Schneier on Security

Pat Cahalan • January 24, 2007 2:07 PM

@ Less is More

Please try to persuade your friends and family to stop doing everything
with admin privileges

Oh, I do.

What I was trying to say: given the set S={computer users}, there will always be a subset S’={people who run as administrator}, as long as they are allowed to do so, and required to do so to obtain functionality they want.

Also ensure that the following services are switched off:

You’re assuming Windows 🙂

That’s a basic list, but for the most part I agree with it.

Pat Cahalan • January 24, 2007 4:33 PM

@ mansec-epn

The obvious problem is that a customers computer can not be trusted.

Yep!

This mandates the use of a second level of authentication.

Nope!

It mandates that you don’t use the customer’s computer as a terminal to initiate a transaction. Whatever kind of security you glop on top is going to only solve symptoms of the problem, and in the long run will fail, because the terminal is untrustworthy.

C’mon, a Palm Pilot can be had for less than $100. A bank that wants to cut costs by allowing its customers can use a digital passbook/checkbook. It could be built to use TCP/IP, IPSec, 802.11. It can use the same IP network that the user’s computer uses -> people can still connect to a wireless network and then out to the Internet and to their bank. Keys are only transferable at a bank, so if the bank needs to revoke a key, it sends messages out to the customers and they bring their d-checkbook to the bank to get the new key. Heck, you can even eliminate a host of other security concerns, because the bank can regard the terminal as more or less trustworthy*

• yes, I’m aware there are hacks here, but it’s infinitely preferable to using a general-purpose PC installed by God knows who maintained by nobody at all as a secure banking terminal. If nothing else, physical access to the device is required to hack it in most ways, which makes a class break orders of magnitude more difficult to achieve.

Pat Cahalan • January 25, 2007 11:53 AM

Let me correct that last:

They’d still be vulnerable to class breaks, but they would be much, much more difficult to perform (I have already thought of a couple potential ones, admittedly), because the device itself is dedicated to one purpose.

It’s really, really hard to secure a computer. Something like this would be orders of magnitude easier to make reasonably secure, and it would certainly be much easier to recover.

Pat Cahalan • January 26, 2007 12:38 PM

@piglet

Are you kidding?

No, I’m dead serious.

We are using PCs precisely because they can do everything.

Yes, and that’s the problem. You have a platform that’s being used for several different classes of activity (low security — high security). If you believe that security is a tradeoff, you can’t expect people who write software for what is essentially a “low security” activity to take the same approach as someone who writes software for a “high security” activity. But vulnerabilities in the “low security” software can leverage into attacks or completely bypass the functions of the “high security” software… and they run on the same machine.

This is why trojans work… because (for example) people reading email consider it a low security activity. People, as a class, are never going to be anywhere near as security conscious while reading their email as they are when they vote or bank or whatever other activities they regard as “something I ought to be careful while doing”.

And as tcliu pointed out, we use banking software in an integrated
way, to receive and consolidate account statements and the like.

It should be trivially possible to keep this functionality without enabling transactions. You could still use your computer to read your statement, for example, which could be delivered to you in a myriad of ways, without enabling your banking software on your PC to initiate the transfer of funds.

Why should we welcome the introduction of “dedicated
devices” for different tasks?

First, it’s not an introduction, it’s a replacement. You carry a checkbook and/or an ATM card now, this device could replace both, and do a better job.

Second, because by their nature some tasks require a different security profile. We don’t put airbags on a bicycle, we put them in cars. But for some reason, we expect to use our computer like a bicycle some times, and like a car some other times, and yet we expect it to be equally safe in both operating modes. This is absurdity.

And should every bank introduce their own banking hardware?

Optimally, no, of course. They don’t now. Each bank doesn’t design its own individual ATM machine, they buy from vendors who build ATM machines.

Why should we believe that this won’t be compromised?

It probably will be eventually, but it can’t be compromised in the same way that a computer can be, or on the same scale. Some pretty simple design considerations can remove virtually all of the attack vectors that hackers use now to subvert personal computers. If the device does not allow remote changes (say, the OS and software sit on read only storage that can only be changed by physical access and you take some basic steps to protect the memory stack), you can’t write and deliver a trojan that can be delivered to the device in the same way that you can attack a PC. You simply can’t subvert the device remotely.

Yes, it would be possible to have a class break instituted by an insider, but that is a threat that will never be removed.

Look, you don’t have two choices: be secure, or be insecure. That’s absurd. We’re not trying to prevent anyone from ever hacking your bank account, that’s obviously not possible.

One of my banks has developed its own banking application that is
supposed to be more secure than a web browser. I think this addresses
some of your concerns.

No, it doesn’t. You’ll note in this particular case the trojan had nothing to do with the web browser. It subverted the operating system of the machine, not the browser.

Using a personal computer to do banking has the following security problems:

(1) The operating system is demonstrably totally untrustworthy

(2) Any number of vendors write software that runs on your customer’s computers, all of whom have different attitudes towards security (and almost all of them are at the bottom end).

(3) People are going to install software on their computers.

Ergo, you can’t write secure software to run on the computer, because of (1) – (3). QED.

Now you may argue that this is a security tradeoff that you don’t want to make, because you, yourself, maintain your own computer and you’re confident in your ability to take care of it… but we’re not talking about you, we’re talking about the set S={everybody who banks}.

Don’t forget that ordinary paper-based banking is ne less vulnerable!

Say what?

On the contrary, if I go through the effort to hack your bank account by forging your check, it doesn’t necessarily give me the ability to forge anybody else’s check.

And, say I’m a traditional paper hanger, relying upon making good looking fake paper checks instead of forging one person’s signature perfectly as my main con. I have to physically pass checks. I have a window of vulnerability each time I pass a fake check. I can’t write a block of checks pretending to be from 250 different accounts in the amount of £580,000 and pass them all at once.

Digitally, it’s a click of the button.

Do you not see the difference?

I would prefer North America to abolish its outdated checks, as Europe
has done long ago.

Until someone gives me a reasonably secure method of electronic banking (and I think current methods stink on ice), I’ll stick to paying my bills with paper checks, thank you very much. Not that I use paper checks for anything else.

That one million dollar fraud at Nordea over 15 months (with prompt
compensation for the fraud victims) is certainly peanuts compared
to routine check fraud in the US.

I doubt that the bank was contractually obligated to return the money, doing so was PR on their part. If the number of victims and the amount of money had been small enough to keep the story out of the headlines, I would be totally un-astonished to hear instead a number of sob stories about people spending years getting the bank to give them back their money.

Regarding “Check fraud”, yes, the dollar figures for all check fraud make this story look like peanuts:
http://ezinearticles.com/?Fraud—Check-Fraud-Statistics&id=131847

However, this includes an extremely large class of fraudulent activities, and really, is utterly besides the point -> having a e-checkbook would eliminate virtually all of the check fraud described in the ezinearticles article (it would be impossible to write an insufficient funds check, for one, and extremely difficult to forge a check for another account).

Moreover, these numbers are also highly affected by the fact that most people in the US don’t bank online, they still write checks.

Crime goes where the pool of money is. If you suddenly get rid of paper checks and force everybody to e-bank, you’ll obviously see a huge drop in fraudulent checks, but within a couple of years you’ll see dozens of stories like this one. Rather than settle for a slight reprieve, why don’t we actually take some steps to make financial transactions more secure, instead of as insecure, in different ways?

Pat Cahalan • January 26, 2007 4:32 PM

@ piglet

Valid points.

Online banking will not disappear on the grounds that there is
a more secure alternative

Heh, it will if the bank says, “The customer is responsible for fraudulent charges due to operating an insecure terminal”… which, reading some agreements about online banking, they actually already do, they just don’t enforce it universally.

I believe that on the whole, online banking is more secure than paper banking

On the whole, I think it can be, but yes, we’re comparing apples and oranges, and really it’s a matter of opinion, since it’s difficult to quantify.

I think you exaggerate the vulnerability of online banking.

Picking nits here, but I think one of our differences is I’m arguing about the vulnerability space, and you’re arguing about the actual threat. I agree, online banking heists aren’t common, but I do think they can be.

Regarding all of the late fee and delayed processing points you make -> well, that’s not really a security threat, per se, that’s the bank taking advantage in loopholes in their process to maximally squeeze their customers. That’s bad business practice, IMO, but isn’t quite the same as unauthorized access to my account(s). I agree it’s certainly something to take into account, however.