Innovating Cyber Defense Approaches for Online Financial Fraud in Developing Economies

1. ITU Workshop on “ICT Innovations in Emerging Countries” (New Delhi, India, 14 March 2013) Innovating Cyber Defense Approaches to Combat Online Financial Fraud in Developing Economies Charles Iheagwara, Director, Unatek, Inc. ciheagwara@unatek.com

2. Mobile World • At the end of 2011, there were 6 billion mobile subscriptions, estimates The International Telecommunication Union (2011). • That is equivalent to 87% of the world population. • is a huge increase from 5.4 billion in 2010 and • 4.7 billion mobile subscriptions in 2009. • • Mobile subscribers in the developed world has reached saturation point with at least one cell phone subscription per person. This means market growth is being driven by demand developing world, led by rapid mobile adoption in China and India, the world's most populous nations.

3. Mobile World Cont. • • At the end of 2011 there were 4.5 billion mobile subscriptions in the developing world (76 percent of global subscriptions). Mobile penetration in the developing world now is 79 percent, with Africa being the lowest region worldwide at 53 percent. • • Portio Research –free Mobile Factbook 2012 • Predicts that mobile subscribers worldwide will reach 6.9 billion by the end of 2013 and 8 billion by the end of 2016. • estimates that Asia Pacific’s share of the mobile subscribers will rise from 50.7 percent in 2011 to 54.9 percent in 2016. By 2016 Africa and Middle East will overtake Europe as the second largest region for mobile subscribers Africa.

4. Mobile Banking • Not all mobile subscribers have bank accounts • The estimate of subscribers with mobile phones but no bank accounts could be anywhere from 15 – 40% of all mobile subscribers • Banks say, “Let’s use phones to serve these people!” • Several mobile banking services exist today • M-PESA (Kenya) • Wizzit(S.A.) • GCash(Philippines) • > 100 million dollars transacted per day

5. How does it work?Courtesy: Microsoft Research India Courtesy: CKS Courtesy: CKS An m-banking agent sends an SMS to the bank for a deposit transaction M-banking outlet in Delhi • A network of human agents mediate transactions • Run small businesses: mobile recharge, pharmacy etc • Commissioned by m-banking provider

6. How does it work? Courtesy: Microsoft Research India Bank Hari deposits 100/- “Hari’s a/c credited” “Credit Hari’s a/c with 100/-” Hari Agent

7. How does it work? Courtesy: Microsoft Research India Bank Hari withdraws 100/- “Agent’s a/c credited” “Credit agent’s a/c with 100/-” Hari Agent

8. Security Challenges • Physical: Phones can be lost or stolen. • If stolen, can login credentials be extracted from the memory card? • Logical: Banks must authenticate users. • How is authentication via wireless medium sure proof

9. Security Challenges Cont. Courtesy: Microsoft Research India ‘ Is this really Hari? Bank “Credit agent’s a/c with 100/-” Hari • Phones can be lost or stolen. Banks must authenticateusers.

10. Challenges • How do we authenticate via a phone like this? • No GPRS, • Can’t install software • Typical m-banking user’s phone Courtesy: EKO • … while also ensuring • A simple interface (want low-literate users to use it) • Low cost (want it to scale)

11. Banking Authentication for Mobile Users • Current practice by banks is not sure proof: • Most banks use PINs to authenticate users • For good security, PINs must be protected • There is evidence that some banks have holes in the way the implement PIN management • Wireless (GSM, etc.) security is grossly inadequate • The problem is wireless leak of information • The security architecture profers Network-layer protection

12. Cyber Attacks on Mobile Banking • Hacking incidents from well-known attacks characterize current mobile banking practice • Attacks on network-layer is difficult to track and quantity over wireless media • Skimming attacks result to losses by some estimates well over $1 billion in 2009.) • Attack type includes shoulder-surfing and phishing attacks.

13. Unatek’s Solution • Unatek’s subsidiary intrusiononline, Inc. (www.intrusiononline.net) is developing a wireless intrusion analytics that aides in analyzing authentication-based applications • A commercial product/service is projected to be released next year • Our approach is to address wireless authentication threat vectors peculiar to delivery of PIN over wireless medium • Current practice mostly center on cryptographic means which have proven to be inadequate

14. Unatek’s Solution • Every user has a PIN & holds a unique codebook • Appends a “coat” that is tamper-proof to each transaction message • Afreshcoat each time • The technology addresses network- and application-layers issues • Our approach revolves around the belief that if wireless transaction is carried over a medium that can authenticate the issues mentioned above will be addressed. • We envisage developing an application that will track PINS on cooperating devices and coat them with protective shields both on the fly and at rest on the handsets

15. Conclusion • Mobile banking in developing economies are vulnerable to several attacks resulting into losses worth several billions of dollars • Current Cyber security measures are inadequate to combat the attacks • Unatek is incubating solutions that extends the current strategies into a new and more effective way of combating the attacks.