Confidential On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank IBA Banking...

ConfidentialConfidential

On-line Banking On-line Banking Risks & CountermeasuresRisks & Countermeasures

By Vishal Salvi – CISO HDFC BankBy Vishal Salvi – CISO HDFC Bank

IBA Banking Security Summit 2009


Agenda

1. Opportunity1. Opportunity2. Threats2. Threats3. Solutions3. Solutions


The Opportunity

OpportunityOpportunity


The Internet


The Internet

Source: Internet World Stats as of Q2 08


The Internet


19 %

72.5 %

73.8 %

5.2 %

63.8 %

26.1 %

68.6 %

58.1 %

70.7 %


The Internet


World Popl. 6.6 Billion

Internet Users 1.46 Billion (22%)

On-line Users584 Million (40%)

Funds Transfer146 Million (20%)


Threats


Infrastructure

Applications

Data

People

So

ph

isti

ca

tio

n o

f a

tta

ck

s

Low

High

Focus of attacks

Time in years

Password Cracking

Website Defacement

Malware

Network Intrusion

Application Layer Attacks

Unauthorised Access

Information Leakage / Theft

Spam Mail

Social Engineering

Phishing

Pharming

Organized

Crime

Disorganized

Crime

Att

ac

ke

rs P

rofi

le

Trojans

Threat Horizon


Threat Horizon


Trend Micro

The Crimeware Landscape


Phishing


Phishing Stats


Other Statistics

Distribution of Attacks by Hosting Method Top Ten Countries by Attack Volume


The Underground Fraud Ecosystem


TechnicalInfrastructure

Cash OutFraudster

The Fraud Supply Chain

HarvestingFraudster

OperationalInfrastructure

CommunicationFraud forum / chat room

Customer Account

Tools Hosting Delivery Mules Drops Monetizing


Cash OutFraudster

Fraud as a Service: “Cut the Middle Man”

OperationalInfrastructure

User Account

Mules Drops Monetizing

FaaS

Tools Hosting Delivery


Trojans

• Phishing/Pharming Trojans• Keyloggers/Screen-scrapers• MITB Trojans• Active Keylogger + Proxy (Botnet) Trojan


Modus Operandi : Harvesting

– Fast-flux networks

Fast FluxFast Flux


Underground Market Place : Credentials for Sale

• Potentially captured via crimeware, given FI & country coverage


Underground Market Place : Credentials for Sale

• An online ad promoting lists of stolen credit cards


Underground Market Place : Herding Mules


Phone fraud services to cash out accounts in USA by taking advantage of inherent

weaknesses in the Call Centers. This can spoof any number in the United States. The

service enables fraudsters to accept incoming calls, posing as the genuine account holder.

Latest Trends : Phone Fraud to cash-out


Chat in the Middle : Phishing Attack attempts to steal consumers’ data via bogus live chat support– Pop-up chat session with online banking customer– Live Chat session with Bank’s “Fraud Dept” looking to validate personal

information for better service• Request information which may be typically be used for challenge questions

– New twist in Phishing attack

Latest Trends : Chat in the Middle


Solutions


Multilayer Protection

Customer Awareness & EducationCustomer Awareness & Education

BankBank CustomerCustomer


Awareness


Anti-Phishing, Anti-Pharming & Anti-Trojan ServiceAnti-Phishing, Anti-Pharming & Anti-Trojan Service


Blocking / Shutdowns



Infection / Update DropCommand & Control Bot-Herder

Less than 25% of infected PCs are protected by AV

applications. Even less effective against

the specific threat.

Anti-Trojan Service

Anti-Trojan Service


Site-To-User AuthenticationSite-To-User Authentication



Authentication



Site-To-User Authentication


Second Factor Adaptive AuthenticationSecond Factor Adaptive Authentication




Strong Authentication



Adaptive Authentication

Fraud Network


Transaction MonitoringTransaction Monitoring





Transaction Monitoring


ConfidentialConfidentialProprietary and Confidential

Transaction Monitoring


Physical, N/W, Application, DB & OS level SecurityPhysical, N/W, Application, DB & OS level Security








Traditional layers of Security


Physical, N/W, Application, DB & OS level SecurityPhysical, N/W, Application, DB & OS level Security






Incident Response, Fraud & Case ManagementIncident Response, Fraud & Case Management


Confidential On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank IBA Banking...

Documents

Transcript of Confidential On-line Banking Risks & Countermeasures By Vishal Salvi – CISO HDFC Bank IBA Banking...