Hey TPM, SignMyTransaction
Ijlal Loutfi, Audun Jøsang · 2016
Online banking services have been fighting malware for the last 10 years. However, the emergence of targeted Man-in-the-Browser (MitB) banking malware has given the upper hand to attackers in this fight. MitB Trojans hook themselves into end users browsers, intercept their banking credentials, alter their transaction details, and then transparently alter the HTML of the bank web pages they are viewing. The end user then approves the transaction unsuspectingly. MitB is able to evade traditional defense mechanisms such as intrusion detection systems, anti-fraud policies, as well as strong authentication mechanisms. In this paper, we present a solution aimed at detecting and preventing MitB attacks. The solutions rely on concepts related to the trusted computing paradigm. It defines a trusted path in the end user platform, which allows it to take a screen-capture of the displayed transaction details displayed by the end users screen, and forward it in the same TLS session as the transaction details to the bank. The trusted path is hardware-protected by the TPM, and ensures that the screen-capture has not been altered by any malware. The solution also relies on the TPM PKI in order to give assurance to the bank that the screen-capture originates form a genuine user. The solution is aimed at corporate end users and industries.