The Vital Role of Protected Confirmation
Approve Payments Through Dynamic Linking Department TI, Institute for Cybersecurity and Engineering ICE

Protected Confirmation - Dynamic Linking
 EU Directive „Revised Payment Services Directive" (PSD2)[*] mandates that:payment service providers apply strong customer authentication that
includes elements which dynamically link the transaction to a specificamount and a specific payee.
 EMV Security Standard
 PCI SSC[*] The European Parliament and Regulation (EU) the Council of the European Union.
Directive (eu) 2015/2366 on payment services in the internal market, 2015, Article 97(2)Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Banking Trojan: Remote Control Device
Automate Any User Interaction with ACCESSIBILITY
 Automate user input via Accessibility
 Attacker can sniff user input such asPINs, clicks, text input, voice input etc.
 Attacker can automate user input:
 Auto-confirm granting privileges Auto-confirm approving payments
 Entering fraudulent payments
 Prevent removing privileges Prevent removing malware

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

ACCESSIBILITY: Remote Control Device

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Hook VNC
• Convenient
remotecontrol via C2• Similar toTeamViewer• Any User
Interaction
can be logged• AnyInteraction
can beinvoked.

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Copybara – Remote Control Hidden Under Overlay

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Copybara – Typical Attack•Lock Screen•Login to Bank App•Enter Payment•

Remove Banking App•

CleanupBerner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied SciencesMitigate Banking Trojan Attacks
 Hardware backed keys
 Strong 2 Factor Authentication 2FA
 Biometrics
 App Protection against Remote Control
 Protected Confirmation

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Class 4 Reader – Evolution Of Strong Authentication

Class 1 ReaderooKeys generated on
Hardware, nonextractable
Keys are protectedagainst cloning

Class 2 Readeroo

PIN entry ondedicated HW
Credentials cannot
easily be sniffed

Class 3 ReaderooTrusted User
Interface
Prevents overlay
attacks

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Class 4 Readeroo

Device attestation
The integrity of thedevice /environment can beverified.

Target Security Architecture Separation between 2 security

domains Device attestation
 Hardware backed key on
Hardware Storage Module (HSM)
FIPS 140-3 (Level 3+) ,EAL4+
certified Trusted UI

Source: GlobalPlatform, The Trusted
Execution Environment: DeliveringEnhanced Security at a Lower Cost to theMobile Market, February 2011.
Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Android Protected Confirmation (APC)
 Confirmation data submitted from an

Click twice toconfirm

Trx details toconfirm

app in the blue OS to APC running in
the orange OS (TEE) Transaction details displayed by APC
via Trusted User Interface (TUI),
leveraging own drivers
 Physical user response collected byAPC via TUI, directly connected powerbutton or biometrics
 APC usage evidenced to the bankthrough a TEE-issued digital signature
over the confirmation data
 Signed confirmation returned from
APC in the orange OS to the app in theblue OS (REE)

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Science Fiction Or Reality – USB Pilot

https://www.ubs.com/ch/en/private/digital-banking/private/apc-pilot.html
Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

FIDO - Technology-Neutral International Standard In order to make "ProtectedConfirmation" widely accessible, thetechnology must be standardized in atechnology-neutral, internationallyaccepted specification.
 FIDO is a broadly acceptedinternational standard implemented
by all major Software companies.

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

Thank you!
Questions?

Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences

APC Demo App – Try it
https://play.google.com/store/apps/det
ails?id=ch.bfh.securevote

https://apc.ti.bfh.ch/Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences