Outflanking and securely using the PIN/TAN-System
A. Wiesmaier, M. Fischer, M. Lippert, J. Buchmann
Abstract
The PIN/TAN-system is an authentication and authorization scheme used in e-business. Like other similar schemes it is successfully attacked by criminals. After shortly classifying the various kinds of attacks we accomplish malicious code attacks on real World Wide Web transaction systems. In doing so we find that it is really easy to outflank these systems. This is even supported by the users' behavior. We give a few simple behavior rules to improve this situation. But their impact is limited. Also the providers support the attacks by having implementation flaws in their installations. Finally we show that the PIN/TAN-system is not suitable for usage in highly secure applications.
Create a lesson
Related papers
Integrated Identity Protection for Semantic Communications in Embodied IoT Systems
Yu Zhang, JingQi Liu, Shuangrui Zhao et al.
Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains
Yichiet Aun, Mohammed A. Alhartomi, Jing Jie Tan et al.
Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Georgios Feretzakis, Alexandros Papaspyridis
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
Jianhong Ma, Wenhao Li, Xixing Li et al.
Shoot on (Core)Sight: Re-enabling Secure Debug on the RP2350 with Photon-Emission Microscopy and Laser Fault Injection
Antoine Plin
CoRTeC: A Differentially Private Release for Synthetic Tabular Data, Decodable by Any Generator
Calister Nnona