Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can you explain what this blog means when it says:

Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) and on another channel entirely.

What does keep the entire process off the PC and another channel mean in this context? How would doing so help prevent that kind of attack?

share|improve this question
Another channel can be a so-called token, or an sms to your cell phone. – Louis Somers May 21 '12 at 20:56
up vote 1 down vote accepted

To add to what woliveirajr writes, the technologies that banks are starting to implement to increase the authenticity and integrity of transactions are not foolproof. This is a classic example of a great technology that may have missed a few things in its implementation. Specific to the blog entry, Litan seems to describe that the adversary knew when the out-of-band (OOB) transaction was being initiated and modified data in-flight.

I assume that OOB, in this example, was not a completely separate physical channel. But it's also possible that the implementation of the communication channel included sufficient information for an adversary to modify account numbers without being detected. For example, if the protocol for authorizing a transaction transferred account numbers and the OOB auth device only "proved" the identity of the end-user, an adversary can easily modify the transaction data without the end-user realizing what happened. Again, security technologies tend to break when the implementation sucks.

AFAIK, researchers from Cambridge first published an attack on EMV.

The benefit of OOB exchange increases the difficulty for an adversary to launch an attack. The users' PC might be compromised, but a hardware device may be much more difficult to compromise. The chances of an attacker compromising both the PC and OOB auth device is much lower than the chances of an attacker compromising just the PC. However, poor implementation can easily render additional controls (i.e. OOB) useless and the costs are greater because the users believe they have greater security though they do not.

share|improve this answer
"But it's also possible that the implementation of the communication channel included sufficient information for an adversary to modify account numbers without being detected.": OK thanks that's rational explanation :) – user310291 May 26 '12 at 17:52

For what I understood, keep the process off the PC means that the computing part of it must be done in a specific device, not in the browser that is running in the PC, since it's "easy" to use some keylog or affect the computer behavior.

And another channel means that you shouldn't trust just the browser communication, since the described attack simply puts an iframe over the real page and tricks user to insert attackers information in the device, instead of the real one. So, since what the user see in the page (in the moment that the required information to finish the transaction is inserted) is a fake one, banks / industry / security / users shouldn't use the internet - browser channel as a trusted one.

share|improve this answer
well that user already uses a smartcard reader so isn't it such other off pc channel ? – user310291 May 26 '12 at 17:50
Yes, there are many "off pc channel": sms, voice calls, a pre-printed card that have some codes (think off gmail two-factor pre-generated codes), cell phone apps, one-time password tokens... – woliveirajr May 28 '12 at 12:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.