IBM Zurich Research Laboratory Internet Transaction Security on Your Key Chain

[David G. Koontz]

http://www.zurich.ibm.com/ztic/

 IBM Zone Trusted Information Channel (ZTIC)

A banking server's display on your key chain

More and more attacks to online banking applications target the user's home
PC, changing what is displayed to the user, while logging and altering key
strokes. Therefore, third parties such as MELANI  conclude that "Two-factor
authentication systems [...] do not afford protection against such attacks
and must be viewed as insecure once the computer of the customer has been
infected with malware".

---

Perhaps worth a read.  Uses a USB device as a browser proxy serving as a man
in the middle monitor for SSL/TLS transactions to banks.    Allows the user
to explicitly authorize release of information in a transaction to prevent
browser based attacks.  See the demo video (another link below).

You'd think it would cure a lot of the issues with performing transactions
on browsers.  Now you get to worry about where your ZTIC is, and whether or
not it's been tinkered with.

There's a YouTube video which can be found here:
http://www.ibm.com/developerworks/blogs/page/woolf?entry=zone_trusted_information_channel_ztic

A couple of articles:

http://www.toysgadget.com/gadgets-and-toys/zone-trusted-information-channel
http://arstechnica.com/news.ars/post/20081105-ibm-looks-to-beat-identity-thieves-with-a-usb-ztic.html
http://www.eweek.com/c/a/Security/IBM-Researchers-Show-Off-New-Weapon-in-Fight-Against-Online-Fraud/

and IBM's own press release:

http://www-03.ibm.com/press/us/en/pressrelease/25828.wss

You need a Springer Verlag account to download a paper presented on ZTIC at
Trust 2008.  I found the proceedings on scribd by googling for the authors
names from the paper title.



---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com