IBM researchers have developed a new device that connects to USB ports and creates a secure communication channel to online banking servers. The device is designed to prevent man-in-the-middle attacks and malware-infected PCs from compromising online banking transactions.
Researchers at IBM revealed new
technology they say can protect online
transactions from malware and man-in-the-middle attacks.
The company has developed a prototype of a small USB
device dubbed the Zone Trusted Information Channel. According to IBM,
the product plugs into the USB port of any
computer and creates a direct, secure channel to a bank's online transaction
server-the point being to bypass the user's PC, which could be infected with
"The various phases of the validation and acceptance of a transaction
are moved from the PC over to the ZTIC," said Gunter Ollmann, director of
security strategy for IBM's ISS, in an
interview with eWEEK. "It is also encrypted at the ZTIC as a further
security precaution, and can use bank-supplied smart-card technologies to
further boost this encryption/security."
If a user's PC is infected with malware that manipulates the information
flow in the PC, the user can cancel the transaction while it's displayed on the
ZTIC device. What the user sees on the ZTIC display is identical to what the
server sees regardless of what occurs on the PC.
Click here to see images of IBM's ZTIC online banking security prototype.
Man-in-the-middle attacks are thwarted as well because the device encrypts
the data and handles the authentication and verification of the banking
transaction on its own hardware, Ollmann explained.
[Secure Sockets Layer/Transport Layer Security] encryption allows for the
sharing of encryption keys that can be signed and even be validated by a third
party as being real and belonging to a specific organization," he said. "It
is therefore possible to ensure that the device is communicating securely with
the correct bank-and not to a networked man-in-the-middle attacker who has
created their own SSL/TLS
certificates. Because this process can be done from the ZTIC, any manipulation
of the customer's computer by an attacker will have no effect on the ZTIC's
The researchers designed the ZTIC with minimal embedded software surface,
including a TLS engine, an HTTP parser for
analyzing the data exchanged between client and server, and networking proxy
for running on a PC. There is also custom system software implementing the USB
mass storage device profile. The hardware consists at a minimum of a processing
unit, volatile and persistent memory, a small display and at least two control
buttons-OK and Cancel. There is also an optional smart-card reader.
Pilot devices are now ready for trial, IBM
"In the presence of an ever-more professionally operating e-crime
scene, it became obvious that PC software-based authentication solutions were
potentially vulnerable and that we needed to innovate to stay ahead," Peter
Buhler, manager of computer science at IBM's
Zurich Research Lab, said in a statement. "That was the starting point for
developing the ZTIC."