An Introduction

1. SECURITY SYSTEM IN BANKS
SUBMITTED FROM MUHAMMAD ADEEL RIAZ
SUBMITTED TO SIR INAM UL HAQ
ROLL NO. 3024
UNIVERSITY OF EDUCATION OKARA 1
UNIVERSITY OF EDUCATION LAHORE
(OKARA)

2. TABLE OF CONTENTS
Sr. No Description Slides No
1 eBanking Security 3
2 Agenda 4
3 Targets of Attacks 5
4 Clients Attacks 6
5 Geneic Torjans 7 to 10
6 Security Measures 11 to 15
7 Visit to Bank 16to17
8 Conclusion 18
9 Refrence 19
UNIVERSITY OF EDUCATION OKARA 2

3. eBanking Security?
• Is eBanking still safe?
• What are the security trends in eBanking?
• What can we learn from eBanking trends for
other online applications?
UNIVERSITY OF EDUCATION OKARA 3

4. Agenda
• eBanking Attacks
• Security Measures
• Secure Communication
• Implementations
• Outlook / Thesis
UNIVERSITY OF EDUCATION OKARA 4

5. Target of Attacks
Phishing Attacks
Trojan Attacks
Pharming
DNS Spoofing
Network Interception
Web Application Attacks
Attacking Server
UNIVERSITY OF EDUCATION OKARA 5

6. Client Attacks
Most promising attack on the client:
• Phishing
• Motivate user to enter confidential information on fake web site
• Simple Trojans
• Limited to a handful of eBanking applications
• Steal username, password and one time password
• Steals session information and URL and sends it to attacker
• Attacker imports information into his browser to access the same account
• Generic Trojans
• In the wild since 2007, but still in development
• Can attack any eBanking (and any web application)
• New configuration is downloaded continously
UNIVERSITY OF EDUCATION OKARA 6

7. Generic Trojans
• Infection of client with user interaction
 Email attachments (ZIP, Exe, etc.)
 Email with link to malicious web site
 Links in social networks
 Integrated in popular software (downloads)
 File transfer of instant messaging/VoIP/file sharing
 CD-ROM/USB Stick
• Infection of client without user interaction
– Malicious web sites (drive by)
– Infection of trusted, popular web sites (IFRAME …)
– Misusing software update functionality (like Bundestrojaner)
– Attacks on vulnerable, exposed computer (network/wireless)
Note: About 1% of Google search query results point to a web site that can
lead to a drive by attack.
UNIVERSITY OF EDUCATION OKARA 7

8. Generic Trojans
• Features of Generic Trojans
– Hide from security tools (anti-virus/personal
firewall)
– Inject code in running processes / drivers /
operating system
– Capture/Redirect/Send data
– Download new configuration / functionality
– Remote control browser instance
UNIVERSITY OF EDUCATION OKARA 8

9. Generic Trojans(cont)
• Features useful for eBanking attacks
– Send web pages of unknown eBanking to attacker
– Download new patterns of eBanking transaction
forms
– Modify transaction in the background (on the fly)
– Collect financial information
UNIVERSITY OF EDUCATION OKARA 9

10. Generic Trojans(cont)
Tips and Tricks
• Every Trojan binary is unique (packed differently)
– Not detectable by Anti Virus Patterns
• Trojan code is injected into other files or other processes
– Personal Firewall can not block communication
• Installs in Kernel
– Full privileges on system
– Invisible
• Bot Networks
UNIVERSITY OF EDUCATION OKARA 10

11. Security Measures
• Attack Detection
• Second Channel / Secured Channel
• Secure Client
Secure Client Second Channel
Secured Channel
Attack Detection
UNIVERSITY OF EDUCATION OKARA 11

12. Attack Detection
• Detect session hijacking attacks
– Monitor and compare request parameters
– Identify SSL Session and IP address changes
• Transaction verification / user profiling
– Statistic about normal user behaviour
– Compare transaction with normal user behaviour
– White list target accounts
– Limits on transaction amount
UNIVERSITY OF EDUCATION OKARA 12

13. Security Measures(cont)
• Second Channel
– Send verification using another channel
– Another application on the client computer
– Another medium like mobile phones (SMS)
• Secured Channel
– Enter data on an external device
– External device can not be controlled by Trojan
– Externel device contains a secret key
UNIVERSITY OF EDUCATION OKARA 13

14. Security Measures
• Secure Platform
– A computer that is only used for eBanking
– Bootable CD-ROM, Bootable USB Stick
– Virtual Machine
– eBanking Laptop
• Secure Environment
– Start an application (eg Browser) that protects itself
from Trojans
– Downstripped Browser
– Proprietary Application (fat client)
– Verify environment before login is possible
UNIVERSITY OF EDUCATION OKARA 14

15. Security Trends
UNIVERSITY OF EDUCATION OKARA 15

16. VISIT A BANK FOR CHECKING SECURITY
• Here I was visit the Habib Bank Limited Renala
Khurd.
• its Branch code is (0557).
• HBL established operations in Pakistan in 1947
and moved its head office to Karachi.
• Having this bank is high alert banking security.
• Here Account verification automatic updates
through Mobile Phone of any other networks.
UNIVERSITY OF EDUCATION OKARA 16

17. • Online Banking security in this bank is very
high alert.
• Protecting from Hackers because its software
is good and removing from all bugs and etc.
UNIVERSITY OF EDUCATION OKARA 17

18. Conclusions
• Here we found in the above slides that the
Banking Security Management/system in Banks at
Pakistan is very high.
• Banks provide security for individuals, businesses
and governments, alike.
• It is prove that banks to be vulnerable to many
risks, however, including credit, liquidity, market,
operating, interesting rate and legal risks.
• Debit cards provide easy access to the cash in
your account, but can cause you to rack up fees if
you're not careful.
UNIVERSITY OF EDUCATION OKARA 18

19. references
• http://en.wikipedia.org/wiki/Online banking
• http://www.rsa.com/node.aspx?id=1158
• APACS: Online banking usage amongst over 55s up fourfold
in five years
• http://www.apacs.org.uk/media centre/press/08 24
07.html
• APACS: APACS announces latest fraud figures
• http://www.apacs.org.uk/APACSannounceslatestfraudfigur
es.htm
• Symantec SilentBanker Trojaner description
http://www.symantec.com/security_response/writeup.jsp?
docid=2007-121718-1009-99&tabid=2
UNIVERSITY OF EDUCATION OKARA 19