Computer-level logging by financial institutions

Question

I am looking for the best approach to recognizing a specific computer and saving that computer as a "safe" login machine. My intuition points me to using cookies, but what value do I store in there to make sure it's safe? What data do I cross-reference to make sure that cookie wasn't stolen off of another computer?

Some examples of what I am trying to accomplish are the websites of major banking institutions, such as Chase, Bank of America, etc. They seem to remember if a computer is accessing the site for the first time.

I may have stated this problem strangely, but I don't know of any other way to describe it--maybe someone can chime in with the correct security terminology for this technique. Although I'm relatively new to security, I am willing to learn!

Thanks

Answer 1

I'm not certain specifically what methods the banks you listed use for this, but I would do a combination of many things, mostly server side and stored in a database.

Disclaimer: Not any one of these things are by any means fool proof.

• User agent
• First and second octet of IP Address (may not be feasible with dynamic IP, this is still processing in my head)
• Average days of week/time of day user logs in
• Browser cookie containing a random token

These things create a signature of the typical environment a user logs in from. When that changes, we prompt for an additional authentication item.

When a user logs in and one or more of those fields stored in the database doesn't match, I would prompt for the secret phrase, or whatever field you use.

I'm sure there are other ways, and other fields you can store to compare against, these are just a quick few that came to mind.

Answer 2

What some large banks are doing is using products like Trusteer's Rapport - which provides an agent to the user's machine which carries out the confirmation that the machine is 'safe' and hasn't been to any known malicious websites.

There are other commercial, and home-grown agent-based solutions to this problem, but all they do is make the spoofing part of an attack harder.

Many banks do already carry out statistical analysis on network traffic, and not just on payment traffic, in order to more rapidly identify potential fraud, but this isn't so much to identify a particular computer, but to identify behavioural anomalies.