April 4, 2017 By Shaked Vax 3 min read

Let’s face it: Authentication factors as we know them are not holding down the fort. The practice of providing something you know, something you have and something you are is failing, even when we are asked repeatedly to provide multiple factors of authentication.

Passing Around Passwords

Passwords are a dying breed. The excessive use of passwords, coupled with the need to make them complex and replace them every few months, has driven many users to recycle them across various services. In fact, according to the “TeleSign Consumer Account Security Report 2016,” 71 percent of accounts are guarded by passwords that are used across multiple sites. So when a password is compromised due to a phishing attack or data breach, multiple accounts belonging to that user are also at risk.

Knowledge-based authentication (KBA) makes up the other piece of the “something you know” requirement. According to the TeleSign report, 56 percent of users consider KBA to be their preferred means of additional authentication. Gartner research, however, found that users fail to answer their knowledge-based questions 15–30 percent of the time, while fraudsters answer correctly 60 percent of the time. Malicious actors often find this information on social networks or through phishing schemes.

Shifting Away From SMS Authentication

To fulfill the “something you have” requirement, we used to have physical tokens that generated different one-time passwords (OTPs) every 60 seconds. This practice has shifted to mobile phones, with OTPs being sent as text messages. However, mobile malware can intercept these messages and forward them to fraudsters.

This growing threat influenced the National Institute of Standard and Technology (NIST) to recommend a shift away from SMS-based OTPs.

Sticky Fingers

Biometric authentication is cool. It’s easier to use than other forms of authentication and can be much more secure. Or is it?

It is definitely easier to use fingerprint readers, for example, than to type, which has led to the exponential growth of fingerprint reader-enabled devices. It didn’t take long, however, for cybercriminals to circumvent this technology. Moreover, if the biometrics enrollment process is not properly secured, a cybercriminal — or even a young child — can register his or her own fingerprints with a victim’s password.

Trust, but Verify

New technologies such as behavioral biometrics, which identify anomalies in users’ ongoing behavior, have the potential to replace passwords and help organizations avoid compromise. However, in the cat-and-mouse game of cybercrime, it’s only a matter of time before threat actors devise behavior replay attacks or other forms of circumvention. Isn’t there a better way to manage secure identities rather than continuing to add more hoops for users to jump through?

Read the white paper: Outsmarting Fraudsters with Cognitive Fraud Detection

The key is not in what strategies we use, but rather in how we use them. While users can provide proof of their identities, so, too, can the malicious actors who compromise them; that’s where the principle of “trust, but verify” comes in. When users enter their passwords or use known devices, there should be indicators of malicious intent if the information is being submitted by a fraudster.

Here are a few examples:

  • For “something you know” credentials, indicators should show whether users have been phished or otherwise infected with malware, which would suggest that their credentials may have been stolen.
  • For “something you have,” indicators should help analysts determine whether a user’s device has been compromised by malware or another means of stealing SMS messages. This should put any OTP response by the user in question. In addition, evidence of device-identifying parameters being spoofed or of remote-access Trojans (RATs) being used may indicate that the user’s known-devices identification has been compromised.
  • For “something you are,” it’s critical to identify particular biometrics, such as a specific fingerprints, associated with multiple accounts of various users.

A Complete Identity Picture

When such indicators are coupled with traditional authentication factors, they paint a more holistic picture of identity corroboration, one that shows not only the bright colors of the positive identity indicators, but also the shadows of malicious actors. This delivers a much higher level of trust in the established identity picture. IBM Security’s Identity and Access Management and identity analytics solutions can provide this complete picture.

To keep the identity corroboration process effective, however, it must adapt continuously to identify new attack and risk indicators — but that’s a topic for another post.

More from Fraud Protection

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today