Wednesday, 28 October 2009

PhoneFactor Security

I was asked recently to look at the security of the PhoneFactor 2-factor authentication solution. If you don't know what it is, then you can find out more here, but essentially you enter your username and password, then they phone you on your pre-defined number and press the # key to validate the authentication. The problem with just pressing the # key is obvious, but they allow you to configure entering a PIN number rather than just pressing the # key. To my mind, there should be no other option than having to type in the PIN number. However, this isn't necessarily a brilliant idea. As I've said before in this blog, a lot of phones log the digits dialled, in which case that PIN isn't secure.

I was also told that the PSTN and GSM networks are secure, so this is a good solution. I'm not sure I agree that PSTN and GSM networks have good security. Analogue PSTN is easy to listen in to with proximity and GSM can theoretically be cracked, and probably will be within 6 to 12 months. So that PIN number isn't really secure. Plus there is the cloned SIM card problem as well.

http://www.mobileindustryreview.com/2009/08/gsm-encryption-can-be-cracked-for-500.html

Having said that, PhoneFactor looks quite good as you enter the PIN on the phone line, not the login dialogue. The problem that Bruce Schneier has referred to is that of a Man-in-the-Middle attack. Most 2-factor authentication methods are susceptible to a MITM attack, including RSA tokens and other hardware tokens. Basically, if I set up a website, for example, to mimic your corporate portal, then you will enter all your details into my page, including your one-time pass code. I will forward them on to the real portal and do whatever I like logged in as you.

The one advantage is that I have to intercept every login attempt, and wait for you to login before I can gain access. Without a 2-factor system, once I've read your username/password combination I can login whenever I like. PhoneFactor would appear to mitigate some of this risk by doing the authentication out of band. However, there is still an attack vector for a MITM attack. In the same way as before, you login to my portal, I forward your credentials, PhoneFactor phone you and you put in your PIN, they enable my session! Obviously, there are other attack vectors as well.

Another potential issue is that you are charged for the phone calls made by PhoneFactor on your behalf. These can be significant costs. In the UK calls to landlines are free, but am I always at my desk when I want to log in? No, I'd want it on my mobile; that will cost me $0.23 per login (East Timor $3.25). So, I could rack up the bill for you company by getting them to call through to someone. If I do this enough times (especially if that person is on holiday in another country with higher charges) I can use up all your credit and none of your users can login.

There is a privacy issue as well. PhoneFactor will know every time you log in or access your bank, etc. How do they protect that data? Do you want them to know that information, even if you do trust they won't accidentally disclose it?

However, I am not against 2-factor authentication. Indeed I think it is a good thing, as users will choose poor passwords, reuse them everywhere and write them down. Similarly, they will give them away to phishing scams. 2-factor authentication removes all of those problems, but by no means is it absolutely secure. PhoneFactor seems OK, but it's not particularly cheap or phenomenally secure. There are some other good software solutions that are pretty cheap as well, and that can combat shoulder-surfing when entering PIN numbers, etc. There are a couple of examples on a blog post I did a couple of months ago: http://blog.rlr-uk.com/2009/06/user-friendly-multi-factor.html

The bottom line is that they are more secure than username/password, but none of them are absolutely secure against all attacks.

Tuesday, 27 October 2009

Security Questions for your Cloud Services Provider

Comodo Vision Video Blog

Cloud Services or Cloud Computing are getting a lot of attention in IT circles, promising cost-effectiveness, flexibility, and time-to-market advantages over traditional alternatives. However, they also increase your security risk by expanding your security perimeter to include that of your service provider. This video blog poses some key questions to ask your Cloud services/Cloud Computing provider regarding data security as well as advice to reduce the risk to your business introduced by Cloud Computing.

See my third video blog for Comodo Vision here.

Thursday, 1 October 2009

APWG Report 1st Half 2009

On 27th September the APWG released their First Half 2009 Phishing Trends Report. This provides some interesting/worrying reading. Most notably is the rise and rise of rogue anti-malware programs.

Rogue anti-malware programs are programs that run on a user's machine and falsely identify malware infections. They then inform users that the malware can be removed by purchasing their anti-malware program. The installed software, in many cases, does absolutely nothing. The malware author has made their money off the user and doesn't care about them or the fact that their machine is left vulnerable to other malware. However, there is another breed of rogue anti-malware that will install other malware onto the user's machine, often adding them to botnets or adding trojans and spyware. According to Panda Labs' Luis Corrons, rogue anti-malware programs are proliferating with "exponential growth. In the first quarter of 2009 alone, more new strains were created than in all of 2008. The second quarter painted an even bleaker picture, with the emergence of four times as many samples as in all of 2008."

Most of these rogue anti-malware programs have a common root - they even look the same. So how come they aren't detected as malware? Well, often they employ server-side obfuscation so that each version is slightly different, thus defeating some signature-based scans. Also, you have to remember that many of these don't perform any malicious actions and, therefore, don't trigger other alarms.

What can we do about rogue anti-malware? Well, simply don't trust anything on the Web saying that you are infected or that they will scan you for free. Do not install any anti-malware from a company that you do not know and always check for validity of links and downloads. There are many companies out there providing free basic anti-malware or sophisticated products for a relatively low price that are legitimate, such as: Panda Security, AVG, Comodo, Symantec, etc. If you do get infected by one of these programs then you need to remove it. Instructions for removing the most common ones can be found at http://www.anti-malware-blog.com/ - N.B. be warned that I have not assessed or validated their instructions and there is no guarantee that they won't cause other problems.

What about the rest of the report? Well, phishing is still on the increase, with reported phishing highs for the first half of the year exceeding those of last year significantly (about 7%). 21,856,361 computers were scanned to determine host infection rates. 11,937,944 were found to be infected (54%), which is an increase of over 66% from the last quarter of 2008. Banking trojan/password stealing crimeware infections rose by more than 186%. Finally, payment services have taken the top spot in the most targeted industry sector from the financial sector, although this is still a close second. To see how this compares, a previous blog post of mine on this shows how things have changed.

For more information about the Anti-Phishing Working Group, to report phishing attacks or to see their reports yourself, visit http://apwg.org/

Welcome to the RLR UK Blog

This blog is about network and information security issues primarily, but it does stray into other IT related fields, such as web development and anything else that we find interesting.

Tag Cloud

Twitter Updates

    follow me on Twitter

    Purewire Trust