Internet banking safe?

[nairi]

I'm sure you've all heard of banking and transferring money via the internet. Recently Dutch banks introduced this new external apparatus, with which you can bank via the internet.

 

My question is, how safe is banking via the internet? What are the advantages and disadvantages?

 

Hope to hear as many insights as possible.

 

Nairi

[Sip]

What external apparatus?

 

In the US, banking at home using the PC and the internet has become very popular and it is pretty safe. I have to be honest that I do not know too much about current European security standards but the security standards used by the banking here in the US are very strong.

 

In the US, the best bet is to use "128-bit encryption". That is used by almost all banks although some still allow 40-bit encryption (which is much easier to break). Most new browsers (US versions) fully support this 128-bit standard.

 

If you are interested to know more about the security and how this "public key cryptography" system works, I'd be glad to explain. It's a VERY clever system!!! Also, if you have any more details on this "apparatus" and what encryption systems they are using, then I'd probably be able to say more. Other than that, common sense always helps:

 

1) Try not to do any confidential and secure stuff (like online banking) from untrusted computers (such as in internet cafes or public libraries).

 

2) Use the 128-bit encryption if available. Don't rely on 40-bit!

 

3) Never do it over wireless. As of now, all standard wireless security systems have been broken!

 

4) Don't be too paranoid though. It is easier for someone to glance over your shoulder at an ATM machine and steal your code than to do it over the net (even with 40-bit encryption).

 

As far as advantages/disadvantages: I only see advantages! It's easy, it's convenient, it's relatively secure, it's fast (usually ), you don't have to put up with long lines at the bank, you can see activity on your account much faster and more often than having to go and check at an ATM or wait for the statements to show up in the mail, etc etc.

 

Anything unclear, please ask!

 

[ September 04, 2002, 04:58 AM: Message edited by: Sip ]

[nairi]

http://www.abnamro.nl/

 

Look under the heading Internet Bankieren. I couldn't find a bigger picture. It's called an e.dentifier. You put your bank card in it and type some irrelevant number on the internet, which allows you to proceed with banking. How do you bank in America?

 

How can I find out what encryption my bank uses? The bank wouldn't give me that type of information if I asked, would it? (There was nothing about this on their site). And what exactly are browsers (finally a good opportunity to ask someone!)?

 

Also, what do you mean by pretty safe? Isn't it true that criminals evolve with the "cures"? How long will it take before 128-bit is as easy to break as 40? What do you think?

 

I am actually interested to know more about this, if you don't mind.

 

Thanks! Any more? I'm very ignorant in computer/internet affairs.

 

Don't blame me. You asked for it!

 

Nairi

 

[ September 04, 2002, 07:20 AM: Message edited by: nairi ]

[Sip]

First of all: Browser ... it's just a term used to describe a program you use to view pages on the world wide web (www). So the thing you have on your screen right now reading this ... that's the browser. In order to do online banking on the internet, most likely you will use the browser to access their site. Thus, the browser needs to support the encryption method the bank uses for communicate with you. Since you have a Mac, I don't know what browser you have ... on the PC, almost everyone now uses "Microsoft Internet Explorer".

 

Re the Apparatus: By looking at that microscopic picture and the funny lookin words on the page (Dutch ) I am guessing that it is either a simple card reader or the more likely thing is that once again you guys in Europe are ahead of us in the US: meaning those cards that you have are actually some type of "Smart Cards". Smart Cards have microchips in them and are supposedly far more secure than the old magnetic code type cards.

 

Most banks use the typical username/password type authentication. My bank asks for "social security number" which is basically a 9-digit ID that most people in the US have (everyone should I think) and then a usual password.

 

Ah hah! You got me. Yes, "pretty safe" doesn't mean much in absolute sense. What it means is that relative to other existing methods, it is just as safe or safer. Criminals do evolve for sure ... computers get faster and faster ... however, just by brute force, it is very hard to break the 128-bit encryption. With just 100 bits, there are more than "1 with 30 0s after it" possibilities for your "key" that a criminial may have to check one-by-one in order to break into your communication with the bank. For now, there is not much choice other than checking one by one. It may take "2 with 13 0's after it years" with current computers to check all those possibilities for your password basically (i'll explain later).

 

Theoretically, no one has been able to mathematically find any flaws in these encrytpion systems. However, this does not mean there is NO way to break it. It could just mean that no one has found it yet! But I am fairly confident in the current systems ... they are good.

 

So what I am trying to say, is that the communication between you and the bank through the internet is relatively secure. But at the end, the weakness comes in the weakest part of the whole system ... which is usually at the user's. The criminal may try to fool you into entering your information in a fake site which looks just like the bank's site! Or she may try to pretend to be you through some other means ...

 

Any security system can eventually be broken as history has shown time and time again. But as I said before, just keep in mind that it is much easier for the criminal to steal your purse, beat you up, or look over your shoulder at an ATM than to break the encryption systems used in online banking.

 

 

Mind? not at all ... this is one of the few things I could possibly help with a bit for a change

 

I'll definitely try to explain the basics without getting into the math. Since this post got a bit long, for now maybe it's good to take a look at the "coin toss" problem we talked about in the math thread HERE (page 5). Look for: How can two people do a "coin toss" on the phone ... and for it's solution down the page. It'll get you thinking about how you can trust what the bank tells you and vice versa! Don't worry about the math too much.

[nairi]

Thanks.

 

How do you know I have a Mac?? You're freaky! What else do you know about me???

 

I use Microsoft Int Explorer btw.

 

This whole online banking thing is quite new here and a number of people have tried to convince me to do it as well. That's why I want as much info as possible from experienced people (i.e. Americans) before I do.

 

Okay, I'm beginning to trust the system, but I still have this strange gut-feeling about it. For instance, how would I be able to tell that it's not my real bank's browser and that someone is trying to fool me?

 

I don't get it. What if the person tossing the coin is cheating with the factors, thus giving you the wrong calculation. For instance, instead of multiplying two numbers (for heads), the person multiplies 3 numbers and fools you into believing that he tossed tails. Or am I seeing it wrong?

 

Thanks for taking the time to help me out.

 

Nairi

[Sip]

I know a lot more than you think After carefully analyzing your posts so far, here's what I think about you (note I am going to be totally honest so sorry in advance):

 

You have a need for other people to like and admire you, and yet you tend to be critical of yourself. While you have some personality weaknesses you are generally able to compensate for them. You have considerable unused capacity that you have not turned to your advantage. Disciplined and self-controlled on the outside, you tend to be worrisome and insecure on the inside. At times you have serious doubts as to whether you have made the right decision or done the right thing. You prefer a certain amount of change and variety and become dissatisfied when hemmed in by restrictions and limitations. You also pride yourself as an independent thinker; and do not accept others' statements without satisfactory proof. But you have found it unwise to be too frank in revealing yourself to others. At times you are extroverted, affable, and sociable, while at other times you are introverted, wary, and reserved. Some of your aspirations tend to be rather unrealistic.

 

So now tell me how accurate you think that was ... on a scale of 1 to 10 (1 being "not even close" and 10 being "extra freaky" )

 

Let's say you are tossing the coin. I pick my factors (either 2 or 3), multiply them together, and tell you the answer first. There is no easy way for you to check if I multiplied 2 numbers or 3 numbers to get that answer.

 

So now you flip the coin and tell me the answer. That is when I reveal if I had use 2 numbers or 3 numbers.

 

For you, it is easy to "check" since you can ask for those factors. If I say I had multiplied 2 numbers, I better be able to give you 2 numbers that when multiplied together give you the answer I started off with. The cool thing about prime numbers is that if I multiplied 3 numbers together, there is no way someone can find 2 numbers and multiply them together to get the same answer! So there is no way to cheat in this system. Did I make any sense?

[Azat]

Sip jan, Do you need us to show you how to turn on the "browser and browser version" fields on the extended logs so you can tell the OS and Browser and browser version of the visitors of your site? You are the devil.

 

By the way. I say your previous paragraph matches me at about an 8. You should be a psychic. You must have pms, errr, I mean esp.

[nairi]

[Sip]

Yes. You are running Internet Explorer version 5.14 on your PowerPC

 

By the way, I copy/pasted that "analysis" from THIS SITE. I am having trouble remembering exactly where I saw that first ... I have a feeling it was here but I am not sure. Azat do you remember anything like that posted on here? (I searched but no luck)

 

Things like typing an address incorrectly or following a link to a website which looks like something you want but is actually a fake ... most of the time, if you look at the actual address on the browser, you will be able to tell where you are.

 

For example if you somehow forget the y when you want to go to yahoo.com, you will end up in a completely different site. Now if they wanted to trick you, they could put something up that looks just like yahoo.com and then you would type your password to log in!!!!! To make matters worse, they would actually redirect you to the real yahoo site and you would continue without even knowing your password was stolen

 

So here, basically the user got fooled into giving the information away. This has been done quite successfuly in the past and is pretty easy. It's up to you to be careful.

 

Theoretically, they could even hack into some servers on the net and redirect the traffic from the bank computers to their own computers. Thus, even if you went to the correct site, you could be redirected to the criminal's site without your knowledge. Stuff like that may and sometimes do happen but are very difficult to do and easy to detect/catch by system operators. You can be sure most monitor things continuously ... after all, it is their ass they are trying to protect.

 

The other thing is that with this "public key cryptography", no one can decode the stuff you send from your computer to the bank except for the bank! Even you yourself would not be able to decode it on your computer!!!!

 

Basically, the best you can do is to ensure your own computer's "security" by taking basic precautions. Details of that we can discuss too (maybe a different thread ?). If your home pc is hacked, there is not much you can do! The hacker can observe all that you do. But that is not an "online banking" risk ... that is more of using the pc risk and of course there are ways you can protect yourself.

 

The rest, is the job of the internet service providers that you rely on for service.

 

They definitely would. If they don't then you should suspect that! After all, you are trusting them with your money so the least they could do is tell you how they protect it.

 

I still have not forgotten that I promised to explain how the encryption between the customers and the banks works. For now, assume that the communication between you and the bank are very secure, as long as you know what you are doing... for example, as long as you don't just give your password away or do "online banking" on a computer that is easily monitored by some stranger like in a public place.

 

[ September 05, 2002, 02:55 AM: Message edited by: Sip ]

[nairi]

[nairi]

[Sip]

Too simplistic That is one of the beauties of public key cryptography. Everyone knows how it works... and it works!

 

Like that coin toss problem ... even when everyone knows exactly how it works, there is no way to cheat in the system! You are forced to be honest. What makes it happen? The fact that you can multiply numbers and get the answer very easily but knowing the answer you can't just go back and figure out the original factors.

 

I guess I'll start the "security" thread ... hopefully there will be others who will give inputs too.

 

Throughout all this ... please keep in mind I am in NO way a security expert! I have also not been too fascinated with the rediculous "hacker" mentality so I am usually not up-to-date on the latest and greatest of how one can break into things. Actually, my computers have been hacked once or twice before and the bastards try continuously to get in so that is the only reason I have had to brush up on a few things (and probably not enough).

[nairi]

How were you able to tell that your computers were hacked? And how can you tell that they're trying to hack it now? And what can you do to reverse it, i.e. get rid of the hackers?

 

Nairi

 

---

The answer in THIS THREAD --Sip

 

[ September 05, 2002, 01:39 PM: Message edited by: Sip ]

[Azat]

This is the first time I see this site. It was probably on anoother forum. But I like it.

[Garo]

Computer expert says can break Microsoft security

By Peter Andersson

reuters.com

 

STOCKHOLM, Aug 26 (Reuters) - Software security widely used for Internet banking and e-commerce can be easily circumvented, and customer accounts at several of Sweden's largest banks remain at risk as a result, a computer expert said on Monday.

 

The Swedish hacking expert, who is well known in computer security circles, but asked not to be named, demonstrated to Reuters how it was possible within minutes to break through security on Web server software from Microsoft Corp. MSFT.O .

 

The expert showed how to crack the security systems for Internet banking, breaking into three of Sweden's big four banks in quick succession. He was then able to show how to conceal his tracks, making detection difficult afterward.

 

While stopping short of breaking into customer accounts, the hacker-turned-consultant said an intruder could have hidden instructions to transfer sums into a separate account when the customer authorises a payment from his Internet bank account.

 

He relied on a variation of a weakness that came to light two weeks ago in Microsoft's implementation of Secure Socket Layer (SSL), an industry standard for transmitting credit card numbers and account passwords via the Web.

 

"It's a protocol which is very easy to break through," the computer expert said, adding that, "The protocol doesn't provide the security the users think it does."

 

The attack technique exploited a combination of vulnerabilities over which Microsoft exerts only partial control. A large share of the blame should fall on network administrators inside banks and other organizations who fail to install Microsoft's software properly, he said.

 

Using the method, an attacker can log in as a Web site customer using certificate authentication and gain access to the Web site's root directory and, from there, enter the organization's internal network.

 

MICROSOFT AND BANKS DOWNPLAY IMMINENT THREAT

 

Microsoft has responded to recent reports about the SSL flaw by admitting its existence, saying they are working to develop a fix, but also by downplaying the notion that the flaw poses any widespread security threat.

 

"Such techniques are difficult, temporary, and generally require favorable network (layout)," the company states on a Microsoft technical discussion site located at http://www.microsoft.com/technet/default.asp

 

Microsoft in Sweden denied that SSL could be breached in the way shown to Reuters.

 

"I can't even see the theoretical possibility for it to happen", said Mats Lindkvist, responsible for security at Microsoft in Sweden.

 

The unnamed expert said an attacker could breach security via hundreds of computers, making detection of the criminal almost impossible, as it might take the police up to four to five months just to follow a trail through 10 computers.

 

Mike Benham, the San Francisco privacy advocate and security consultant who first revealed the SSL flaw, offered a technical description of how this works: "An attacker could transparently proxy (invisibly transfer) a victim's traffic to the real secure site, while intercepting and logging all the data."

 

Microsoft embarked earlier this year on what it called a "trustworthy computing" campaign to improve the security of its software. The company was responding to a mounting outcry over widely publicized software security breakdowns.

 

The four Swedish banks are not unique. According to computer experts, many of the world's major financial institutions are similarly vulnerable because they rely on software using the industry-accepted SSL protocol.

 

All four major Swedish banks said they were not aware of any break-ins into their systems. But spokesmen at some of them said no system could be perfect.

 

"If man can fly to the moon, sooner or later someone will be able to circumvent the security systems," Swedbank's head of press relations, Jesper Berggren, told Reuters.

 

"As far as I can tell no system will ever be 100 percent secure. To say that our systems are 100 percent secure would be presumptuous," added Handelsbanken's information director, Lars Lindmark.

 

TIP OF THE ICEBERG

 

But computer experts say banks remain highly vulnerable.

 

"There's been a lot of denial," said Peter Neumann, principal scientist at Silicon Valley think-tank SRI International and one of the world's authorities on computer security.

 

Such flaws result from a mix of fatalistic acceptance and technical ignorance, he said. "'Everything is fine,' banks say. That's clearly nonsense. Pretty much everything is vulnerable -- certainly more so with a little bit of insider knowledge."

 

Computer security expert Lars-Olov Guttke at Swedish security firm Deprotect said his company had managed to use hidden instructions to transfer tens of millions of dollars from an account at a leading European bank.

 

The bank had asked Deprotect to test its security systems.

 

After two weeks, Guttke told the bank about the transfers, which had not been detected. The key factor was that the sums transferred secretly were not big enough to alert the system.

 

"It might take a few days to figure out how to make the intrusion, but once you've done that it doesn't take very long to break through the systems," Guttke said.

 

Guttke said banks spent huge amounts to secure their customer-facing systems but tend to neglect internal systems giving access to their networks. Security veteran Neumann agreed, saying that former insiders may pose a bigger threat.

 

Information about the level of computer-related crime is scarce because few crimes are reported. Companies fear bad publicity and additional costs if the weaknesses of their security systems become known.

[Sip]

Very interesting stuff Garo!

[nairi]

Indeed!

 

So how do you guys feel now? Should we still trust internet banking or not?

[Azat]

I have no problem banking online. Banks in US will refund ALL the money that anyone will ever take out of your acount. About 6 months ago someone wrote check for 3500 at circuit city in a different name but same account number of my friends account. The bank refunded their money within 2-3 days.

 

I feel that Online banking is very safe even after reading the news release that Garo posted.

[Sip]

Oh yah! I defnitely still would. Doesn't matter how "easy" it sounds to break into stuff on the net, it is probably not easier than someone punching you in the face on the street and running off with your bag.

 

Plus, what would they have to gain by targeting me? I'll worry about it when I actually have something that a criminal would like to have ... ah yes, the beauties of being a grad student slave

 

Also, keep 2 things in mind:

 

1) "Hackers" or "Hacker-wanna-bes" always have the tendency of saying things like "oh it's so easy because I am so cool" when in reality, most of them are nothing but 2-nd rate losers (the really good ones are VERY good though ... but they are very few in numbers) and

 

2) News reports like that usually tend to exagerate things for the shock effect. How many times have you heard on the news an Asteroid was going to hit the Earth?

 

Don't get me wrong, there have been some pretty horrible security disasters before and there will surely be more (like that Microsoft SSL thing) ... you just have to look at the chances of things happening.

 

[ September 06, 2002, 03:26 PM: Message edited by: Sip ]