E-Banking Transaction Authorization - Common Vulnerabilities, ...
summary
Reviews over 50 penetration tests and live deployments and finds concrete failures: transaction details are not bound to authorizations so SMS codes and time‑based OTPs let malware swap recipient or amount; account‑change flows accept new numbers without confirming the old; POST parameter sequencing lets an attacker override an authorization step; SHA1‑based signing is misused and vulnerable to race attacks; connected card readers without pinpads and Tinba malware enable automated transfers. Recommendations are transaction‑specific signatures, physical user confirmation and authorizing credential changes via current channels like external pinpad.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:02Wojtek Dworakowski
- 4:02Operation authorization methods
- 6:20IDEAS ARE GREAT
- 7:23What's wrong with these?
- 10:23SMS number change
- 13:01Example #3
- 13:19Step 1: User enters transaction data
- 13:52Step 2: User enters authorization data
- 15:39Transaction signing' using SMS code
- 17:26What could possibly go wrong?
- 19:43Malware VS operation auth ex1
- 21:45Recommendations
- 22:20Malware VS operation auth ex 2
- 26:03Requirements for implementation / verification
- 26:45Future work
related talks
32mSecurity horror stories in payments
59mHow Smartcard Payment Systems Fail
46mFixing authentication and authorization
06mHuman-in-the-Loop for Secure Digital Wallets Transactions
42mChallenges in User Authentication: Balancing Security & User Experience
57m(In)Security of Mobile Banking
35mEveryone can see your credit card details
37mFirst Contact - Vulnerabilities in Contactless Payments