Mobile Phones Help Secure Online Banking
9780
Bank of America Corp. customers can now use their mobile phones to make online banking more secure.
714004
I&#39;ve been explaining quite a bit of late about a new federal law that allows banks to convert your checks to digital images. Banks aren&#39;t the only businesses using electronic means to process paper checks.
504348
U.S. Bancorp will use VeriSign's Unified Authentication service to validate and secure interactions with commercial banking customers, providing them with a secure USB token they must use when accessing services online.
163701
(InfoWorld) - Efforts to establish security standards for mobile devices were boosted Tuesday with the release of the Mobile Trusted Module (MTM) specification. The specification offers a set of standards for mobile phone manufacturers and software developers toÂ store data securely in mobile devices, such as smartphones and wireless PDAs (personal digital assistants). The standards, issued by the Trusted Computing Group industry association, have been years in development. They are backed by numerous companies, such as Nokia, Samsung Electronics, and France TÃ©lÃ©com, which are members of the Trusted Computing Group's Mobile Phone Work Group. Like the Trusted Platform Module used in PCs, the MTM stores information in a secure area of the device to ensure the device's operating system, applications and data haven't been virtually or physically tampered with. It uses a system of "engines" within the device that report the state of their code so that their "trustworthiness" can be established. Vendors can determine whether the MTM should be a discrete silicon chip or a system-on-chip implementation. In addition to helping manufacturers and operators reduce the risk of virus attack and identity theft, the MTM can enable mobile payment and ticketing services. Further information about the mobile phone security specification isÂ available here.Â
184264
(InfoWorld) - Banks and other companies switching their phone systems to VOIP (voice over Internet Protocol) are making themselves vulnerable to phishing attacks for which there are currently no effective detection or prevention tools, a security researcher warned Wednesday. "People will be able to penetrate bank networks and hijack their phone lines," said an independent security researcher, known by his pseudonym The Grugq, in an interview. VOIP is becoming increasingly common as companies and operators look to the technology to help cut costs, which makes them moreÂ vulnerable to attack, he said. The Groqg, who spoke this week at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia, saidÂ VOIP phishing attacksÂ will emerge by the end of this year. The attacks will allow hackers to steal personal data, including credit card numbers and bank account information, and there is little security managers can do to stop them. "Theoretically, you phone up your bank and the customer service line has been taken over by hackers," The Grugq said. In this scenario, the customer would be asked by the hacker to enter personal banking information before being passed on to an actual bank customer-service representative. "There's no security technology out there that companies can deploy to fix this," The Grugq said, noting that existing intrusion-detection systems are not capable of detecting when a VOIP attack takes place. During his presentation at HITB, The Groqg announced the release of alpha code for SIPhallis, a tool he wrote that allows security managers to manage SIP (Session Initiation Protocol) VOIP packets on their networks. "It gives you an interface to create and send VOIP packets; it also allows monitoring of VOIP packets," he said, adding the application can also be used to inject packets into a VOIP stream. Existing softphone or PBX software is all that is required for hackers to launch a VOIP attack, The Grugq said. HITB runs through Thursday, Sept. 21.
71184
Hanging on the telephone Here's a cautionary tale for would-be penetration testers: get permission from a bank before you try to bill them for helping to identify and fix the security short-comings of their services. New Zealander Gerasimos Macridis, 39, learnt that lesson the hard way after his attempts to help the country's Reserve Bank in improving its telephone banking systems resulted in a court appearance.â¦
34313
Soon you will be able to deposit checks by scanning them at home and sending them electronically to your bank. No need to visit a branch or even an ATM.
497821
Alternative browser features protection against online scams.
489539
(InfoWorld) - WithÂ Internet fraud on the rise, French banks and merchants are not putting in place antifraud technology to catch bad online transactions, an official from France's central bank said Thursday. Some banks are reluctant to put into place stronger mechanisms, such as requiring customers to use one-time passwords, because of high deployment costs as well as the reluctance of customers to use it, said Marc Andries, who works in the non-cash means of payment oversight division for the Bank of France. Paradoxically, the introduction of authentication technology prompts some consumers to question the security of their bank, said Andries, who gave a presentation at Fraud World 2007 in London. Nonetheless, the rise in online banking fraud and card-not-present (CNP) fraud -- in which someone's credit-card details are used for an online transaction without the need for the physical card -- demands a solution, he said. As a result, the Bank of France is in an "intensive dialog" with financial institutions to adopt new security technology, Andries said. The Bank of France will not, however, dictate how banks should strengthen their security or what technology they should use, he said. That is in contrast with the U.S., where the Federal Financial Institutions Examination Council, which supervises U.S. financial institutions, mandated that banks implement two-factor authentication by the end of 2006. Merchants in France who conduct e-commerce transactions tolerate CNP fraud because e-commerce is soaring, and they can buy insurance to guard against losses, Andries said. "They accept it because it's part of the business," he said. CNP fraud has risen as face-to-face transaction fraud has fallen with the widespread deployment of so-called "chip and pin" technology in Europe, where consumers must enter a four-digit personal identification number in a terminal before completing a transaction. As a result, criminals have turned to CNP fraud, where the credit-card details, obtained through phishing or other scams, are used for e-commerce transactions. But that fraud can be reduced by using systems that use a combination of data to better authenticate the transaction. Security software can check the card's security code -- the three-digit number on the back of the card -- along with part of the customer's post code or house number. Consumers aren't putting much pressure on either banks or merchants since they can contest fraudulent CNP transactions, Andries said. But they don't get off that easy, since "in the end, the losses are paid by the client of the merchant through inflation, and that's not good for the central bank," Andries said.
276623
As cell phones turn into mobile handheld data devices, companies are exploring ways to protect them from being hacked by a growing number of sophisticated viruses designed specifically to attack the wireless world.
611114
Partnership will produce secure processor that enable mobile phones to be used for "contactless payments."
430042
By embedding a computer chip or other type of memory device, a cellphone can double as a credit card.
358340
(InfoWorld) - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters The warning from the UNâs International Telecommunications Union came a little more than a year after the United Statesâ Federal Financial Institutions Examination Council (FFIEC) released similar guidance calling for stronger user authentication for online banking customers.                                                     Those kinds of warnings are music to the ears of Jon Fisher, CEO of Santa Clara, Calif.-based Bharosa, which sells anti-fraud and multifactor authentication technology to banks, health care companies, and the government. Just three years old and with 50 employees, Bharosaâs been taking on security industry behemoths such as VeriSign and EMC/RSA on their own turf and, in some cases, winning. In the past year, Fisherâs company signed deals with Wells Fargo, National City, and the U.S. Air Force. A serial entrepreneur who sold his first company at age 23, Fisher spoke with InfoWorld Senior News Editor Paul F. Roberts about how the changing regulatory environment has been good for his company. InfoWorld: What is the core intellectual property that Bharosa has? Jon Fisher: We have a proprietary, gated methodology to screen for fraud in real time. The first gate manifests itself pre-log-in via an analysis of a host of data about the user and transaction. The second gate is at the first point of authentication: the user name and password. The third gate is manifest in session where transaction and document requests occur. The fourth gate is a score of third-party data, whether thatâs enterprise, legacy, or other data thatâs fed into our fraud detection engine. IW: What should enterprises know about software like Bharosaâs? JF: Fraud detection has a place not just in achieving FFIEC compliance, but also truly bringing together disparate legacy systems [that] enterprises have had in place for some time. IW: Are you talking about single sign-on, or something else? JF: Single sign-on is an application of that. But fraud detection [can make] a decision about what advanced forms of authentication to use based on the conditions, or what kinds of transactions will manifest in certain ways, like a document request or [bill payment].Â  IW: Arenât authentication and fraud detection ultimately just parts of a bigger architectural change that will tip the scales in favor of vendors who can take care of data security in addition to authentication and storage and the networking piece? JF: Iâve been an entrepreneur for a number of years. I know that if you want to start a company and run a good company, youâve got to do something well. Weâve selected a few things to focus on and do well. Theyâre things that, in aggregate, constitute more than just a point solution. But, yes, certainly less than the array of products in unrelated areas offered by competitors. In terms of how the competition in the space breaks out in the next few years, because of the importance of fraud detection â especially in the enterprise â some very large companies are looking at the space and deciding what their strategy will be. If you have a key product like [Bharosa] fraud detection thatâs embedded deep within some of the worldâs finest enterprises, no matter how much the space matures or develops and no matter what resources competitors have, you still have to work with Bharosa. IW: In the financial services space, how much of this is being driven by FFIEC guidance around single factor authentication? Where do things stand with adoption of FFIEC? JF: There are two answers. As an objective observer, Iâd have to agree that more than 50 percent of U.S. banks will technically not comply with FFIEC-related guidance by the end of the year. However, as a principle at Bharosa, Iâm finding that FFIEC compliance has served as rocket fuel for my relatively young company. Itâs been a key driver in our growth. Weâre very much looking forward to the second phase of FFIEC guidance in 2007. Weâre also looking for the effect this guidance will have on other markets. These mandates for enterprises to update security as a function of time are great environments to work in if youâre a software company.
61400
A payment system that allows users to spend cash via their handsets is launched across the UK.
546702
The growing functionality of mobile phones-- which in the future could be used to unlock doors and make credit-card purchases-- is driving demand for new and stronger security products, companies exhibiting at the 3GSM World Congress in Barcelona said.
701756
(InfoWorld) - Uncertainty about how to secure mobile phones in the face of increasing threats is slowing enterprise adoption of mobile applications, experts exhibiting at theÂ 3GSM World CongressÂ in Barcelona this week said. Over two-thirds of mobile operators in Europe that took part in a survey said that they detected more than 100 incidents involvingÂ mobile virusesÂ orÂ mobile spywareÂ in 2006, according to a study by conducted by Informa for security software developer McAfee. The number of European operators reporting more than 1,000 such incidents more than doubled in 2006 compared to the previous year, the report said. IT administrators, uncertain how to protect their users from such attacks, are unwilling to enable mobile access to applications for workers. "Enterprise security professionals haven't really worked this out yet," said Lorcan Burke, CEO of AdaptiveMobile. Companies such as banks, with strict security requirements, simply block access to any service, including Internet access, that could open doors to security issues, he said. At the recent RSA Conference in San Francisco, some of the most crowded events were those tackling mobile security issues, said Simeon Coney, vice president of marketing for AdaptiveMobile. That was an indication that IT administrators are trying to find out how serious mobile security problems are and how to address them, he said. Mobile services can be secured in the application, the network or in hardware or software on the device. Among operators responding to the McAfee study, most found that virus protection was most important at application and device levels, although more of them had deployed network-level security systems than the other options. Over 200 respondents from the operator community took part in the study. AdaptiveMobile makes network-level security products for operators, including a system for filtering viruses in e-mail, SMS (Short Message Service), MMS (Multimedia Messaging Service) and WAP (Wireless Application Protocol) traffic. Beyond viruses, AdaptiveMobile can also control content, so it can stop phishing and other fraudulent attacks, or limit the types of content end users can access. If an operator has deployed AdaptiveMobile's platform, an IT administrator in a company can set and manage such controls down to the level of individual users. For the mass market, AdaptiveMobile's product allows operators to notify a user by text message if their phone becomes infected with a virus and offer a download, either for free or for a fee, to disinfect the device. Without such software, operators will replace a user's device or ask them to send it off for disinfection, both costly propositions. A network-based security mechanism offers some advantages over anti-virus software that sits on the handset, Burke said. Handset software doesn't prevent phishing and other nonviral scams. In addition, anti-virus software isn't compatible with all phones, making it logistically difficult for the software developers to tweak their products for each version of every phone and make sure to sell the proper software to end users. He calls anti-virus software on the handset "the minimum acceptable response. It's a tick in the box to make people feel comfortable." Some developers also sell security mechanisms that sit in the phone's hardware. Such solutions are ideal for organizations with very strict security requirements, such as government users, Burke said. One downside to the hardware-based solutions is that they take about two years to make it into a handset, he noted.
32642
As more and more people turn to the  Internet to pay bills and shop for goods and services, Dutch  financial services group ING has carved out a lead in what was  once considered the most elusive of online services: banking.