Leveraging cellular infrastructure to improve fraud prevention

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2009, Pages 350-359

  Park, Frank S ^a   Gangakhedkar, Chinmay ^a   Traynor, Patrick ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

Cellular networks; Credit card authentication; Infrastructure assisted security; Mobile phones; Multi factor authentication

Indexed keywords

AUTHENTICATION INFRASTRUCTURE; CELLULAR NETWORK; CREDIT CARDS; INFRASTRUCTURE-ASSISTED SECURITY; MULTI-FACTOR AUTHENTICATION;

AUTHENTICATION; CELLULAR NEURAL NETWORKS; COMPUTER APPLICATIONS; COST REDUCTION; MOBILE DEVICES; MOBILE PHONES; PUBLIC WORKS; TELEPHONE; TELEPHONE SETS;

WIRELESS NETWORKS;

EID: 77950798658     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2009.40     Document Type: Conference Paper

References (53)

1. The State of New Hampshire Supreme Court: Estate of Helen Remsburg v. DocuSearch, Inc. http://epic.org/privacy/boyer/brief.html, November 2002.
2. 3G Newsroom. U-TDOA technology standardized by 3GPP. 3GPP, May 2003.
3. M. Abadi and B. Blanchet. Analyzing Security Protocols with Secrecy Types and Logic Programs. In Proceedings of the ACM Symposium on Principles of Programming Languages (POPL), 2002.
4. M. Abadi and B. Blanchet. Computer-Assisted Verification of a Protocol for Certified Email. 2003.
5. B. Blanchet. ProVerif: Cryptographic protocol verifier in the formal model. http://www.proverif.ens.fr/, 2003.
6. B. Blanchet and A. Chaudhuri. Automated Formal Analysis of a Protocol for Secure File Sharing on Untrusted Storage. In Proceedings of the IEEE Symposium on Security and Privacy (OAKLAND), 2008.
7. L. Bruce. Skimming the cash out of your account. http://www.bankrate.com/ brm/news/atm/20021004a.asp, 2003.
8. calleridspoofing.info. calleridspoofing.info: The definitive resource on Caller ID spoofing. http://www.calleridspoofing.info/, 2008.
9. CardTechnology. UAE ID Card To Support Iris Biometrics. http://www.cardtechnology.com/article.html?id=20070423V0XCZ91L, 2007.
10. Cellular Telecommunications Industry Association. Wireless Quick Facts. http://www.ctia.org/advocacy/research/index.cfm/AID/10323, 2008.
11. Cisco Systems, Inc. Cisco Wireless Location Appliance. www.cisco.com/en/US/prod/collateral/wireless/ps5755/ps6301/ps6386/ product-data-sheet0900aecd80293728.pdf, 2007.
12. CNET News. PayPal to offer password key fobs to users. http://news.cnet.com/PayPal-to-offer-password-key-fobs-to-users/2100-7355 3-6149722.html, 2007.
13. D. Danchev. Phishers apply quality assurance, start validating credit card numbers. http://blogs.zdnet.com/security/?p=2095, 2008.
14. S. Drimer and S. J. Murdoch. Keep Your Enemies Close: Distance Bounding Against Smartcard Relay Attacks. In Proceedings of USENIX Security Symposium (SECURITY), 2007.
15. C. Ellison and B. Schneier. Ten Risks of PKI: What You're Not Being Told About Public Key Infrastructure. Computer Security Journal, 16(1):1-7, 2000.
16. Entrust. Multifactor Authentication with IdentityGuard. http://www.entrust.com/strong-authentication/identityguard/index.htm, 2009.
17. EuroSmart. White Paper: Smart USB Token. www.rfidinfo.jp/whitepaper/741. pdf.
18. J. Evers. T.J. Maxx hack exposes consumer data. http://news.cnet.com/T.J. -Maxx-hack-exposes-consumer-data/2100-1029 3-6151017.html, 2007.
19. Experian Group. Increasing the effectiveness and efficiency of fraud detection for Bank Zachodni WBK. http://www.experian-da.com/news/enews-0903/ Story10.html, 2009.
20. J. Fredericks. Armenian Mob Imiplicated in Credit Card Scheme. http://www.beaconcast.com/articles/20090103, 2009.
21. Google Inc. Google Android. http://code.google.com/android/, 2008.
22. J. Heary. Black Hat 2008 Day 1 Phishers posting credit card info for all to see and a new DNS cache poisoning trick. http://www.networkworld.com/ community/node/30822, 2008.
23. HSN Consultants Inc. The Nilson Report. http://www.nilsonreport.com/ recentissues.htm, 2009.
24. Keynote Systems. AT&T Wireless and Verizon Wireless Lead in Performance on Keynote Wireless SMS Index for April through June. http://www.allbusiness.com/media-telecommunications/5990369-1.html, 2002.
25. B. Krebs. 14 Arrested for Credit Card, Phishing Scams. http://voices.washingtonpost.com/securityfix/2006/11/14-arrested-for-credit- card-ph-1.html, 2006.
26. B. Krebs. FBI Tightens Net Around Identity Theft Operations. http://www.washingtonpost.com/wp-dyn/content/article/2006/11/02/AR2006110201579. html, 2006.
27. E. Larkin. Massive Theft of Credit Card Numbers Reported. http://www.pcworld.com/article/158003/heartlandtheft.html?tk=rss news, 2009.
28. J. Leyden. Visa trials PIN payment card to fight online fraud. http: //www.theregister.co.uk/2008/11/10/visa one time code card/, 2008.
29. Microsoft Corporation. Bank Employs SMS Messaging System to Protect Customers from Credit-Card Fraud. http://download.microsoft. com/download/8/f/0/8f02f193-320c-4d0c-b4df-6578e9254ad6/ RaiffeisenBankCaseStudy.doc, 2006.
30. MobiClear Ltd. http://www.mobiclear.com, 2008.
31. OpenMoko. Openmoko - Open. Mobile. Free. http://openmoko.com, 2009.
32. T. Pantin. Chip and pin system to be intrduced. http://www.thenational. ae/article/20090202/NATIONAL/836355499/0/NEWS, 2009.
33. PayPal. PayPal Security Key. https://www.paypal.com/cgi-bin/webscr?cmd= xpt/Marketing CommandDriven/securitycenter/PayPalSecurityKey-outside, 2009.
34. V. Prevelakis and D. Spinellis. The Athens Affair. IEEE Spectrum, March 2005.
35. Research Network Operations Center. WhereAmI. http:// ANONYMIZED/, 2004.
36. P. Roberts. US Bancorp teams up with VeriSign on banking security. http://lists.virus.org/cryptography-0410/msg00110.html, 2004.
37. L. Rohde. MasterCard offers SMS to detect credt card fraud. http://www.computerworld.com/action/article.do?command=viewArticleBasic& articleId=99660, 2005.
38. RSA Security. RSA SecurID. http://www.rsa.com/node.aspx?id=1156, 2009.
39. SiPix Imagining, Inc. World's First ISO Compliant Payment DisplayCard using SiPix and SmartDisplayer's Flexible Display Panel. http://www. businesswire.com/portal/site/google/index.jsp?ndmViewId=news-view&newsId= 20060510006193&newsLang=en, 2006.
40. M. Spirito. On the accuracy of cellular mobile station location estimation. IEEE Transactions on Vehicular Technology, 50(3), May 2001.
41. A.-B. Stensgaard. Biometric breakthrough - credit cards secured with fingerprint recognition made feasible. http://www.ameinfo.com/58236.html, 2006.
42. TMCnews. Credit Card Theft by Spyware Elite Toolbar (EliteBar); SaferSurf.com Warns: Spyware Elite Sends Credit Card Information to Third Parties. http://www.tmcnet.com/usubmit/2005/jul/1166104.htm, 2005.
43. P. Traynor. Characterizing the Limitations of Third-Party EAS Over Cellular Text Messaging Services. Technical report, 3G Americas Whitepaper, 2008.
44. P. Traynor, W. Enck, P. McDaniel, and T. La Porta. Exploiting Open Functionality in SMS-Capable Cellular Networks. Journal of Computer Security (JCS), 2008.
45. P. Traynor, W. Enck, P. McDaniel, and T. La Porta. Mitigating Attacks On Open Functionality in SMS-Capable Cellular Networks. IEEE/ACM Transactions on Networking (TON), To appear 2009.
46. P. Traynor, P. McDaniel, and T. La Porta. On Attack Causality in Internet-Connected Cellular Networks. In Proceedings of the USENIX Security Symposium (SECURITY), 2007.
47. US Department of Justice. Retail Hacking Ring Charged for Stealing and Distributing Credit and Debit Card Numbers from Major U.S. Retailers. http://www.usdoj.gov/opa/pr/2008/August/08-ag-689.html, 2008.
48. VASCO. DigiPass Products. http://www.vasco.com/products/product.html? product=47, 2009.
49. VeriSign. A Guide to Providing Proactive Protection to Consumer Online Transactions. http://www.verisign.com/authentication/authentication-resources/ proactive-consumer-protection-guide/index.html, 2008.
50. Visa Europe. Chip and PIN - The Facts and the Future. http://www.visaeurope.com/pressandmedia/factsheets/chipandpin.jsp, 2009.
51. H. Weisbaum. Paying at the pump just got more risky. http://www.msnbc. msn.com/id/27085818/, 2008.
52. B. Woolsey. Credit card 'phishing': What it means, how to prevent it. http://www.creditcards.com/credit-card-news/phishing-credit-card-scam-fraud- 1282.php, 2008.
53. W. Yan and D. Chiu. Enhancing E-Commerce Processes with Alerts and Web Services: A Case Study on Online Credit Card Payment Notification. In Proceedings of the International Conference on Machine Learning and Cybernetics, 2007.