IBM Zone Trusted Information Channel
(ZTIC) CASE
You may have heard of Man in the Middle attacks, meet Man in the Browser attacks (MitB). The term has been around since 2005, but not used much. That's changing, thanks to current crimeware, considered a form of MitB attack. According to Wikipedia, MitB is:

"A trojan that infects a web browser and has the ability to modify pages, modify transaction content or insert additional transactions, all in a completely covert fashion invisible to both the user and host application.

A MitB attack will be successful irrespective of whether security mechanisms such as SSL/PKI and/or Two or Three Factor Authentication solutions are in place."

I covered an instance where crimeware played a part in stealing almost a half million dollars in this post. In my next article, I discussed Zeus and URLZone, possibly the crimeware used in the half million dollar hoist. In this article, I would like to dig deeper into possible solutions.

Protect ourselves
Since it's our money, we need to take the initiative. Doing everything we can to protect our hard-earned savings. Once we have our personal situations in the best shape possible, we can bug the banks to get their act together.

The obviously solution is to not bank on-line. That's a great idea, but what about our service personnel or anyone who cannot physically get to their bank? Besides, we should not have to succumb to cybercriminals. With that in mind, let's look at some of the solutions, you the members have come up with.

I would be negligent if I did not mention one thing first. No solution is fool-proof, especially since crimeware is ever-evolving. That has to temper everyone's decision about which solution to use or if it is worthwhile to bank on-line. Let me know in the comments which if any solution makes sense for you. Here they are:

Use a dedicated computer running only the operating system (if possible not Windows) and Web browser application, no other applications (especially e-mail) should be installed. Make sure the operating system and Web browser are up-to-date. Finally, this computer should only be used to access the required financial Web portals, no other Web browsing.
Install Linux on a bootable read-only media (LiveCD or lockable flash drive) along with a Web browsing application. Use this setup for any banking, financial, or credit-card transaction.
Use a computer with a pristine, up-to-date host operating system. Have one virtual machine (VM) for normal computer functions and another VM setup exactly like the dedicated computer I described earlier. Use that VM exclusively for financial transactions. iPhone I recently read a blog post by Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit of the New South Wales Police Department. He mentions that the iPhone may be immune to existing variants of crimeware. Ironically, it's because of a feature that most users do not like. The iPhone is only capable of running one task at a time. Therefore crimeware cannot run in the background.

What banks need to do
Now that we are protecting ourselves as best we can, let's take a look at what the financial institutions need to do. Two key processes, authentication and verification need to be improved. All involved parties need to be who they say they are. All involved parties also need to know that the transaction taking place is accurate and initiated by one of the authenticated parties.

Authentication
Web sites that deal with finances, money transfer, or credit card transactions need to offer true multi-factor authentication. In the United States, I am not seeing this. If I am wrong, let me know. Is your bank or credit card provider using more than one of the following factors:

Something you know: Such as a password, image, or answers to questions.
Something you have: Such as a one-time password token (SecureID), computer hardware, or a smart-card key.
Something you are: Such as a finger print, retina, DNA, or a verifiable image.
The three factors are listed in order from weakest to the strongest. My bank uses one-factor authentication. First they ask a security question: