7 ms·

What do you tell business owners to do when accessing their online banking?

• tptacek 13y ago
  Use a machine that is used for absolutely nothing else.
  • bashinator 13y ago
    How many of them actually do?
    • Tomte 13y ago
      Germany's best-selling PC magazine c't periodically distributes "Bankix" on their CD. It's a Linux live system (with permanent storage on a USB stick) geared specifically towards online banking. I believe that quite a few people actually use it. Of course the hardware is the same, but you get a clean single purpose software system.
      • telephonetemp 13y ago
        > Germany's best-selling PC magazine c't periodically distributes "Bankix" on their CD. >I believe that quite a few people actually use it. That sounds like a great attack vector. How secure are factories where discs are pressed? Even without access to the factory you could buy a bunch of magazines and repackage them with compromised CDs.
        • Tomte 13y ago
          Someone would probably notice, checking the DVD against a checksum. Repackaging it seems to be tricky, since the paper inlay is bound in the magazine, it's not just stuck on the cover or whatever. You tear it out at a perforation, leaving part of the DVD cover inside. There are much more exposed attack vectors on online banking users, I would think. And you can always just download the ISO and check it against the hash (and the PGP key).
    • rdl 13y ago
      I've set up VMs for people with their credentials in the VM and nowhere else, and the host firewalled pretty restrictively such that that VM is pretty useless except for banking. I suspect compliance is high on systems like that.
    • deleted 13y ago
      [deleted]
  • jacquesm 13y ago
    And if your bank does not do 2 factor authentication switch to another bank.
    • signed0 13y ago
      Which banks actually do this? I've never encountered one.
      • jacquesm 13y ago
        Both my banks do (European banks, specifically Rabo and ABN/AMRO). These are still not immune to phishing attacks but it's a lot better than TAN codes or some other 'dumb' authentication scheme. Typically these systems work in conjunction with pin-and-chip card, a small piece of hardware that generates the codes and a challenge / response system built into the website you use for the authorization. Separate challenges exist for logging in (read access) and transferring money.
        • eru 13y ago
          What's wrong with TANs?
        • just_testing 13y ago
          Those are common in Brazilian banks as well. At least four of the six biggest (I don't remember about the last two) do two-factor authentication. Another cool thing I've seen in Banco do Brasil was the need to authorize the computer you're going to use in a ATM or in a 1-800. If I recall correctly, they do that with a Java applet. Recently they also launched a common-malware-search-and-destroy application of MANDATORY use in Windows computers (my mom uses, she asked me. And yes, the digital certificates were all valid).
      • majelix 13y ago
        Here's a list of them that use Verisign's VIP: https://idprotect.vip.symantec.com/wheretouse.v https://idprotect.vip.symantec.com/wheretouse.v Others may use in-house solutions. Here's Bank of America's two factor solution: https://www.bankofamerica.com/privacy/faq/safepass-faq.go https://www.bankofamerica.com/privacy/faq/safepass-faq.go We're almost to a point where the question isn't whether or not they support it, it's finding out that they have a program, clicking through tiny text links at the bottom of pages, and figuring out how yet-another-implementation works.
  • skrebbel 13y ago
    Wow, really good idea. Is a VM that is used for absolutely nothing else good enough?
    • AnthonyMouse 13y ago
      How do you define "good enough"? The general idea is to use a machine which has minimal opportunity to be compromised through other activities. There have been known to be exploits that allow a compromised VM guest to compromise the host, and obviously if you compromise the host you can compromise all the other guests. Using a separate VM is worse than using a separate physical machine and better than doing nothing. Whether it's "good enough" depends on who you are. Who are the plausible attackers? What do you stand to lose if it goes wrong?
    • abecedarius 13y ago
      The VM is easily vulnerable to the host OS, so running in a VM only protects the activities you do in the VM in the sense that the software pwning the host might not be looking for it. So not really.
      • nz 13y ago
        Unless you are not using the host OS for anything _other_ than virtualization. If the host OS is used to host VMs[1], which are then used for specific tasks (casual browsing, banking, development, etc). Any exploit will be limited to the VM. This would be a pretty solid setup. It is only vulnerable to attackers that have direct access to the hardware, or have the ability to exploit the hypervisor. [1] in other words if the host OS is used as a hypervisor, or if the host OS _is_ a hypervisor.