Two-factor authentication for online banking usually
involves passwords and tokens which provide synchronised,
constantly changing numbers to use as additional evidence of
identity.
The security industry has promoted the tokens as a preventative
measure against hacking for users of remote corporate or banking
systems. However, experts have warned that they are still
vulnerable to phishing attacks, where fraudulent emails lure
recipients to bogus websites that are set up to gather security
details.
Four customers who used two-factor authentication have been
compensated by ABN Amro for undisclosed amounts taken from their
bank accounts.
"We are taking this incident very seriously and, in addition to
informing our clients, are also implementing all of the technical
measures that are at our disposal to stop criminals in their
tracks," said Johan van Hall of ABN Amro Netherlands. "Safe usage
of home and office computers is an essential requirement for secure
online banking, and we plan to remind our clients even more
frequently and urgently than before of that fact."
Hackers sent the customers emails falsely claiming to be from
ABN Amro. If recipients opened an attachment, software was
installed on their machines without their knowledge. When customers
visited their banking site, the software redirected them to a
hacker-controlled mock site that requested their security
details.
As soon as the hackers received these details they were able to
log into a customer's account at the real ABN Amro site, before the
expiry of the fob-generated number. They could then transfer the
customer's money.
Security experts have warned that such 'man in the middle'
attacks cannot be prevented by security tokens.
At the E-Crime Congress in London last month, several experts
spoke out about the limitations of the systems. "Even when all the
banks have it [hackers] will still attack them," said Mikko
Hypponen, chief research officer of security firm F-Secure, at the
Congress. "'We see them using 'man in the middle' already."
"There are a whole bunch of things that can go wrong with
two-factor authentication," Ross Anderson, a professor of security
engineering at Cambridge University, told the same conference.
"Banks are resisting because their technical staff know that it
will be expensive to introduce and will not be effective. Some
banks will introduce it, it will be quickly broken and then quickly
forgotten."
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
