your OTP ? OTP is 123456 OTP is 123456 Alice Welcome Welcome Alice Application Pay $X to Mr ABC MITM Pay $X to Mr XYZ Server OK for $X to Mr ABC OK for $X to Mr XYZ And potentially compromise the transaction  The Man-in-Browser can be carried out similarly to attack PKI tokens 11
    • Threats in the Session (5/7) Best Practice:  In session-based attacks, the hacker may have already bypassed the authentication process.  It is therefore important to implement proper security to ensure the integrity of the transaction as well  There are 3 areas where security technologies can be applied:  Protecting the session  Re-validating the transaction through Out-of-band authentication  Requiring the user to provide OTP authorization code for non- repudiation 12
    • Threats in the Session (6/7) Best Practice:  Protecting the session  Mastercard SecureChannel using smart card reader  The IBM ZTIC is a USB-attached device that can verify the integrity of the SSL web session on behalf of the end-user. Hello ZTIC Please login Alice SSL certificate is MITM flagged as invalid by ZTIC 13
    • Threats in the Session (7/7) Best Practice:  Protecting the transaction  Use Out-of-band authentication to verify the transaction and use a OTP authorization code for non-repudiation SMS …. …. Welcome Alice Welcome Alice Pay $X to Mr ABC Pay $X to Mr XYZ MITMPlease ConfirmTransaction ID:9999 to DS3 Authentication serverPay $X to Mr XYZAuth Code: 123456 Transaction is sent to user in SMS via OOB channel, and modification is detected by user 14
    • Threats at the Server (1/6) Attack Objective:  Rogue administrator has elevated rights to the system, and will abuse the rights to get the end- user credentials Types of attacks  Replay attacks  Offline dictionary attacks  Password sniffed in transit 15
    • Threats at the Server (2/6) Replay Attack  What happens:  Rogue administrator turns on verbose logs in the web server. All users’ login credentials are captured in the web server logs.  The administrator copies the login credentials from the logs (even if they were already hashed at the browser) and does a replay of the web session to gain access as the user. 16
    • Threats at the Server (3/6) Offline Dictionary Attack  What happens:  Rogue administrator gains access to the password database in the system.  The administrator copies the database to an external machine, and runs a brute-force attempt to find the users’ passwords against the password records. 17
    • Threats at the Server (4/6) Password sniffed in transit  What happens:  Similar to the replay attack, but carried out by the network administrator  Rogue network administrator turns on sniffing in the intranet. All users’ login credentials being transferred from the web server to the application server are captured in the sniffer logs.  The administrator copies the login credentials from the logs (even if they were already hashed at the browser) and does a replay of the web session to gain access as the user. 18
    • Threats at the Server (5/6) Best Practice:  The security risk posed by a rogue administrator is even higher than any phishing website.  It is important that administrators should be prevented from even gaining access to the users’ ID and password login credentials.  There are 3 areas where security technologies can be applied:  Use end-to-end encryption of passwords from browser to authentication server  Store passwords in a hash+encrypted manner  Implement 2-factor authentication for end-user logins 19
    • Threats at the Server (6/6) Best Practice: Web/App Server Session Best Practice: Vulnerabilities:encryption of •End-to-end Customer •Replay attack passwords •Offline dictionary attack •Password storage in hash- 3. Passwords remain RSA •Password sniffed in transit encrypted mode encrypted at web- •2-factor authentication at login 2. Encrypted server logs password with session nonce protects against replay attacks UserID abc DS3 Authentication Server Pwd ****** 4. Passwords are stored hash+encrypted in DS3 Authentication Server. DS3 Server will RSA decrypt the password, Login check the session nonce before verifying the password. 1. In addition to SSL session encryption, Password is RSA encrypted with session nonce using Javascript or Java Applet for end-to-end encryption 20
    • Social Engineering Threats (1/5)  Attack Objective:  To fool victim to carry out certain functions or reveal certain information  Types of attacks  Masquerading as customer  Masquerading as technical support  Masquerading as organization 21
    • Social Engineering Threats (2/5) Masquerading as customer  What happens:  Hacker is doing brute force attack on customer account and has locked the account. Hacker will try to convince Helpdesk to unlock the account 22
    • Social Engineering Threats (3/5) Masquerading as technical support  What happens:  Hacker pretends to return call from tech support company to convince administrator to reveal information about the system, and even the administrator password 23
    • Social Engineering Threats (4/5) Masquerading as organization  What happens:  Hacker may pose as the organization to convince the user to reveal the password; or  Hacker may pose as the organization to obtain answers from user on personal questions in order to gain access to the password reset function. 24
    • Social Engineering Threats (5/5) Best Practice:  Besides enforcing strong authentication for end-user logins, administrative or privileged accounts for internal systems should also be protected with 2-factor authentication.  Change or re-set password self-service screens should require the 2nd-factor credential as part of the change/reset password process. UNIX Windows OK UserID, Password + OTP GINA PAM_RADIUS UserID, OK Password + OTP RADIUS Authentication VPN Administrator DS3 Authentication Server Verify 25
    • Addressing the threats Web/App Server Session Best Practice: Vulnerabilities: •End-to-end encryption of Customer •Replay attack •passwords Offline dictionary attack •Password storage in hash- Vulnerabilities: •Password sniffed in transit Best Practice: encrypted mode •Session session •Verify thehijacking •2-factor authentication at login •Man-in-the-Middle / •Use OOB to re-validate the Man-in-Browser attack transaction •User to provide OTP auth-code for non-repudiation Vulnerabilities: Best Practice: •Trojan sniffers •Strong 2-factor •Soliciting Email to enter Best Practice: authentication using credentials •Require strong authentication Vulnerabilities: tokens or SMS OTP •Fake Phishing website for internal administrative •Masquerading as customer accounts •Masquerading as tech support •Require strong as organization Masquerading authentication for change / reset password Helpdesk 26
    • Questions ?  Thank you. For enquiries, please contact: Data Security Systems Solutions Pte Ltd Website: http://www.ds3global.com info@ds3global.com 27