2

My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as descibed here and here.

I do not have detailed information regarding the readers used by my bank. What I know is:

  • They can be operated with or without USB cable.
  • The readers are interchangeable, i.e., contain no personalized information associated with my account.

My question is, what I can do to minimize the risk of fraud. My thoughts so far are:

  1. Use Tor for any interaction with the bank website.
  2. Use a Linux installation in a VirtualBox (or other VM), used only for online banking. However, as far as I understand, this would not protect me from key-loggers on my host PC. It is also unclear to me how big the danger due to key-loggers is with a card reader, since the PIN is entered on the reader, not on the PC.
  3. When used with USB connection, a driver on the host PC needs to be used (available only for Windows, so this is actually not an option, also due to the implied decrease of security). On the other hand, as far as I understand the USB connection could be used to get increased security, by displaying transaction-specific information on the card reader, which the user has to confirm. But as I understand from the papers linked above, this is often not properly implemented, so I don't know if the un-connected mode would actually be more secure?
  4. The same cards are used for online banking and for ATM and payment terminals. Thus, it seems that losing the PIN and the information on the chip of the card (through skimming and/or being observed when entering the PIN) will automatically also give attackers access to online banking. Since both my wife and me have a card for the same account, does it make sense to (as far as possible) use one of the cards as the "online banking card" and the other one as an "ATM card"? Would that substantially decrease the risk, or am I overlooking something?

Could you clear up my understanding of the points I described, as well as provide further insight?

Improve this question

2 Answers 2

Reset to default
5

I briefly read the papers you linked to and they expose several vulnerabilities allowing an attacker that can talk to the reader to make it sign transactions/login requests without requiring user consent. However, this isn't a big deal, for an attacker to "talk" to the reader your machine already has to be compromised and if that's the case, no amount of security can protect you.

On the other hand, this smartcard system is actually pretty nice and requires the card to be physically present to make a transaction, making stealing of card numbers useless. IMO, that's how online card payments should've been done from the beginning.

Now, let's go through your checklist :

  • using Tor is unnecessary; you don't need anonymity, and security is already provided by the fact that the bank's site uses HTTPS. Even in the case that their HTTPS implementation is flawed, Tor won't give you any more protection and at this point you shouldn't use their site at all.

  • using a VM on a compromised host is stupid. If your host is compromised, the attacker still has total control of the hardware and can even "talk" to the reader to exploit the vulnerabilities described in the papers you linked. Moreover, you won't be able to install the reader's drivers and browser plugin in a Linux environment.

  • given the papers linked in your question, I'd say offline mode may be more secure. It doesn't display transaction info, but on the other hand, it only allows them to make a single transaction, where as in the connected mode they can exploit a vulnerability to make the card sign an unlimited number of transactions without requiring user consent (as long as the card is in the reader).

  • card skimming won't allow them to make online transactions, as skimming won't steal the secrets in the chip, and this EMV-CAP system relies on the chip to perform crypto operations. The magnetic stripe is never involved. Stealing the PIN may give an attacker the possibility to make payments if they also physically steal your card. - skimming a smartcard chip is impossible.

TL;DR don't use a compromised machine and you will be safe. If you suspect your machine is compromised (because you installed pirated software or software coming from untrusted sources, keygens, shady "video players" or plugins, etc), reinstall it from scratch and be more careful. Finally, even if the machine is compromised, I doubt attackers updated their malware to exploit these readers - it's just not worth it (for now) as simply keylogging card numbers is still a juicy business and they have no reason to devote their time to update malware for the really low number of people who use these card readers.

Improve this answer
4
  • To further Andre's (sorry, don't know how to make the special e) point on the first bullet, technology has emerged that allows infosec personal to either A.) Block Tor users from accessing their websites or B.) Limit the functionality of a Tor user while they are logged into a website. The reasoning is that a typical user does not use Tor, however, nefarious types who want to remain anonymous are more likely to use Tor.
    – k1DBLITZ
    Commented May 16, 2015 at 14:23
  • Your write "skimming a smartcard chip is impossible". According to a quick literature search, does does not seem to be true, see, e.g., here or here. The claim that skimming card with a chip is impossible seems to be what banks nowadays often use to blame fraud on customer error instead of reimbursing them.
    – Simon
    Commented May 16, 2015 at 15:07
  • After more detailed reading, I am not sure whether these attackes on smartcards with chip actually allow for a complete clone. It seems like their skope is more limited, but it is still unclear how this might interact with smartcard readers for online banking.
    – Simon
    Commented May 16, 2015 at 15:20
  • @Simon EMV attacks do exist, however they're rare and mostly get fixed, these cards are nowhere near broken as the magstripe ones are.
    – user42178
    Commented May 17, 2015 at 18:52
0

Treat your personal PC as your banking PC and keep it patched. Never read Email on that PC. Only install Office, Chrome, flash, java on your VM. Redirect all USB drives to that VM.

Don't use USB if possible on your PC, or disable it via GPO

Re #4 - I have no comment on this one...

Improve this answer
3
  • I agree that using Tor is unnecessary, but given that the bank is using HTTPS I see no security risk in this.
    – user42178
    Commented May 16, 2015 at 12:31
  • @André My understanding of ToR is that the SSL connection is terminated at the Exit Node. That node will decrypt your onion traffic and encrypt the SSL traffic. Since it's acting as a bridge, it could see the traffic. I've never done this personally - is this incorrect?
    – makerofthings7
    Commented May 16, 2015 at 12:33
  • Yes, that is incorrect. Tor only relays packets adding its own crypto on top, but if you're using HTTPS, the packets leaving the exit node (and going to the server you're connecting to) are still HTTPS packets and keep their security. Rogue Tor nodes won't gain any more information than standard MITMs in conventional IP networks.
    – user42178
    Commented May 16, 2015 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .