'E-Commerce in Crisis: When SSL Isn't Safe'

Joe (152.163.36.128) -

"The problem is," according to one bank regulatory security auditor, "SSL isn't broken. SSL states that the connection between your PC's network card and the bank's network card isn't compromised. This is still true. Nobody is sniffing the transaction off the wire. Instead, this is a 'man-in-the-end-point' attack." In other words, the Trojan is sniffing or manipulating the transaction before it is ever sent across the Internet to the bank.

According to Mitchell Ashley, CTO of network security provider StillSecure, "Traditional phishing attacks have duped end-users into clicking on a link, but in the newest evolution, even the most security-savvy can fall victim to attack. Once you're infected, the game is up."

Read the full article...

• E-Commerce in Crisis: When SSL Isn't Safe

Comment #1 Mark (196.40.43.79) -

I think that is an excellent article. However, I have a few critiques.

The author goes into long convoluted discussions about the various risks to banks by special phishing programs.

Before one gets into those specifics a brief look at the big picture would be appropriate. Then one may conclude there is a major problem in general that must be addressed (and if properly addressed the issues described in that article become irrelevent).

The first step is to look at what "SSL" is. It is simply a protocol to secure the transmission of data BETWEEN your computer and the BANKS computer.

It does nothing to: 1) verify who you are, 2) secure data on your computer or the banks computer. It is only designed to stop someone from "listening" in on the CONNECTION. This of course is a very important aspect of security, but it is one small piece.

What that means is that ANY PROGRAM that might be installed on YOUR COMPUTER that might monitor data ON YOUR COMPUTER (such as keystoke logging) will not in any way be limited by the SSL protocol.

When you press a key on your computer that is not part of the connection between YOUR COMPUTER and the BANKS. It is simply an activity on your computer that programs on your computer can monitor.

Therefore any and all programs on your computer have the potential to retieve data that one might think is protected by the SSL connection.

The real question is how one can suitable secure their own computers?

Comment #2 Milly from Wisconsin -

I don't thing there really is a secure way. Computers are programmed by people and there are always ways to find leaks. That is why I do not bank online. Just too many security risks.

Name:           
E-Mail:         

Optional (please add to our directory first)
Web Link:       
Link Title:     

Message:

Note: once you register your email address with Privacy it is used across our whole network of forums and blogs. You can create seperate profiles for each forum or blog, but use the same login.