Preventing identity theft from internet banking activities within a business environment

Abstract

Identity theft is the fastest-growing crime which occurs almost on a daily basis in the United States (Christian, 2011). Decades ago, it was simply stealing a credit card number or a bank account number, but nowadays identity theft is occurring on a much larger scale, where it affects several people all at once. Identity theft attacks are becoming much more sophisticated. Phishing is one of the most widely used attacks (Alexander, 2010). The attacker tricks the user into disclosing personal information from which the attacker can gain financial value. According to the Phishing Activity Trends Report, in March 2010, the number of unique phishing websites detected added up to 29,879 (APWG, 2010). Online banking is a service that allows bank customers to use some form of computer to access account-specific information and possibly conduct transactions from a remote location - such as at home or at the workplace. Online banking was threatened worldwide with more than 23,610 phishing reports registered in February 2007 according to the Phishing Attack Trends Report-February 2007 from the Anti-Phishing Working Group (APWG, 2007). According to the research released by the Ponemon Institute, which polled 500 executives and business owners from small to medium sized businesses in the United States, 55% of businesses were victims of fraud between 2009 and 2010, with 58% of fraud enabled by online banking activities (Guardian Analytics, 2010). All of this has damaged banks' business customer relationships, where only 20% of the respective banks were able to [iii] identify fraud before money was transferred, which is quite a small percentage. Online banking fraud in the UK amounted to £52.5 million during 2008 by the use of key-logging (BBC, 2009). The result of fraud includes ruined business credit ratings, large fraudulent purchases, damaged reputations, illegitimate business deals made in the company's name, fraudulent loans obtained in the company's name and so on (Collins, 2005). This shows that identity theft in the commercial domain is a threat, especially where online banking is used. This project tackled this problem by conducting extensive research on the security mechanisms available to businesses and which are adopted by both local and global banks. Local banks adopt secure mechanisms however it was found that given the existing technologies adopted, and through an active man-in-the-middle attack, a business client can still be a victim of identity theft which will in tum affect both the bank's reputation and the business' financial assets if funds are transferred during the attack. The solution proposed by this project will tackle this type of attack along with several other possible attacks. The solution revolves around mutual authentication using physical certificate-based tokens. Certificate-based mutual authentication will ensure non-repudiation and integrity. Nonrepudiation is ensured by the creation of digital signatures, which is signed using the sender's private key. It can only be decrypted at the receiver by using the sender's public key. An attacker cannot decrypt the message with his own public key. Integrity is also ensured since, if an attacker decrypts the digital signature with the client's public key, assuming that somehow the attacker get hold of the client's public key, it has to be encrypted again using another private key. The server will receive this signature and will not be able to decrypt it with the client's public key. At this point, the server will detect that the data was compromised in communication and the connection with the client will be [iv] terminated. Furthermore, business clients will only be able to conduct e-Banking activities while having a physical token available on the client's machine, against which the server will verify the user's identity and vice-versa. This will protect against phishing attempts while minimizing the risk for identity theft. To make this possible, this work proposes a new handshake protocol to allow both parties to verify each other and automatically create a secure e-Banking session. This solution is found to be successful in protecting both the client and the bank from several types of attacks. A number of possible attacks were evaluated and examined to check if this solution is robust enough to prevent them from happening. For the purpose of this project a simple prototype was also implemented which gives an idea of how the solution would work in practice.