Naavi.org

In India, Banks  are pushing Customers to interact with them only through ATMs. Even RBI is encouraging this mode of interaction and discouraging customers from visiting bank branches.

As a result of this policy, Bank customers are being exposed to increased levels of insecurity in their Banking transactions. Apart from the various incidents reported in India involving skimmers and hacking of ATMs, the video in this link provides a clear indication of how unsafe are the current systems.

Please view this Video which contains a demo in a hacker’s conference.

A Complete demonstration and details of how the systems were compromised are available here

Related Article in bankinfosecurity.

In one of the attacks, the demonstrator reprogrammed the ATM remotely over a network, without touching the machine; the second attack required he open the front panel and plug in a USB stick loaded with malware.

The ATM fraud is therefore a threat looming large in Indian Banks. Hence there is a need for a special ATM security mechanism to be introduced by the Banks to protect themselves and their customers.

Hope RBI will take note.

Naavi

The public outcry on the US program “PRISM” under which US Government is said to be spying on Cyber Communication of individuals has naturally raised some attention on the Indian situation.

Under ITA 2008 there are powers for the Government to intercept cyber communication under reasons of national security, prevention of cognizable crimes etc. However it is also true that Indian intelligence agencies often resort to interception without adequate legal sanction or procedures. The past indications clearly point out the misuse of intelligence for political purposes also. Since India does not have a strong “Privacy” law, it is presently difficult to prevent surveillance by intelligence agencies. The Government also uses the ISP licensing regime to gain access to ISP data.

It is believed that not only the Indian Government but also several other countries such as UK and Australia have huge surveillance mechanisms in place.

Though Government of India has recently stated that their National Security agencies may tap only the meta data and not go into content, the assurance can only be taken with a pinch of salt. Individuals therefore need to bank upon private encryption if they want privacy. Though law may still be invoked by the Government to demand decryption, in a majority of cases the user may at least be aware that his communication is being monitored.

The biggest challenge for the security agencies is to ensure that the need to monitor criminal activities where they genuinely need power to surreptitiously carry on surveillance is suitably met. In such cases the intelligence agencies may need to break the encryption themselves. Since breaking a strong encryption could be difficult, any person using encryption could be treated as a “Suspect” in the eyes of the Government and may be subjected to physical surveillance as well. The cost of security of the nation is therefore likely to sky rocket in the coming months.

In order to find a solution to this problem it is necessary for the Indian intelligence agencies to broker a treaty with the privacy community, establish a trusted relationship so that common public would not resort to wide usage of encryption and make national security costs prohibitive. For this purpose Government should offer a system of Monitoring of  surveillance agencies by a committee” consisting of select members of public and putting in place a strict regime of procedures that the mechanism would not be used for political and tax purposes.

Related Article in ET

Naavi

It is reported that Indian intelligence agencies have flagged a mobile application by name WeChat developed by a Chinese company “Tencent” as a “Threat”.

After the revelation about the US intelligence program PRISM through which the US Intelligence agencies are reportedly spying on all communications passing through Google, FaceBook etc. it appears that intelligence agencies in India also have become a little more alert.

The threat of Chinese intelligence agencies intruding into Indian Cyber Space is well known. The WeChat may be one such application. However there are bigger threats since India imports a huge number of computers, laptops and mobiles from China, some of which are branded where there could be backdoors at the OEM level.

Until the dependence on China for IT assets is removed, Indian Cyber Space will remain vulnerable. Hence one important aspect of Indian Cyber Security program should be encouragement of a large scale indigenous investment in Cyber Security research and subjecting all Chinese products to be put through a security check for certification.

I urge Indian Corporates to also think in the direction of setting up specialized Cyber Security labs that can analyze source codes and test hardware for security. The Government backed security lab led by IISc Bangalore has lost credibility since it is reported to carry substantial funding  by the Chinese Company Huawei itself.

Related Article:

Naavi