The security risk of internet banking has increased rapidly as internet banking services have become commonly used by the public. Among the various security methods, OTP (one time password) is known as one of the strongest methods for enforcing security, and it is now widely used in internet banking services. However, attack methods which can detour OTP have been developed that additional security for OTP is now needed. In this study, we discovered that a new kind of attack through OTP is theoretically possible through an analysis of the currently implemented OTP system and known attack methods. Based on our theory, we tested the new attack method on Korean internet banking services, and empirically proved that it could effectively detour around all of the currently implemented OTP security systems in Korea. To prevent this, we also suggested solutions based on the root cause analysis of the OTP vulnerabilities.

Case study of the vulnerability of OTP implemented in internet banking systems of South Korea

A message brokering mechanism for a transaction processing system may include first and second stages operable to exchange message requests and responses. The first stage may be operable to receive a message request from a message source and to check whether there is an existing first stage response to the message request. In some embodiments, if there is an existing first stage response, the first stage may dispatch the existing first stage response to the message source.

Systems and methods for transaction messaging brokering

Modern security architectures tend to become more and more complex. Not only the chances to improve Web applications using several data channels and diverse (TCP-)ports are very promising, but also the risks for criminal attacks and an intrusion into the corporate network are increasing. The classical solution to protect networks against criminal attacks with firewalls is problematic, though. On the one hand, attacks from the inside are hardly prevented by firewalls, on the other, mobile computing poses additional security risks to the corporate networks. Personal firewalls solve some of those problems, but their central administration is very difficult. In this paper, we will discuss a possible strategy to manage distributed personal firewalls with a central tool, the Smart Data Server.

Managing Distributed Personal Firewalls with Smart Data Servers.

This article describes various efforts to address security in three areas of the Internet protocol suite: the Internet Protocol itself (IPsec), the domain between transport and application layer (the Secure Sockets Layer and the Transport Layer Security protocols) and security extensions for the HyperText Transfer Protocol (S-HTTP). For each area the current technology, relevant standardization activities and likely future developments are discussed. In addition, a brief introduction to the Internet standardization process is given.

Internet security protocols

A message brokering mechanism for performing a recovery operation in a transaction processing system including first and second stages operable to exchange message requests and responses. The first stage may receive a message request from a message source and may check whether the message request is a special message request. This may be by way of checking if a recovery attribute of the message request is set. A normal message request may have a recovery attribute that is not set. If the message request is a special message request, it may be dispatched to the second stage. If the message request is a normal message request, it may be dispatched to the second stage if the normal message request is not a repeat normal message request.

Systems and methods for multi-stage message brokering

This document specifies the requirements for the provision of security services to the HyperText Transport Protocol. These services include confidentiality, integrity, user authentication, and authentication of servers/services, including proxied or gatewayed services. Such services may be provided as extensions to HTTP, or as an encapsulating security protocol. Secondary requirements include ease of integration and support of multiple mechanisms for providing these services.

G. Bossert

Papers

Considerations for Web Transaction Security