IBM Researchers Show Off New Weapon in Fight Against Online Fraud

Researchers at IBM revealed new technology they say can protect online banking transactions from malware and man-in-the-middle attacks.

The company has developed a prototype of a small USB device dubbed the Zone Trusted Information Channel. According to IBM, the product plugs into the USB port of any computer and creates a direct, secure channel to a bank's online transaction server–the point being to bypass the user's PC, which could be infected with malware.  

"The various phases of the validation and acceptance of a transaction are moved from the PC over to the ZTIC," said Gunter Ollmann, director of security strategy for IBM's ISS, in an interview with eWEEK. "It is also encrypted at the ZTIC as a further security precaution, and can use bank-supplied smart-card technologies to further boost this encryption/security."

If a user's PC is infected with malware that manipulates the information flow in the PC, the user can cancel the transaction while it's displayed on the ZTIC device. What the user sees on the ZTIC display is identical to what the server sees regardless of what occurs on the PC.

Click here to see images of IBM's ZTIC online banking security prototype. 

Man-in-the-middle attacks are thwarted as well because the device encrypts the data and handles the authentication and verification of the banking transaction on its own hardware, Ollmann explained.

"SSL/TLS [Secure Sockets Layer/Transport Layer Security] encryption allows for the sharing of encryption keys that can be signed and even be validated by a third party as being real and belonging to a specific organization," he said. "It is therefore possible to ensure that the device is communicating securely with the correct bank—and not to a networked man-in-the-middle attacker who has created their own SSL/TLS certificates. Because this process can be done from the ZTIC, any manipulation of the customer's computer by an attacker will have no effect on the ZTIC's processes."

The researchers designed the ZTIC with minimal embedded software surface, including a TLS engine, an HTTP parser for analyzing the data exchanged between client and server, and networking proxy for running on a PC. There is also custom system software implementing the USB mass storage device profile. The hardware consists at a minimum of a processing unit, volatile and persistent memory, a small display and at least two control buttons—OK and Cancel. There is also an optional smart-card reader.

Pilot devices are now ready for trial, IBM officials said.

"In the presence of an ever-more professionally operating e-crime scene, it became obvious that PC software-based authentication solutions were potentially vulnerable and that we needed to innovate to stay ahead," Peter Buhler, manager of computer science at IBM's Zurich Research Lab, said in a statement. "That was the starting point for developing the ZTIC."