I find it very strange that bank use service like SiteKey without user-agent identification. This still makes them very vulnerable to MitM attack which is exactly what they are trying to protect against with this technique.
How a man in the middle attack works against an online bank. The user communicates with the the phisher, while believing that she is speaking to the bank. The phisher can use deceit to query the user for more information than the bank would normally ask for. Using this additional information, the phisher can communicate with the bank, while pretending to be the user.
I was wondering if using user-agent identification would help against MitM attack.
The idea behind user-agent identification is that it's a secret that is known to the user-agent, like the browser, but it not known to the user. This makes a difference because the user-agent will only send his secret to the real website, while a user might write down his secret to any phishing site.
An example would be to set a cookie to identify the browser via a link sent in an email to that user. When the user access the link, it sets a cookie for the site it wants to log in.
Then, when the user want to log in to that site, the site check if the browser the user is using have that specific cookie.
If he does, then the site show the SiteKey phrase and picture. If he doesn't, then the site ask the user to identify it's browser.
- User : The person trying to access a website. Example : you
- User-agent : It's the tool that the user use to access a website. Example : a browser
- User-agent secret : Something that is known by the user-agent, but not necessarily by the user. Example : a cookie
- User-agent identification : The process by which the website the user is trying to access validate that a specific user-agent is authorized to access this website under that specific username. Example : by validating that a cookie containing a secret code associated to the username is set on that browser
SSL/TLS : Of course you need that since there is no security without it...
Why do we need to set the cookie by an email link?
If you read about SiteKey, you will find out that they are indeed trying to do user-agent identification using a cookie! But they are failing...
Why does BoA allow users to get access to their SiteKey image after answering her security questions? The reason is simple. Normally, BoA knows to present the right SiteKey image to a user because it recognizes the computer that user logs in from as belonging to the user in question. This is done using secure cookies. But what happens if there are no cookies? Say that the user wants to log in to her BoA account from a computer that she has not successfully used to connect to BoA's website with before. Before sending the SiteKey image to the user, BoA will require the user to provide some evidence of her identity - the answers to the security questions. Once BoA receives these, and has verified that they are correct, then it will send the user's SiteKey image to the user. That allows the user to verify that it is really communicating with BoA, and not an impostor, which in turn, provides the user with the security to enter her password.
The problem is that the way to prove the user identity is by asking him a question... The phishing site can then directly ask this question to the user and it's game over.
It's different if the cookie is set by a link in an email. If the website doesn't recognized the broswer, it will send an email to the user. This means that unless the attacker, the phishing site, has access to the user email, he cannot set the cookie hence he cannot impersonate the user.
It's also important that the cookie is set by visiting a link and not by writing a secret code that you receive by email. If you can't trust the user to enter his password on the right site, can you trust him to enter the code on the right site?
Other interesting links