Latest trend - Linux Boot CDs for Online Banking

[pj_mcgarvey at hotmail.com (PJ McGarvey)]

I didn't read the whole article, but I wonder if this would be best suited for large transactions, say over $1000?   
The bank could use some other means to verify the user is using its live cd, before allowing the transaction.  Or what 
if they integrated some sort of bootable distro on a usb fob that has a certificate built-in for use with two-factor 
authentication?  Even combine that with some out-of-band type of authentication, like a PIN sent to your cell phone.

 

Of course, if the banking session were still compromised, and the Bank states there is no recourse if you use the live 
CD, then you're SOL...

 

Bruce Schneier has written some stuff about "authenticating the transaction"

 

-PJ


Date: Mon, 19 Oct 2009 08:49:07 +0100
From: jim.halfpenny at gmail.com
To: pauldotcom at mail.pauldotcom.com
Subject: Re: [Pauldotcom] Latest trend - Linux Boot CDs for Online Banking




2009/10/18 Dale Stirling <dale at puredistortion.com>

This is definatly a short term fix as I this becomes a major trend it
will just shift the attackers focus to the OS's on these live CD's.

Then we are in the same position that we are now having users that
have a false sence of security from a quick fix that had a limited
life span.

As said before I think a patched system and user education are the way to go.






I can see where the banks are coming from with this, since it may be possible to safely use  a computer infected with 
current banking trojans when booting from a live CD. Penetration into the market will probably be low so malware 
pushers may not target this platform. However, even if this were an minimal environment which auto-updated on boot up I 
reckon this would be too slow for Joe Blow. I have doubts whether people would reboot into a different OS in order to 
gain some additional security.

Jim
                                          
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20091021/61474453/attachment.htm