71

My bank recently revamped its website, and it changed for the better as far as I’m concerned. Especially, security seems to have been dramatically enhanced.

Most importantly, they introduced a rather unusual (I’ve never seen this before) identification method, which they call the ‘electronic certificate’. Basically, you have to go to the bank in person and the guy gives you a tiny, cheap USB stick with a very low capacity. From this point, you’ll be required to plug the stick into your computer every time you want to log in. The stick alone is not enough, you also have to type your password — basically, 2-factor-authentification with a USB device being the second factor.

How can this possibly work? Of course, I believe the USB stick to contain certificates/encryption keys of some kind, that are used in the login process, but they don’t require the user to install any software on the machine. I find it rather creepy that a website accessed from a sandboxed web browser, with no plug-in/module/app/toolbar installed whatsoever, can see the USB stick you just plugged in. And not only see this stick, but read it and use its content deeply enough to log you to the most sensitive level of your online banking app.

I am not a big fan of plugging unknown devices into my computer to begin with, and my warning light flashed when this was explained to me, so I went for another identification method (you can choose). I’m just curious.

PS: the measure obviously does not apply to their mobile apps, since smartphones don’t have USB ports, but that’s not a big deal because you cannot do much with their phone app (it's mainly a consultation app, not something you can actually make big payments/transfers with).

Edit: no open file dialog is used, which would make the explanation quite clear.

  • 2
    Any chance it's the USB stick that's providing the necessary drivers to wire itself into the browser? – John Dvorak Jan 06 '17 at 08:25
  • I have no idea since I don't actually own it, but it was said to be compatible with "any device that has a USB port", Windows, Mac, Linux and more, and to work out of the box –  Jan 06 '17 at 08:27
  • What driver is the USB stick using? Also is it just a standard USB stick? It is possible that it is running some kind of script in the background similar to a USB rubberducky type devices which uses a bog standard HID driver that windows will have installed already or will auto install. – TheJulyPlot Jan 06 '17 at 08:28
  • I'm sorry I don't have much details on the stick as I chosed another identification method so they didn't give one to me. That would be an interesting thing to study for sure, but I can't do that right now. Maybe I could ask for one –  Jan 06 '17 at 08:31
  • 2
    Have you tested to see if you actually can log into your bank from a 'sandboxed web browser'? It may be that this key will only work with a non-sandboxed browser and the bank is assuming all their customers are running that way. Might be something to ask your bank about. – Mark Ripley Jan 06 '17 at 08:32
  • 1
    I said sandboxed browser because mine is + I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted by default (I hope!) in 2016 for the bank to assume this. I didn't try though –  Jan 06 '17 at 08:48
  • 41
    I think you're missing some info here. It is possible to have a USB smartcard with embedded chip containing your cert and private key. The whole thing can be interfaced through PKCS#11 or Windows Certificate Store, granting access to any browser to the certificate associated with the token. That, however, will usually require the necessary device to be installed. Since you didn't give it a try (and can't provide detail on the stick itself), I'm willing to believe there is just a misunderstanding regarding the meaning of "out of the box" – Stephane Jan 06 '17 at 11:12
  • 19
    I have a Yubikey USB dongle as 2 factor authentication. When I plug it in to the PC it installs itself as a generic keyboard, which all devices ive encountered accept. When I press a button on the front of the yubikey, it types a One-Time Password that the receiving website/program takes to authenticate with Yubicos authentication servers that I am using the key I have set up the account to be used with. As such i can plug it in to anywhere and enter the OTP in to anything without having to install anything. – James T Jan 06 '17 at 12:31
  • 2
    I'd also expect the USB key would be a smartcard containing a private key which you use as a second factor. It could be that the OS already has these drivers or pulls them from Windows Update (which also happens for a lot or regular USB keys). But in most cases you'd have to install the client certificate on your machine first. When prompted by the browser, the OS will then try to retrieve the cert from the USB key if it's present – BlueCacti Jan 06 '17 at 14:42
  • @rory-alsop, actually my answer was an answer, I only saw the other answer at the last second and considered that better than mine. Non-the-less, Both USB devices and disk partitions both have unique identifiers that could be used as a lightweight second factor. The USB device ID being the most likely candidate. I use those ID's for processing backups of USB drives. – Julian Knight Jan 06 '17 at 15:30
  • 1
    This is fishing in the dark. Please add the USB identifier here like vendor ID and product ID. Use your operating system mechanisms to read the attached USB devices. -- OK, I finally saw that you do not have such a stick. – cornelinux Jan 06 '17 at 19:13
  • @JamesTrotter That hardly seems a lot more secure, since it's basically a second password which could be discovered and entered directly. – Michael Jan 06 '17 at 21:59
  • 1
    It's just a thing that pretends to be a keyboard. When you push the button It exports a public key. Any OS will happily pass keyboard input to wherever your cursor is. – jorfus Jan 06 '17 at 22:50
  • 1
    Just FYI: Most smartphones do have USB ports (the charging port), which can be used to connect external USB devices. You just need an appropriate adapter/cable, which can be obtained for a couple/few $, or a device that has a micro USB connector. USB devices which natively have such connectors (i.e. that don't require adapter cables to plug into phones) are becoming more common. – Makyen Jan 07 '17 at 07:47
  • Could it be [this](http://www.pcworld.com/article/190015/secure_online_banking.html)? – VL-80 Jan 07 '17 at 22:40
  • I like how according to your impression, "security seems to have been dramatically enhanced", with the "[m]ost [important]" change being an identification method you "[have] never seen [...] before". Security is a feeling, most importantly ;) – bers Jan 09 '17 at 07:16
  • @Michael no, not a single password used over and over... a new one time password each time the button is pressed, validated by the hardware vendor by whatever site you are tying to log in to that supports yubikey (a fair few, infact). It is also a second factor authentication method, so is used on top of your normal password. – James T Jan 09 '17 at 08:44
  • It's like the dongle some software companies made you buy. I don't know if they still do that or not nowadays. – johnny Jan 09 '17 at 22:15

9 Answers9

65

What your bank gave you is an USB security token with a digital certificate (like these). These are standardized hardware devices which almost every operating system supports plug&play out of the box. They are very common for implementing multi-factor-authentication to high-security systems in enterprise IT.

Your web browser uses HTTPS with client-based certificates to access your bank's website. It uses your operating systems certificate store to find an installed certificate which matches the identity the webserver requests. When you have a standard USB security token installed, the operating system will also look for any certificates on the token.

The operating system can not do the verification process with the webserver by itself, because the token doesn't allow to read the private key of the certificates stored on it directly. The token includes the hardware to do the verification. So the private key never leaves the USB stick. That means even if your PC is compromised by malware, the private key of the certificate isn't in danger of being stolen (but keep in mind that this method doesn't provide any protection after the authentication was successful. Malware can still screw with your web browser).

By the way: Which bank is that? If my bank would also support this authentication method, I might even start doing online banking.

Philipp
  • 48,867
  • 8
  • 127
  • 157
  • 4
    I think the OP was wanting to know more about the mechanism for how the USB drive provides security. Do you have any more information about how a USB security token like you describe would work for logging in to a bank website? It doesn't sound from the description that any sort of installation was necessary, nor were there any user prompts. – Thunderforge Jan 06 '17 at 18:23
  • 7
    A USB security token will not work on every operating system. Aladdin tried for years and failed. The etoken driver for linux does not work out of the box and is not installed. opensc is also not installed at default. PLUS: You need to add the PKCS11 module to your browser... – cornelinux Jan 06 '17 at 19:18
  • 2
    I think that what he is basically saying is that it is pre-installed into the OS, so there's nothing *more* needed to install. – Puppy Jan 07 '17 at 17:52
  • 1
    Keep in mind that while the dongle is plugged in any malware will have the same access to the certificates as the browser has so it's not something to keep plugged in. – ratchet freak Jan 09 '17 at 13:12
  • 1
    Note that this only applies only to applications using the Windows certificate store. A prominent example of this behavior are Chrome and Edge. Firefox OTOH will not work without a PKCS#11 module. – SEJPM Jan 09 '17 at 17:11
28

One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect to claim that "it works in any device that has a USB port, Windows, Mac, Linux and more, and to work out of the box".

Did they claim that it works in any browsers or just any OS?

Lie Ryan
  • 31,089
  • 6
  • 68
  • 93
  • 1
    That doesn't tally with the bank's claim. – Julian Knight Jan 06 '17 at 15:07
  • 7
    +1 This sounds right. It's an open source mechanism, which means it's likely implemented by Microsoft/Linux/Apple. Of course, the bank's claim that it works on *any* computer with a USB port is nonsense. I have a box that runs MenuetOS, and I can pretty much guarantee it won't work with that OS. – phyrfox Jan 06 '17 at 22:57
  • 1
    @phyrfox Well, technically it works with *nearly* any device that has USB port, you just have to install Linux first. – Hannes Karppila Jan 09 '17 at 15:26
  • @phyrfox: well quite. I have a box I just scrubbed clean, with no OS installed at all, let alone a browser, and it doesn't work on that either. I guess when a bank says "any computer" or "your computer", read the small print, they don't mean *any* computer I might own. And they aren't guaranteeing anything anyway, it's not like I can demand my money back when it doesn't work on my Atari ST. – Steve Jessop Jan 10 '17 at 12:53
25

....they don’t require the user to install any software on the machine.... I thought that the ability for a webpage to browse the file system freely without user action is too commonly restricted by default

Yes, that should definitely not be possible without smartcard drivers. This is a fundamental security mechanism of any browser. What gives the clou that the certificate is read without clicking an "open file" dialog, a Java dialog or pre-installing drivers? You said you chose another verification option.

This sounds like the USB key used, for example, by the Bank Of China. Such technology is described here.

was said to be compatible with "any device that has a USB port"

Having a PKCS#11 cert, or a #12 to combine with a passphrase will work on all OSses. This is the same way password managers like keepass work, combining something you know with something you have to get 2 factors of authentication.

J.A.K.
  • 4,793
  • 13
  • 30
  • 1
    Interesting answer, thank you! There is no open file dialog, I did check because it was the first think that came to my mind. –  Jan 06 '17 at 08:59
  • 2
    Then it still could be a pre-installed browser plugin or smartcard driver. You were right on your analysis, there should be no way "out of the box" to do this, but with popup or some small user interaction, this does make sense. – J.A.K. Jan 06 '17 at 09:33
  • 4
    @Zazor: I think you do not own such a stick. How can you know, there is no open file dialog? – cornelinux Jan 06 '17 at 19:16
  • What if it simply pretends to be a generic keyboard? – jorfus Jan 06 '17 at 22:51
  • 3
    @cornelinux I plugged a stick of my own then tried to log to the website. It stated "your key is not valid" but I could see the login interface does not ask the user to open a file –  Jan 07 '17 at 04:57
  • So what does the "lsusb" or the device manager in windows tell you about this "stick"? – cornelinux Jan 07 '17 at 09:17
  • " a stick of my own" - is it the stick you decribe? i thought you opted for a different verification option. If it is, yes, please give us the output of lsusb so we can get an idea of what the stick does. – J.A.K. Jan 07 '17 at 12:33
  • 2
    @J.A.K. no, I had my own USB stick plugged in. It's totally unrelated to the identification process; I just wanted to test what happens when you try to login *without* the proper stick –  Jan 08 '17 at 08:19
  • 3
    The login application will match the USB by its type or manufacturer. I don't think you will get any information from throwing a random USB in the mix. – J.A.K. Jan 08 '17 at 13:45
12

It's probably just a USB smartcard reader, with inserted SIM sized smartcard.

Manual installation of drivers is not needed since at least generic drivers for both reader and card are already installed in most modern OSs.

See the image below for example of such device:

Photo of USB device.

There is certificate with private key stored on that SIM smartcard inside reader. When you plug it in the computer, that certificate from smartcard gets loaded into OS certificate store. From there on it basically behaves just like any other certificate which is saved on computer and can be used for accessing secured resources, signing documents/mail, encrypting stuff, etc.

This one in particular is issued by Cert Authority which is trusted by my bank (web banking) and State (mostly used by me for IRS related stuff and requesting real documents).

Anders
  • 64,406
  • 24
  • 178
  • 215
user2720406
  • 121
  • 3
  • 4
    *"When you plug it in the computer, that certificate from smartcard gets loaded into OS certificate store"* What you describe, if true, doesn't seem to be a feature, but a security hole in the OS. I'd be worried if anyone could plug a USB stick into my computer and upload arbitrary files. – chue x Jan 08 '17 at 17:57
  • 2
    It's not arbitrary file that's get loaded into computer, but a digital certificate, which by itself cant do any damage - presuming that the implementation of whole digital certificate handling stack of software had been done correctly in the OS (which most definitely should be) Also, you don't just stick random USB sticks and let random USB sticks be stuck into your computer. If you do that, the computer can be considered compromised anyway. – user2720406 Jan 08 '17 at 22:51
  • 2
    @chuex, that is literally the point of USB sticks. – Stack Tracer Jan 09 '17 at 01:43
  • That wouldn't work with all OSes though - definitely not Linux at least (I have yet to see a distro which includes OpenSC out of the box). – André Borie Jan 09 '17 at 09:30
  • 1
    @StackTracer Not every small USB devices is a file store ("USB Flash Drive"). Cf. [Phillip's answer](http://security.stackexchange.com/a/147497/88532). – jpaugh Jan 09 '17 at 17:15
  • @jpaugh, I am aware. Not sure how that is relevant to my comment. – Stack Tracer Jan 10 '17 at 00:14
  • @StackTracer "Mass storage" is only one class of USB "sticks." There's also a "Content Security" device class (aka DRM), which seems to describe the OP's device, and is presumably also rectangular (i.e. "stick shaped"). [List of USB device classes](http://www.usb.org/developers/docs/devclass_docs/) – jpaugh Jan 10 '17 at 15:41
  • @jpaugh, that does not make my statement any less valid. – Stack Tracer Jan 11 '17 at 05:23
11

It's most likely a device that pretends to be a keyboard and is thus recognized by any OS without requiring special drivers. Internally, it would probably use HOTP (or TOTP, if it had an RTC chip and a battery) and just "type" the OTP each time the button is pressed, like a Yubikey or similar U2F device.

The browser doesn't talk nor know the USB is there; it just instructs the user to press a physical button on the device (to tell the device to "type" the code, as the browser itself can't talk to it) and then interprets whatever keystrokes (up to the length of the code) it receives as coming from the device.

André Borie
  • 12,706
  • 3
  • 39
  • 76
  • You're suggesting something similar to a [Yubikey](https://www.yubico.com/products/yubikey-hardware/yubikey4/) I don't think that tallies with what the OP described. – Rob C Jan 06 '17 at 09:49
  • 3
    @RobC this is most likely the only solution that fits the bill for WIndows/Mac/Linux compatibility without requiring drivers. Anything else would require either a browser plugin, a driver, or both, which definitely doesn't correspond to what the author described. – André Borie Jan 06 '17 at 10:25
  • 3
    I agree with Rob, it seems unlikely that a bank would use that solution. If the USB stick would emulate a keyboard, how would it intercept these responses in the browser and reply a token? It would interact with the computer which would look very creepy to the average user. I can't think of a clean way of achieving what the OP described by using a keyboard emulated USB. As mentioned by J.A.K., the OP didn't use the USB stick so there might be some installation, approval required by the user. – Silver Jan 06 '17 at 10:50
  • @Silver there is no interaction needed between the stick and the browser. It's just a second factor like TOTP or HOTP. – André Borie Jan 06 '17 at 10:55
  • 8
    @AndréBorie, that could work. You could test it by pressing the button in a notepad window. This would require the user to have the TOTP field focussed in the browser. There is too little information to figure out what the mechanism is though. Maybe the OP can specify the bank that is using this so everyone can do more research. – Silver Jan 06 '17 at 11:04
  • I also just discovered about U2F. I think Lie Ryan answer should be the accepted answer. – Silver Jan 13 '17 at 14:16
9

Sounds like a theoretical idea I had about a decade ago.

Pretty much every OS supports USB network devices. Your USB stick may pretend to be a network card, connected to a a local network, with a webserver on that network too. That webserver can have HTTPS certificates, too.

Your webbrowser can make HTTPS requests to that webserver, and discover that the USB stick and bank website trust eachother. This isn't considered a sandbox escape, because neither the browser nor the OS know that the webserver is actually on the USB stick.

IP warning: to the best of my knowledge, my former employer holds a patent on this idea in most jurisdictions. Contact a patent attorney before copying this idea.

MSalters
  • 2,699
  • 1
  • 15
  • 16
  • How would the browser know the Domain Name or IP of that webserver? – Marcel Jan 06 '17 at 14:12
  • 4
    @Marcel The web server on the USB device could set a static IP for its own. The web application can then connect to that IP address. E.g., the web server could set its IP to 12.34.56.78 and the web application could then load a resource like https://12.34.56.78/.well-known/verify-user/[unique-id] and then verify the resource actually loads (and maybe check it's contents) – BlueCacti Jan 06 '17 at 14:36
  • 2
    Basically, PoisonTap (https://samy.pl/poisontap/) for good? – Matthew Jan 06 '17 at 14:54
  • 4
    Wouldn't adding a network card be a privileged operation restricted by the OS? – Josh Sanford Jan 06 '17 at 14:57
  • I have never heard of this method being used on a large scale. – Philipp Jan 06 '17 at 15:00
  • 1
    @JoshSanford Unfortunately, it is not restricted on Windows. See https://www.grc.com/sn/sn-576.htm, find "USB network adapters" – Marcel Jan 06 '17 at 15:07
  • 2
    @Marcel: And the domain name could be `usbstick.example.bank` since the bank knows what IP the device will be claiming. This would take a single /30 that can be shared across all USB sticks of that bank. Even better, you can **also** have the same IP on the public internet. The PC will choose the better route (local) when the USB is plugged in, and the worse route (internet) when not. The latter webserver will just serve an image "Plug in your USB stick!". – MSalters Jan 06 '17 at 15:24
  • 1
    @JoshSanford: With USB and Wifi it's usually not anymore. People started complaining why the f**k would their wifi require root password and they expected it to be just plug and play. Famously Linux Torvalds himself complained that linux should not require root password to do things like switch printers or join a wifi network. Some distros still make it restricted, it's not a feature of the kernel but more of how the distro was configured. – slebetman Jan 08 '17 at 07:49
7

As some of the other answers mentioned, this is most likely a USB security token. Think of it as a smart card reader + embedded smart card (and sometimes they are actually implemented this way). Think CAC card used by US defense organizations. Think PGP card. Some Yubikey models also support acting as a smart card.

This kind of devices is widely used by banks in China to protect their online banking website / desktop client software, and my answer is mostly based on my personal experience using these tokens in China.

How do you use it?

When you sign up for online banking and opt for a USB token, the bank gives you the token, creates a public/private key pair and your personal certificate, and load those into the token. You set a password on the token, which is separate from your online banking login password.

You install the driver provided by the bank on your personal computer, plug the token in, and navigate to the bank's website. Whenever you log in or perform a sensitive operation (transferring funds, changing contact information, authorizing online purchase, etc.), the browser / operating system prompts for your token password, the light on the token blinks for a few seconds, and the transaction goes through.

Wait, I have to install drivers?

Yes. The Windows operating system has a standard smart card interface, but each model of USB token still requires a driver. Very rarely, Windows Update will install the correct drivers for you, but in most cases you will have to download a package from the bank's website.

Often the only supported operating system is Windows, and the only supported browser is IE. (They like them some ActiveX.) It is certainly possible in general for smart cards / USB tokens to support other OS / browsers, see CAC card above; you have to check compatibility with your own bank.

So how does it authenticate you?

The browser asks the OS to ask the token to sign a small piece of data (perhaps your transaction details). The token signs it, using your private key and certificate. The browser sends the signature to the bank. The bank verifies the signature, and is satisfied that only the token they gave you have the private key to produce this signature.

The private key never leaves the token. If properly designed, the token should never divulge the private key.

twisteroid ambassador
  • 771
  • 4
  • 6
5

First of all, let me state that I am quite skeptic of the claim by a non-technical employee that it works on "any device that has a USB port", regardless of browser or OS. I wouldn't be surprised if the supported OS turned out to be just a couple of Windows versions (and, maybe, MacOS). However, it is interesting to think how such a device could work.

Most solutions not requiring drivers, like the André Borie proposal of a usb keyboard, would require however some extra interface (like a hardware button).

Still, the post of user2720406 gave me an idea for a device that would indeed work [on certain places] for any [switched on] device that has a USB port:

The usb device would simply a contain a SIM card, using that to access the internet on its own through GPRS/3G. Then the device would simply send digitally signed messages of «Customer with token 12312121 is using online banking». The online session is not allowed unless one was received in the last 5 minutes (plus maybe other factors, like the IP of the customer having a similar geolocation to the IP of the device). Thus, the usb port would only be used for power, and the device be completely independent on what is installed on the computer.

Ángel
  • 17,578
  • 3
  • 25
  • 60
2

This sounds like a Yubikey. They're well known and work great. https://www.yubico.com/products/yubikey-hardware/yubikey4/

  • Regarding not needing drivers: The Yubikey identifies itself as a keyboard so any machine with a keyboard driver can read the text output from it.
  • How it works: You push the button and the Yubikey issues a public key (from a secure private key embedded in the device). The bank can then authenticate you and confirm that you have the thing you know (your password) and the thing you have (your physically secured private key).

  • Why it's secure: It's not possible for software on your computer to get access to your private key so malware cannot copy the key and pretend to be you. It would have to be physically stolen from you. (which is possible, but that's why you pair it with something you know)

  • Who uses them and why: Google helped design the yubikey so they could solve the problem of malware on a computer grabbing local credentials while the user was not present. Every Google engineer has one. I've used them for years and deployed numerous 2fa solutions around them.

jorfus
  • 441
  • 3
  • 6
  • According to the website yubikey also identify itself as smartcard and smartcard reader. – Lucas Jan 06 '17 at 22:57
  • The YubiKey uses generic drivers already available in Windows: For the YubiKey Standard / Nano, and any device with an OTP mode (Edge, NEO, etc.): Keyboards > HID Keyboard Device (same as plugging in an external keyboard) – jorfus Jan 06 '17 at 23:17
  • On newer operating systems it probably gets identified by name, but my point is, it works fine on any machine I've ever plugged it into. I've never seen a "unknown device" warning. – jorfus Jan 06 '17 at 23:18
  • If it types in, then it sounds like it is just text that could then be captured by the user or malware and used separate from the device. – MikeP Jan 08 '17 at 01:45
  • Absolutely, this is simply a one-time token. Malware containing a key logger will always be able to log the password and the OTP (even if you're typing in the OTP from a keychain fob). What this prevents is the malware from exfiltrating those credentials and using them again later. – jorfus Jan 09 '17 at 23:26