1. Authentication 2.0: User Generated Security
Bring Your Own Token (BYOT)
Selahaddin Karatas
CEO
SolidPass

2. “Why do I rob banks? Because that is where the money is…” -Jesse James
Technology has changed – danger hasn’t
“Why do I rob banks? Because that is where the money is…” -Jesse James

3. Game of Thrones
10 years ago.
today?

4. MitB, DNS Cache Poisoning
Threat Mutations
Phishing
&
Pharming
External
MitM, MitMO,
MitB, DNS Cache Poisoning
Internal
Inside Job

5. The Threat Landscape in 2011
92% from external agents

6. 81% involved hacking & / malware

7. A Few Examples Of Emerging Threats
The Mobile threat
APTs (Advanced Persistent Threats)
Hacktivism
Cyber War
Manipulated SEO
The Cloud
Malware
Rogue Certificates
Social Networks
Embedded Hardware
Shortened URLs
Poisoned QR codes
Digital Virtual Currencies
A Few Examples Of Emerging Threats

8. Mobile devices (BYOD) Mobile browsers Mobile malware Mobile banking
The Mobile Threats
Mobile devices (BYOD)
Mobile browsers
Mobile malware
Mobile banking

9. Attacks on Mobile Users
Android malware takes off
Attacks on Mobile Users
The wording of the mobile app app needs a little clarification.

10. Social-engineering (re-engineered)

11. Our personal credentials are everywhere…literally
Facebook, Linkedin, iPhone apps like Path steal contacts from your address book, “No Permissions” Android apps harvest and export device data…

12. Zeus in the Mobile – ZitMo
From Phishing to MITM
Zeus in the Mobile – ZitMo
Looks good? Look again…

13. Zeus moves to the cloud
Researchers discovered a new version of Zeus malware that targets users of cloud-based payroll services.
1. Zeus captures a screenshot of the service provider’s login page when a user infected with the Trojan visits the site
2. This image records the employee’s username, password, company number and the icon needed to bypass the provider’s image-based authentication system.

14. Out of band SMS is not enough
An attack used by the SpyEye Trojan circumvents mobile SMS security measures used by many banks….

15. SpyEye Trojan in the news
The crafty SpyEye trojan can adjust victim’s balance and create fake online bank statements too to keep the victim unaware of the fraud.

16. Remote Access Attack Vectors
The attackers got in via a VPN or remote access connection in 55% of the breaches investigated by Trustwave SpiderLabs in 2011

17. The solution is
Out of band and offline authentication, preferably
Challenge-Response based

18. Securing the Digital Realm
Business Applications
Web Applications
Network Applications
Online Banking
E-Government
E-commerce
Extranet
Intranet
Strong Authentication
RADIUS
SaaS
Custom
Custom Applications
With Web Services
&
Integrated into Mobile Apps…

19. With challenge-response, user authenticates server & server authenticates user
Employ Challenge - Response for logins in order to obtain user authentication
Making sure the right user has the correct key…

20. Use more than static username & password
Strong authentication with Microsoft OWA
Use more than static username & password

21. Embed it where possible The BYOT model - user generated authentication
BYOT model: outsource the hardware
to the end-user
Embed it where possible
The BYOT model - user generated authentication

22. Thank you
@solidpass