# Detection of Substitution attack on Block Cipher ECB mode

This is from Christoff Paar's book on Cryptography

Let’s assume a protocol for wire transfers between banks (Fig. 5.2). There are five fields which specify a transfer: the sending bank’s ID and account number, the receiving bank’s ID and account number, and the amount. We assume now (and this is a major simplification) that each of the fields has exactly the size of the block cipher width, e.g., 16 bytes in the case of AES. Furthermore, the encryption key between the two banks does not change too frequently. Due to the nature of the ECB, an attacker can exploit the deterministic nature of this mode of operation by simple substitution of the blocks. The attack details are as follows:

1. The attacker, Oscar, opens one account at bank A and one at bank B.
2. Oscar taps the encrypted line of the banking communication network.
3. He sends \$1.00 transfers from his account at bank A to his account at bank B repeatedly. He observes the ciphertexts going through the communication network. Even though he cannot decipher the random-looking ciphertext blocks, he can check for ciphertext blocks that repeat. After a while he can recognize the five blocks of his own transfer. He now stores blocks 1, 3 and 4 of these transfers. These are the encrypted versions of the ID numbers of both banks as well as the encrypted version of his account at bank B.
4. Recall that the two banks do not change the key too frequently. This means that the same key is used for several other transfers between bank A and B. By comparing blocks 1 and 3 of all subsequent messages with the ones he has stored, Oscar recognizes all transfers that are made from some account at bank A to some account at bank B. He now simply replaces block 4 — which contains the receiving account number — with the block 4 that he stored before. This block contains Oscar’s account number in encrypted form. As a consequence, all transfers from some account of bank A to some account of bank B are redirected to go into Oscar’s B account! Note that bank B now has means of detecting that the block 4 has been replaced in some of the transfers it receives.
5. Withdraw money from bank B quickly and fly to a country that has a relaxed attitude about the extradition of white-collar criminals.

I don't understand the part which I have bolded. How does bank B have a means of detecting that block 4 has been replaced?

• Same money transfer again and again. It is not Cryptographic... – kelalaka Sep 10 '20 at 7:04
• The answer to this question doesn't actually involve cryptography so much as it involves the bank's own auditing procedures; ECB provides no real means of tamper-detection, since it's not authenticated encryption. If it did this attack would be impossible; but the bank's audits can relatively easily detect such tampering. – Serpent27 Sep 10 '20 at 7:16
• To be clear, this example is entirely fictional; real bank systems don't work this way, they have strong authentication and unique identifiers for everything (usually several per transaction) – dave_thompson_085 May 7 at 2:25

## 1 Answer

This isn't a question of cryptography, but of auditing. Bank A and Bank B both keep records of the transactions they've performed. Eventually, they're going to compare notes and realize that the two sets of records don't match. Specifically, Bank B has a collection of transactions that transfer money into Oscar's account without counterpart transactions on Bank A's side, while Bank A has a collection of transactions that transfer money into non-Oscar accounts at Bank B without counterpart transactions on Bank B's side. Since the dollar amounts of the mismatched transactions are identical, that's strongly suggestive of Oscar tampering with the transfer stream.

• For real banks 'eventually' would be end-of-day reconciliation at the latest, and possibly earlier. – dave_thompson_085 May 7 at 2:26
• @dave_thompson_085, I'm not sure end-of-day reconciliation would catch it. In isolation, Bank A's books balance (every decrease in an account's balance is matched by a transaction sending money to Bank B), and Bank B's books balance (every increase is matched by a transaction receiving money from Bank A). It's only when you compare the two that you can find a mismatch. – Mark May 7 at 2:33
• The networks banks nowadays use for funds transfer, like FEDwire and ACH, reconcile daily and may have 'daylight' checks as well. – dave_thompson_085 May 9 at 7:51