Tools against man-in-the-middle attacks

Overview:

As the techniques of online fraud continually morph and evolve, banks are coming to realize that fraud is not a problem that can easily be contained; it’s an ongoing threat that requires strong and constant surveillance. Fraudsters are relentlessly inventing and reinventing tools to conduct sophisticated real-time attacks, such as man-in-the-middle, man-in-the-browser, and Rock Phish attacks. These kinds of attacks are becoming more frequent in the online banking arena, resulting in a crisis of customer confidence and significant financial losses reaching into the millions.

Man-in-the-middle attacks prey on the difficulty of verifying both the authenticity of a transaction as well as the authenticity of the customer who initiates it. VASCO addresses this security gap with our e-Signature solution, which conveniently operates on the same back-end platform as other VASCO strong authentication solutions and products.

Goal:

VASCO’s unique visual transaction signing and e-signature solutions are designed specifically to help financial institutions combat man-in-the-middle attacks and secure financial transactions. VASCO makes this possible by using data such as account numbers, transaction amounts and timestamps in order to generate an Electronic Signature unique to each particular transaction.

Threats:

A man-in-the-middle attack is an insidious form of eavesdropping in which the attacker is able to read, insert and modify messages between two parties at will, without either party becoming aware that the link between them has been compromised. With a man-in-the-middle attack, user authentication alone is not enough to verify transaction authenticity, since all communications would be conducted via a spoofed website managed by the hacker (the “man-in-the-middle”).

Approach:

Best Practices recommended by VASCO in order to combat man-in-the-middle attacks:

• Use of one-time passwords for user authentication
• Use of electronic signatures for transaction authentication
• Use of host authentication
• Use of multiple channels
• User education