Will Apple kill the SIM card?

GigaOM reports rumors that Apple and Gemalto work on integrating a SIM into iPhone circuit board. Everyone believes that this is totally unaccaptable for the network operators, but probably they want the iPhone badly enough so that they would accept this.

Here is what would come out of that:

• precious space on the PCB is saved
• the new security element might also contain payment applets
• the general security of the iPhone might be improved.
• changing the mobile network operator could become extremely simple, even automatic.

There were rumors before that apple wants to enter the NFC universe. It will be important to see if Apple makes SIM switching really easy. They could if they wanted to. Also, it will be very interesting to see if such a device could also get EMV certifications.

ZeuS attacks m-TAN

ZeuS e-crime toolkit now supports man in the mobile also. It seems that the malware on the PC tricks the user into installing malware on their phone with a classic social engineering manipulation.

The fraud is then straightforward: The trojan on the PC starts a transaction, the telephone malware grabs the m-TAN confirmation message and forwards it to the malware on the PC where the fraudulent transaction is completed.

This will become increasingly dangerous with the success of smartphones, which allow more attack vectors, in particular if the telephone is regularly connected to the PC, e.g. for synchronizing or charging.

I have written about this problem already one month ago.

Smartphones Not Ready for Mobile TANs

In the last weeks we had an outbreak of security issues with smart phones. The most famous was the pdf font bug that hit the iPhone and other iOS devices which was fixed by Apple with iOS 4.0.2. This one was really dangerous because it could infect iPhones just by opening an infective web site.

Then we had a rootkit for Android phones. A first criminal exploitation was a Trojan, also for Android, that sent text messages to premium numbers.

Of course there is much more. The reason for this is, of course, that there is no magical security for telephones. Old-style telephone-and-SMS-only phones were simply too dumb to be hacked (if we disregard the occasional bluetooth hack). Modern smartphones are normal computers that happen to contain a radio baseband chip.

However, we have that security feature M-TAN or Mobile TAN for online banking. When a M-TAN user has entered their transaction into the online banking website, they get a SMS with some details on the transaction and the M-TAN number. If the details of the transaction look good, they enter the M-TAN into the web site to complete the transaction.

So, here is the criminal master plan:

1. own as many PCs as you get
2. own as many smartphones as possible
3. match smartphones and PCs
4. start phony transactions on the PC
5. capture the resulting SMS
6. send the M-TAN to the Trojan on the PC
7. Profit

Sounds complicated, but if everyone has a backup of their smart phone on the PCs step 3 should be quite easy and the only remaining issue for the criminal is whether they find enough matches so that the plan is worth the effort.

A promising version of this plan would be to attack the smart phone via the infected PC. In iPhone speak this would be called the "trojan jailbreak". If this can be done without the user noticing it, the M-TAN is completely broken.

I don't recommend using M-TANs on a smartphone.

FBI can't break TrueCrypt

The FBI failed to decrypt a hard disk encrypted under TrueCrypt and another unnamed program. Of course, this is the expected result if AES is secure and the password the suspect had chosen is also secure. Still, this is a nice argument that the whole things worked.

On a side note: this is exactly why authorities want to put trojans into computers of suspected people: The Trojans would be used to "confiscate" the data or the password while the suspect uses them.

Graham Cluley from Sophos claims that Apple have secretly patched their OS against a Tojan. Of course the claim that Apple computers were immune against malware have always been absurd. It is reasonable to expect that more malware will target Macs, and we will see how Apple will deal with that. It will be hard work just like in the case of Windows, not some magical pixie dust.

German Police publishes ATM Crime Numbers

The german federal police has published the 2009 numbers for ATM fraud. 964 ATM machines have been manipulated, that#s 20% more than 2008. Usually the PIN is spied out and the magnetic stripe data of the banking card is read. The data is transferred via a wireless connection who make a copy of the card and use that at another ATM.

Usually customers won't note the manipulations. Removing the magnetic stripe would improve the situation, but note that the cards must be authenticated with a real challenge-response protocol if a real security improvement is the target.

Bumping Telephones for small Payments

Bump is an API and service that allows people to initiate a data transfer between their telephones by bumping them together. The service matches location, time and kinetics of the bump between the phones. Then contact data may be exchanged or, more interesting, small amounts of money my be sent.

The bump procedure ensures that users understand what's happening and privacy may be added by adding a PKI to the bump matching service: if the match is made, the service can send public keys of the bump partner.