Internet banking fraud

I have a suggestion whereby the banks could counter internet banking fraud, which I would like to run past any experts in the field who might be on this forum..

As I understand it, much of this fraud results from criminals installing Trojans on computers and then harvesting PIN numbers. It seems to me that this could be countered as follows: When you log in, the bank's computer would generate a random 4-digit number that was smaller than your PIN number, and display it on your screen. Then, instead of entering your PIN number (and thus revealing it to a Trojan), you would enter the number that was the difference between the randomly-generated number and your PIN number. e.g., if your PIN number were 6464, and the randomly-generated number was 4797, you would enter 1667 (6464-4797). In this way it would be impossible for a keystroke-reading Trojan to harvest your PIN number.

I am not sure, though, whether a Trojan would be able to read the randomly-generated number sent by the bank's computer. If so, my idea would be ineffective, of course.

Rocker

But I want to check if my balance has risen over $4 quickly and it would take hours to do those sums on my abacus.http://www.woodworkforums.ubeaut.com...ons/icon10.gif

G_mick,

Maybe the banks could also just accept the PIN number for people who were too brain-damaged, or could not be bothered, to do the subtraction, on the understanding that such people would not be compensated, if their PIN number was stolen by a Trojan.

Rocker

Rocker, some years ago my bank used an on screen key pad for entering the pin. A keypad would pop up on your screen you then entered your pin by clicking the appropriate buttons with the mouse. This means that no numbers are directly entered or logged on your computer. Every time you logged in the keypad would be in a different spot on your screen so it was difficult to work out what was being entered by the cursor postion.

For some reason they stopped using this system.

Commonwealth Bank's Netbank used to work that way.

Now they put up a code table. You type the corresponding letter from the code table for each number in your PIN. The code table is different each time you log in.

Rocker thats a pretty difficult thing to do, what if your PIN was alphanumeric or 8-10 numerals?

Also not sure what you meant by logging in... did you mean getting into the PC or the website or actually logging into the service... because if you meant the latter obviously the PIN needs to be in already... and hence still exposed to the trojan.

A much safer thing to do although albeit not the most convenient is only use your computer for banking and make sure that it is up to date with firewalls, etc

As I have had reinforced in a discussion today, "random number generators" aren't actually generating numbers randomly at all. They are merely generating numbers in a complex sequence or algorithm.

In the course of our business we regularly transfer rather large sums of money, and the bank concerned has taken not of Rocker's advice.

It has issued each of the signaturies (sp?) of the account with a little RNG (random number generator) which is tuned exactly to a parallel generator back in some dark room at the bank. The numbers change every two minutes.

When a transaction is made, there is a two minute time frame to log in the number, do the business and get out.

So now all you need to do is hijack the bank's one, be online at exactly the time the transaction is occurring, and do your criminal business in what's left of the two minutes I guess.

Cheers,

P

being in the industry im in' I can attest that after the holocaust the only survivors will be telco's, banks & cockroaches. :D

Quote:

---

... "random number generators" aren't actually generating numbers randomly at all. They are merely generating numbers in a complex sequence or algorithm.

---

Interesting point that. Given the same seed, a computer will always generate the same sequence of 'random' numbers. It is the seed that contributes the random aspect to the algorithm. Most computers would use something from the time and date or a 'random' location of memory as the seed. If you can generate the same circumstances, you could conceivably generate the same 'random' numbers.

Those gadgets have been around for a while but are only available to 'certain' clients - ie. the ones who will make the bank lots of money. Fell privileged, Midge. ;)

BTW the 'bank's one' would be a black box in a modem cabinet in the comms room. If you can get in there to hijack it, you probably wont need it ;)

I can feel this thread touching on encryption... Did anyone watch that show on Aunty that discussed military encryption /maths /etc some time back ? I remember the host mentioned (dont know if this is true) that commercial encryption by law lagged military encryption by 20 or 40 yrs - cant remember exactly the time frame..... I dare say in the computer age this may have shortened by definition if not by law.

Quote:

---

Originally Posted by silentC

Those gadgets have been around for a while but are only available to 'certain' clients - ie. the ones who will make the bank lots of money. Fell privileged, Midge. ;)

---

Ohhhh yeah.... we make the banks LOTS of money, but it doesn't feel like a privilege?? :confused: :confused: :confused:


P :D

SilentC,

It seems then that the present Commonwealth Bank system is a rather more sophisticated implementation of my idea. I can't understand why Westpac doesn't adopt the same system. They still just get you to enter an unencrypted PIN number :(

Rocker

That typo of mine was a bit Freudian:

Fell: adjective fierce; cruel; dreadful: *She thinks a man goes out with a girl for one fell purpose. --SUTTON WOODFIELD, 1960. 2. destructive; deadly: fell poison; fell disease.

The 'strength' of encryption is generally spoken of in terms of bits eg. 128 bit encryption. This describes the length of the keys that are used to perform the encryption. The longer they are, in essence the more permutations there are for an encryption breaker to go through. Given time, all two-way (reversible) encryption can be broken.

There are types of encryption that cannot be broken (hashing) but they are not useful for information exchange because the original message cannot be restored even by the encriptor. These are used for example to encrypt passwords stored in databases. The only comparison ever done is between the encrypted version in the database and the encrypted version of what the user typed in, so it is not necessary to be able to un-encrypt it.

For a long time, the US would not allow the stronger encryption (larger keys) to be exported outside the States. As far as I know that has now been reversed - but probably only because they found something better to use.

Quote:

---

Originally Posted by routermaniac

Rocker thats a pretty difficult thing to do, what if your PIN was alphanumeric or 8-10 numerals?

Also not sure what you meant by logging in... did you mean getting into the PC or the website or actually logging into the service... because if you meant the latter obviously the PIN needs to be in already... and hence still exposed to the trojan.

A much safer thing to do although albeit not the most convenient is only use your computer for banking and make sure that it is up to date with firewalls, etc

---

RM,

When you log on to Internet Banking, you first enter your login-ID, i.e. your customer number, which tells the bank what PIN number to expect. You then enter a 4-digit PIN number. It is not alphanumeric, and is always 4 digits.
However, as SilentC has explained, the Commonwealth Bank already uses a more sophisticated version of my idea. I just wish all banks would.

Rocker

Does anyone else long for the 'good old days' when secure banking meant you had a large, steel bound oak box in the basement, liberally wrapped with heavy chain interlinked with large padlocks, all capped off with a very large, very hungry and bad tempered mongrel dog.

Sigh
Richard

You can still do that if you want. Nothing that a pair of bolt cutters and a shotgun or a steak laced with arsenic wouldn't take care of though. :D

Quote:

---

Originally Posted by Daddles

Does anyone else long for the 'good old days' when secure banking meant you had a large, steel bound oak box in the basement, liberally wrapped with heavy chain interlinked with large padlocks, all capped off with a very large, very hungry and bad tempered mongrel dog.

---

Don't know how you got in to see it but i'm changing the locks on the basement door

Silent

I saw a conspiracy show once that said US stopped at 128 encryption for public use was because any stronger and the FBI computers then wouldn't be able to crack it.




The trouble with life is there's no background music.

Quote:

---

Originally Posted by silentC

Commonwealth Bank's Netbank used to work that way.

Now they put up a code table. You type the corresponding letter from the code table for each number in your PIN. The code table is different each time you log in.

---

I'm with them and I've never seen anything but an ID and password login. :confused:

Doesn't matter anyway the true theives are the banks. :mad:

I am with you DanP, only a Client Number and then the Password?
Station-rat :)

Oops, my mistake :o

It's not Netbank, it's our other bank that does that - IMB. Yes, Netbank has a userid and password setup, not a PIN number.

You also have to move your mouse until a yellow bar runs right across the screen. Another way of making sure it's a real person looking at the screen.

Perhaps the bank should move towards smart cards- you can buy keyboards commercially that accept them, just plug the smartcard in and away you go (banks have been using this system in-house for ages).

"The trouble with life is there's no background music."
Buy an iPod!

Quote:

---

Originally Posted by stuart_lees

"The trouble with life is there's no background music."
Buy an iPod!

---

Don't you Mac guys never give up trying to get us to convert.http://www.woodworkforums.ubeaut.com...cons/icon6.gif

I'll bet you had a beta video toohttp://www.woodworkforums.ubeaut.com...ons/icon10.gifhttp://www.woodworkforums.ubeaut.com...ons/icon10.gifhttp://www.woodworkforums.ubeaut.com...ons/icon10.gif



The trouble with life is there's no background music.

Quote:

---

Perhaps the bank should move towards smart cards

---

There's been talk of that for years. I've seen the keyboards that take them (Australian invention - Keycorp) and they use them in the branches.

At the end of the day, it's a matter of calculated risk. Is it worth the money to develop a water tight system vs. the cost of coping it sweet when someone rorts it? If you're making a 2 billion dollar profit p.a., at what point do losses to fraudulent activity become more than a nuisance?

I'm PC actually. No wait, I'm not very PC at all, but I use PCs... Course, I do have an Apple ][e in my office, and a Mac Mini, and an iPod...... However, that is balanced against the 4 PCs, so I'm still non PC enough to say that I favour PCs, so long as its not PC to mention this........

If anyone actually understands the mixed TLAs here then more power to you!

You do know what TLA stands for, don't you Stuart? :D

Quote:

---

Originally Posted by stuart_lees

If anyone actually understands the mixed TLAs here then more power to you!

---

Stuart, the bottle of thinners is for cleaning BRUSHES :D

Richard

Stuart the question stands " were you a beta looser or not"http://www.woodworkforums.ubeaut.com...ons/icon10.gifhttp://www.woodworkforums.ubeaut.com...ons/icon10.gifhttp://www.woodworkforums.ubeaut.com...ons/icon12.gif







The trouble with life is there's no background music.

Mr Ashore, do you type your signature line in every time?

Quote:

---

Originally Posted by Rocker

RM,

When you log on to Internet Banking, you first enter your login-ID, i.e. your customer number, which tells the bank what PIN number to expect. You then enter a 4-digit PIN number. It is not alphanumeric, and is always 4 digits.
However, as SilentC has explained, the Commonwealth Bank already uses a more sophisticated version of my idea. I just wish all banks would.

Rocker

---

Rocker, for my internet banking with the Commonwealth I have a 6 digit pin, for the ANZ and Westpac an 8 digit alphanumeric pin.

Only on eftpos cards have they numeric pins with 4 digits for ANZ and Westpac and 6 digits for Commonwealth.

Must be different up north.


Peter.

Quote:

---

Originally Posted by Rocker

RM,

When you log on to Internet Banking, you first enter your login-ID, i.e. your customer number, which tells the bank what PIN number to expect. You then enter a 4-digit PIN number. It is not alphanumeric, and is always 4 digits.

---

The 3 I use for internet banking are:

The NAB is a 6 digit alpha/numeric

Bendigo Bank is same,

CBA is 6 but only numeric

Quote:

---

Originally Posted by Sturdee

Rocker, for my internet banking with the Commonwealth I have a 6 digit pin, for the ANZ and Westpac an 8 digit alphanumeric pin.

Only on eftpos cards have they numeric pins with 4 digits for ANZ and Westpac and 6 digits for Commonwealth.

Must be different up north.


Peter.

---

Sturdee,
You are of course correct; I must have been having a senior moment. Well, actually my Westpac online banking password is 6-digit alphanumeric.
Rocker

The Credit union I'm with has a log-in code and a separate code for external transfers.

Quote:

---

Originally Posted by silentC

Mr Ashore, do you type your signature line in every time?

---

Silent
No I use a free ware program I found called 101 clips it allows you to retain up to 30 things , text , pictures, web pages etc on your clipboard instead of just the last thing you saved
You just line up your curser open 101 clips from task bar and click on the entry you want
Find it under Google 101 clips



Rgds
Russell




Don't take life too seriously; No one gets out alive.

Several people have mentioned that their pin numbers are sent unencrypted.

Every bank in Australia will be using an encrptyed web session. This is visable via the little padlock on the bottom right of the browser. The web address will probably start with https://.
This means that the whole session should be encrypted in either 64 bit or 128 bit (depending on browser) key.
These sessions have many short commings and ways to crack them, but by far the way most people get stung is by following a link to a dodgy website. Always go to your banking site via your favourite links (never via an email) and check that the padlock appears.

Quote:

---

Originally Posted by bitingmidge

As I have had reinforced in a discussion today, "random number generators" aren't actually generating numbers randomly at all. They are merely generating numbers in a complex sequence or algorithm.

In the course of our business we regularly transfer rather large sums of money, and the bank concerned has taken not of Rocker's advice.

It has issued each of the signaturies (sp?) of the account with a little RNG (random number generator) which is tuned exactly to a parallel generator back in some dark room at the bank. The numbers change every two minutes.

When a transaction is made, there is a two minute time frame to log in the number, do the business and get out.

So now all you need to do is hijack the bank's one, be online at exactly the time the transaction is occurring, and do your criminal business in what's left of the two minutes I guess.

Cheers,

P

---

Funny I heard the same thing this morning

Quote:

---

Originally Posted by silentC

Commonwealth Bank's Netbank used to work that way.

Now they put up a code table. You type the corresponding letter from the code table for each number in your PIN. The code table is different each time you log in.

---

When I log into CBA netbank I enter the password directly....I dont see any code tables. Are you sure youre not logging into a fake netbank site run bythe Russian mafia???

You must've missed this:

Quote:

---

Originally Posted by Me on Page 2

Oops, my mistake

It's not Netbank, it's our other bank that does that - IMB. Yes, Netbank has a userid and password setup, not a PIN number.

---

Quote:

---

Originally Posted by Rocker

I must have been having a senior moment.

---

Love that phrase. :D I seem to get them too these days. :D


Peter.

The other thing that may be possible is to have email confirmation for external transfers.

maybe

Rocker,

I don't think a Trojan would find it difficult to record the banks random querey to you and your reply and so reveal your pin at one go. Bendigo bank uses a little key pendant that generates a one-time verification number, when you press a button, that has a valid life of 1 minute. You use your user name, pin and then this verification. Doesn't matter if a hacker got the pin and user name as they are useless without this verification number.