Preventing a socially-engineered transaction

Question

Can you explain what this blog means when it says:

Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) and on another channel entirely.

What does keep the entire process off the PC and another channel mean in this context? How would doing so help prevent that kind of attack?

Answer 1

To add to what woliveirajr writes, the technologies that banks are starting to implement to increase the authenticity and integrity of transactions are not foolproof. This is a classic example of a great technology that may have missed a few things in its implementation. Specific to the blog entry, Litan seems to describe that the adversary knew when the out-of-band (OOB) transaction was being initiated and modified data in-flight.

I assume that OOB, in this example, was not a completely separate physical channel. But it's also possible that the implementation of the communication channel included sufficient information for an adversary to modify account numbers without being detected. For example, if the protocol for authorizing a transaction transferred account numbers and the OOB auth device only "proved" the identity of the end-user, an adversary can easily modify the transaction data without the end-user realizing what happened. Again, security technologies tend to break when the implementation sucks.

AFAIK, researchers from Cambridge first published an attack on EMV.

The benefit of OOB exchange increases the difficulty for an adversary to launch an attack. The users' PC might be compromised, but a hardware device may be much more difficult to compromise. The chances of an attacker compromising both the PC and OOB auth device is much lower than the chances of an attacker compromising just the PC. However, poor implementation can easily render additional controls (i.e. OOB) useless and the costs are greater because the users believe they have greater security though they do not.

Answer 2

For what I understood, keep the process off the PC means that the computing part of it must be done in a specific device, not in the browser that is running in the PC, since it's "easy" to use some keylog or affect the computer behavior.

And another channel means that you shouldn't trust just the browser communication, since the described attack simply puts an iframe over the real page and tricks user to insert attackers information in the device, instead of the real one. So, since what the user see in the page (in the moment that the required information to finish the transaction is inserted) is a fake one, banks / industry / security / users shouldn't use the internet - browser channel as a trusted one.