Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
Linux Business Firefox Security The Almighty Buck Ubuntu News

Can Ubuntu Save Online Banking? 462

CWmike writes with a pointer to this ComputerWorld mention of an interesting application of Live CDs, courtesy of Florida-based regional bank CNL: "Recognizing that most consumers don't want to buy a separate computer for online banking, CNL is seriously considering making available free Ubuntu bootable 'live CD' discs in its branches and by mail. The discs would boot up Linux, run Firefox and be configured to go directly to CNL's Web site. 'Everything you need to do will be sandboxed within that CD,' [CNL CIO Jay McLaughlin] says. That should protect customers from increasingly common drive-by downloads and other vectors for malicious code that may infect and lurk on PCs, waiting to steal the user account names, passwords and challenge questions normally required to access online banking." (But what if someone slips in a stack of doctored disks?)
This discussion has been archived. No new comments can be posted.

Can Ubuntu Save Online Banking?

Comments Filter:
  • Reply (Score:5, Funny)

    by Pharmboy ( 216950 ) on Thursday March 25, 2010 @08:03PM (#31619830) Journal

    (But what if someone slips in a stack of doctored disks?)

    What do you mean, like a disk that would boot Microsoft Windows instead?

    • Re:Reply (Score:5, Interesting)

      by Cryacin ( 657549 ) on Thursday March 25, 2010 @08:07PM (#31619872)
      I actually think this is a good idea. Gives the user something physical to insert, that way they understand it. It also reduces the number of variables in the transaction process.

      Hence, if you're too lazy, don't have the knowledge or it isn't economically viable to get someone in that can secure and configure your computer system, this seems like a sane alternative that makes it a bit harder for a black hat to come in and pillage your account.
      • Re:Reply (Score:5, Insightful)

        by GIL_Dude ( 850471 ) on Thursday March 25, 2010 @08:18PM (#31619970) Homepage
        I guess for those people who shut down their computers more than once a day it would be fine. For those of us who reboot about once a month and use sleep / resume the rest of the time it is a terrible idea to be rebooting all the time to do banking (maybe twice a day sometimes, but at least a couple of times a week). Why would anyone want to put up with that? Even for folks willing to accept it, the bank would inevitably get a smattering of "the wireless doesn't work on my netbook" or something (even though Ubuntu live CD's are pretty good about support they can't manage to support every device). I would be more accepting of a VM or something though than a live CD for my own use.
        • Re: (Score:2, Insightful)

          by Anonymous Coward

          I believe you, obviously a technical person, are free to set up a VM.

          However, Joe Average won't care to setup or purchase a VM for his current operating system, but will settle for rebooting and losing maybe 30s of productivity for it.

        • Re: (Score:2, Informative)

          by Anonymous Coward

          Then boot the live cd in a VM... Jeez...

        • Re:Reply (Score:4, Informative)

          by obarthelemy ( 160321 ) on Thursday March 25, 2010 @09:11PM (#31620496)

          I'm wondering: If I'm running WIndows, and setup the bank's Linux in a VM, am I still vulnerable to windows's trojans and keyloggers ? I would guess Yes, because keystrokes go WIndows -> VM manager -> Linux VM ? Or not ?

          • Re:Reply (Score:4, Informative)

            by selven ( 1556643 ) on Thursday March 25, 2010 @09:28PM (#31620660)

            A VM is just a program, so any keystrokes will be sent to both the VM and whatever other program feels like it needs them. What you won't have, however, is contextual information - it's not as easy to tell when you're typing in a password in the VM from the host.

        • You do realize that most if not all Virtual Machines allow you to run physical discs, right? Or that it's trivial to convert said discs into images that any VM package will accept.

          It's ultimately probably a better idea to have to boot into it rather than using something else as it makes it more of a deliberate process. A bit of a pain, but more deliberate in nature. Anybody that can't figure out how to work around the reboot limitation shouldn't be doing so anyways.
        • Re:Reply (Score:4, Insightful)

          by fuzzyfuzzyfungus ( 1223518 ) on Thursday March 25, 2010 @11:09PM (#31621414) Journal
          If you can't trust the client, a VM is of limited use(not zero use, the union of "the set of machines with malicious Browser Helper Objects that steal banking credentials" and "the set of machines with keyloggers" is almost certainly larger than "the set of machines with keyloggers"); but once a home user box is 0wned, there is very little stopping malware#1 from inviting malwares#2-#N as the situation dictates.

          At some point, at least for banks and accounts with real money in them, it will become economic to ship dedicated appliances and skip the LiveCD/reboot/hardware incompatible/etc problem entirely. There are several possibilities: Imagine, for instance, something like the Beagleboard [], but stripped down(no need for that fancy CPU or most of the I/O, something cheaper can load the bank website), and locked down: sealed in a tamper evident plastic box, CPU has on die verification of the bootloader, bootloader will only load signed system image, etc. All that tivoization stuff that gets the Trusted Computing Group excited. Should be under $100, possibly even under $50, in reasonable volume and nigh impossible to crack by software means(and hard to crack by hardware means without the target noticing. It doesn't really matter much if some hobbyist manages to crack his own, with prolonged physical access, that is his business). Just plug in a monitor, ethernet cable, keyboard, and mouse, and away you go.

          For the terminally clueless(no pun intended), for whom peripheral hookup is a bit daunting, there would be nothing stopping you from charging a touch more and shipping a whole netbook. Even full x86 netbooks can be found at ~$200 with fair frequency, and nasty little PDA-in-a-netbook's-body offerings have been under $100 for a while now.

          If even networking is too much of a challenge, you could go the Amazon route of baking in cell access: with proper caching and/or the use of a dedicated application preloaded on the client, the amount of data transfer for most people's banking needs would be tiny(and banks love adding monthly fees, so I'm sure they could find some way to recover the cost).
        • Re: (Score:3, Interesting)

          by Zordak ( 123132 )
          Why not just hibernate your main OS and then boot into the live CD? It doesn't take that long to load the memory snapshot from a cold boot.
      • Re:Reply (Score:5, Insightful)

        by Khyber ( 864651 ) <> on Thursday March 25, 2010 @08:29PM (#31620108) Homepage Journal

        "Gives the user something physical to insert"

        Except the netbook owners, whom have no optical drive.

        • Re:Reply (Score:4, Informative)

          by MaskedSlacker ( 911878 ) on Thursday March 25, 2010 @09:02PM (#31620420)

          USB drive then?

          • Re:Reply (Score:5, Insightful)

            by rabiddeity ( 941737 ) on Friday March 26, 2010 @04:44AM (#31623140) Homepage

            >USB drive then?

            If you're going to do that, then you might as well just make an intelligent crypto token that generates a sequence of numbers according to some known algorithm. The device should have a set of buttons (akin to a small PIN pad) where the user enters a known sequence of buttons on the device itself. Online bank software either queries the device directly as USB (which may introduce other security issues) or has the user enter a set of numbers from an onboard display, in addition to their username and password. A single PIN entry allows a single login session. For extra security have the user press a "confirm" button on the device and perform another verification every time money is transferred or other sensitive operations take place.

            Prevents access via software keyloggers, because the buttons are on the device itself. Provides two-factor authentication, making phishing attacks a little bit tougher if done correctly. Should be reasonably cheap. And it's a lot more convenient than booting into another OS to do your banking.

        • Re: (Score:2, Funny)

          by Anonymous Coward

          You replied to that post without a smutty joke.

        • If your only computer is a netbook...

          You're doin' it wrong!
        • Re: (Score:3, Insightful)

          by Dhalka226 ( 559740 )
          Well, so what? Just because it doesn't solve every possible problem for all possible users doesn't mean it's not worth doing.
      • Re: (Score:3, Insightful)

        by hairyfeet ( 841228 )

        The problem with this idea is it is gonna be a nightmare for support. Lets be honest folks..while Ubuntu and other Linux distros have come a loooong way on hardware support, there is still an assload of funky cheapo hardware out there that Linux isn't gonna work well with, and the kind of folks that would require this kind of help certainly aren't gonna be technical enough to run a bunch of CLI crap to get their cheap ass wireless card or other cheap shit to go. How well does Ubuntu support those funky SiS

    • Re:Reply (Score:5, Funny)

      by flyneye ( 84093 ) on Thursday March 25, 2010 @08:36PM (#31620188) Homepage

      (But what if someone slips in a stack of doctored disks?)

      Well don't leave 'em layin' around on the floor and no one will slip on them.

    • Re:Reply (Score:4, Funny)

      by WrongSizeGlass ( 838941 ) on Thursday March 25, 2010 @09:13PM (#31620520)

      What do you mean, like a disk that would boot Microsoft Windows instead?

      I think they meant AOL disks.

    • Re:Reply (Score:5, Informative)

      by Runaway1956 ( 1322357 ) on Thursday March 25, 2010 @10:01PM (#31620968) Homepage Journal

      This is rated "funny" - but it's really not. I read a story about a credit union, in Texas I think, that found a bunch of CD's had been distributed to customers. The label claimed that they were distributed by the credit union, and that they contained software with which to securely connect to the bank. And, of course, the contents were just a trojan.

      I kind of thought the story was covered here on slashdot, but I could be wrong.

      Ahhhh - here we go. Someone tried to pass it off as "pentesting" in the slashdot story: []

  • BIOS (Score:2, Interesting)

    by sourcerror ( 1718066 )

    What about infecting the BIOS?

    • Re: (Score:3, Insightful)

      by jawtheshark ( 198669 ) *

      I always keep hearing that claim. I've never found one and actually never heard of one reported in the wild.

      As for the article: Online Banking has worked perfectly fine the last years.... At least for me :-) It needs no saving...

    • Re:BIOS (Score:5, Interesting)

      by Anonymous Coward on Thursday March 25, 2010 @08:20PM (#31619984)

      They could ship you a free NetBook w/ CD.

      Don't mod me funny, I'm serious. Like maybe a $100 little book running Linux, automatically set to keep itself up to date to eliminate hundreds of millions of dollars in cybercrime. The banks would own it, maybe even lease it to you for a $2 banking fee for having an online account with them. When you don't need it anymore or switch banks, you give it back to them and they would wipe the BIOS and system and reuse it.

      In fact, they could probably even make the netbook cheaper by not including a hard drive. Just boot from USB or CD, maybe even a small USB traveldrive installed internally inside the case itself. The USB ports could be removed or completely disabled, no CDROM drive included, no HDD, etc. It becomes more or less a dumb terminal whose only purpose is to connect to the bank on boot. And, in addition, sandboxed to not allow any other applications to run besides the required startup items.

      Just checked and it looks like Gateway sells a $49 netbook, found it on CNETs list of netbooks when I sorted by lowest price. And, that's *consumer* price, if the banks bought in bulk they'd even be cheaper than that. If they banks told them they didn't want USB ports (except the internal one), no harddrives, etc. then it would even be cheaper. I bet they could get them for $25 or so apiece in bulk for say 1000 units. That's not much cost to essentially eliminate the wholesale highway robbery of people's accounts that's been going on. The savings would be pretty enormous. Offset that with a small lease fee like I suggested above and its a win/win for everyone involved. Not to mention it would help Gateway out of its slump.

      Gateway LT2016u (Verizon Wireless) Specs: Intel Atom N270 / 1.6 GHz, 1 GB, 160 GB, Microsoft Windows XP Home Edition, 10.1 in TFT active matrix, 3 lbs

      • Re:BIOS (Score:4, Informative)

        by hipp5 ( 1635263 ) on Thursday March 25, 2010 @08:28PM (#31620100)
        One of the major Canadian banks (RBC) was actually giving away netbooks (eeePC 700 I believe) a little while back (to those who switched to them). With that in mind this suggestion doesn't seem that crazy. In reality, you wouldn't even need a full netbook. A small screen, minimal keyboard, network card, and very small SD card would do. Some people might even be willing to pay $100 for them if it meant they could feel safe in their online banking.
      • by h4rr4r ( 612664 )

        Link to that $49 netbook?
        Last I checked those kinds of prices on atom machine were subsidized and tied to a contract with a 3G provider.

      • by Khyber ( 864651 )

        "They could ship you a free NetBook w/ CD."

        How many netbooks actually come with an optical drive?

        • How about a USB pen drive writing port on the cash machine?
          You stick your pen drive into a USB port, type your pin and it
          updates your install complete with an optional personal key?

      • That would be a subsidized price. You'd have to tack on a $60 a month data plan for at least 2 years in addition. A netbook with those specs is generally around $300.

      • What I have had in mind for a long is something even more mobile - a credit card sized micro computer with a number pad and a simple LCD display. Sortof like a calculator.

        The OS on that has the public key of the bank and it has it's own private key for the owner (and the bank the corresponding public key). Thus it could use any medium to communicate with the bank, no matter how insecure. Maybe via a USB-dongle which you attach to the PC you are using. For online banking, you just go onto the bank site, no l

      • Oh god, why? Talk about over-engineering and waste of money and resources.

        Just send an SMS for any operation over X dollars and send the netbooks to some poor kids.

    • by zonky ( 1153039 )
      The whole thing is worthless, as soon as you burn it to disk, because as soon as you do so, its now out of date - i.e, it subject to flaws. Or are you going to force the user to download all the patches everytime they run the thing? What if it needs a kernel upgrade/reboot? It'll never work?
  • Convenience? (Score:5, Insightful)

    by rschuetzler ( 1735324 ) on Thursday March 25, 2010 @08:05PM (#31619848)

    Isn't the point of online banking that it is convenient? And easy? For me, booting from a Live CD may be a piece of cake, but for a lot of people, it's far from that.

    Even if it is a great idea, 98% of the population won't latch on to something like this, and the 2% who might are probably already running linux

    • If they do the live CD right, it should not be terribly inconvenient. Nonetheless, I think you're correct that most people won't do this - they simply won't understand the need for it. Personally, I've been doing on-line banking using a live CD for a couple of years. But then again, I'm somewhat paranoid (but only because everyone is against me 8^).
      • It will be inconvenient, both for the user and for the bank. Many people do not have their systems set to boot off of the optical drive by default, so the bank would be expected by the user to provide technical support for that change. In addition, users are not going to happily accept the idea that they have to stop their music, save their work in various applications, and close down their browsing sessions to reboot (a process which for many people is not a short experience) just to check their bank bal

      • Loading Ubuntu could be easy, but have you ever tried teaching someone over the phone how to use their BIOS?

        Methinks the set of people who are clueless about security doesn't overlap much with the set who know how to boot their machine to an alternate device and log in to their wireless network in Linux.

    • Re: (Score:3, Insightful)

      by HeavyD14 ( 898751 )
      I don't think its a question of difficulty. It would be a total pain in the rear if I had to reboot every time I wanted to get on my bank's website. Or do I keep a dedicated bank terminal ready to got at any instant?
      • I don't think its a question of difficulty. It would be a total pain in the rear if I had to reboot every time I wanted to get on my bank's website. Or do I keep a dedicated bank terminal ready to got at any instant?

        Actually, yes, you could have a "dedicated bank terminal". Take the old PC that is getting replaced, boot from the Linux cd-rom, use it for banking, and let the family screw up the new computer with trojans and malware while you enjoy relative peace of mind. I know a few families that have gone this route. They could care less about FOSS and its philosophies or politics, they just like the practicality of the solution. This is how FOSS can make inroads to the public, through practicality, not through id

        • Re: (Score:3, Interesting)

          by Artemis3 ( 85734 )

          How about an ultra cheap ARM such as the 80$ Menq's Easy PC E790 []?

          With their custom OS pre-installed, I'm sure many people would like a dedicated "secure terminal" instead of having to deal with issues in their everyday PC.
          Takes up much less power and is faster to boot (flash based) than an old pc. They could even try an ARM tablet or such.

    • Re:Convenience? (Score:5, Insightful)

      by tpstigers ( 1075021 ) on Thursday March 25, 2010 @08:30PM (#31620122)
      Actually, 98% of the population will only shy away from something like this is they're told what the process actually is. If they are told rather that it's their "Personal Online Banking Disc", and are then given instructions to walk them through the process, most people will happily buy into it. Most people wouldn't hesitate to install an app for this purpose, so the Live CD just needs to be marketed properly.
    • by rm999 ( 775449 )

      Not to mention that many people don't have CD players in their computers anymore.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        And even fewer systems are set to automatically set to boot from CD automatically, and the options to change it are usually located in the BIOS.

        Would YOU want to be their tech support guy, who would have to know how to modify the boot order on every model and make of PC or Mac that was built in the past 10 years? And heaven forbid getting a customer sets the boot order wrong, and then they can't get back into Windows when they remove the boot CD. You know damn well that they'll blame you for "breaking their

    • That was my first thought, but I'm also old enough to remember having to drive to the bank and wait in line. It's far more convenient to reboot with a CD in your PC than it is to go to even an ATM machine. With the proper marketing this could go a long way towards reducing online fraud.

  • by ricebowl ( 999467 ) on Thursday March 25, 2010 @08:07PM (#31619866)

    The majority of users I have contact with resent having to enter passwords/user-verification at all. With banks they do, often at least, appreciate the value of the process. But they still take every opportunity to minimise the process, so what're these users to do when they can't have Firefox (et al) save their username/passwords?

    Personally, I'm thinking they'll go back to using Windows, which can't be reasonably prevented by the institution, without cutting off a large user-base. Still, a nice -and, to me, novel- idea.

    • by gumbi west ( 610122 ) on Thursday March 25, 2010 @09:21PM (#31620606) Journal

      You could use token authentication and just allow the disk to keep a cookie that logs them in with minimal interaction (either nothing or a short password like their pin).

      Also, just thought you might like to know... Et al. is short for et alii and translates literally as, "with others." etc. is short for et cetera and translates roughly as, "with other objects". There is a people/things distinction. So if the other stuff is people, "et al." and if the other stuff is things, "etc.".

  • (But what if someone slips in a stack of doctored disks?)

    The important question is will the entire endeavour decrease the amount lost through fraudulent OLB transactions, and if the cost (producing the disc, customer dissatisfaction of having to use them etc.) is worth it for the expected decrease in fraudulent OLB transactions. In order to understand this you'll have to analyse a whole bunch of 'what if' questions, and the one above should certainly be one of them.

    (OK, sure in reality the bank might expect to see a benefit from appearing to go out of their way t

  • Utah does this... (Score:5, Interesting)

    by gandhi_2 ( 1108023 ) on Thursday March 25, 2010 @08:25PM (#31620054) Homepage

    Lots of Utah state government employees who work from home (for example, people who do data entry for Dept. of Workforce Services). It's worked pretty well, bypasses a lot of problems.

  • Surely if its a one shot thing, a customer version of webconverger or maybe slitaz?
    • Why Ubuntu? My guess is because it's the (at the moment) most popular version of Linux (which might help the adoption of using it since many have heard the name) and tends to have great (albet not perfect) hardware driver recognition. People want to use products by names they know and even if they've never used Ubuntu there is a semi-chance they've heard of it. And calling it just plain Linux which most have heard might bring to mind the old stereotype 'Linux = Ungodly complex geek thingy'.
  • The problem isn't online banking per se, it is the ease with which even savvy users can be duped into fraudulent online transactions. The solution must be much more general. Also, if every place we need to do a secure online transaction requires the booting up of a LiveCD or similar, gods help us. To say the least, that is not a scalable or generalizable solution.
  • Theory vs. Reality (Score:5, Insightful)

    by DaMattster ( 977781 ) on Thursday March 25, 2010 @08:36PM (#31620186)
    In theory it is a fantastic idea to promote security and virtually prevent problems. In reality, here is what you face: 1. User inertia to do this because it removes some of the convenience of online banking. Maybe Joe and Jane Smith who would be using this would be less savvy than your average computer user and still find a way to bungle things up despite this being totally sandboxed. 2. The fact that this is openly downloadable - Criminal networks can now simply obtain CNL's distro and systematically look for a weakness. A weakness with Linux is generally in order of magnitudes harder to find than Windows. It might work if, you have a system where you must be a customer of the bank and the distro you download comes with a unique certificate tied to your identity. But the reality of online banking is that it is an inherrent security risk. But even then, it is not quite perfect.
  • If I was into phishing I'd build such a CD (pre-set to my spoofed bank site of course) right away and mass-mail it out to everyone with instructions on how to use it. Pick a big bank and you should get enough hits to make it worthwhile the CD printing cost!

    Or, how about let's not do this? Technical "solution", social problem. Good luck...

    • There's a ton of unpatched vulnerabilities in IE. There's even some in Firefox (and if you start adding plug ins, which you have to do to use the web, there's lots). I've gotten viruses from embedded PDFs in youtube comments.
      • by h4rr4r ( 612664 )

        Stop using the adobe pdf reader. Why in the blue blazes would you use windows and adobe pdf reader?

  • That's a great idea.

    Especially since the technology for building your own pre-owned version of Ubuntu, writing it to a CD-ROM and then printing a bank logo on it is very complicated and expensive and thus completely out of reach of all but the most well funded banks and governments, so we won't ever see anyone tampering with this process.

    Simply brillant.

  • Microsoft has cut a deal with China Construction Bank, [] the second largest bank in the world [by market capitalization.]

    Microsoft China on March 23 inked a MoU with China Construction Bank, the nation's biggest real estate and mortgage lender, on strategic cooperation.

    Under the MoU, both sides will build a new generation online banking IE browser on the base of Windows Internet Explorer. In addition, they will jointly solve problems regarding to certificate management, browser safety monitor system allocati

  • What about OS and application security updates? It's kind of hard to patch a read-only CDROM :P
  • Unless they plan on sending you a new Live CD every time a new Firefox or Linux kernel security bug is patched, many users would be vulnerable to attacks within a few months of this CD being released. A smart phisher will eventually construct an effective "man in the middle" style style attack using whatever security holes are discovered, and the bank would probably take at least a week to develop, test, and ship new CD's that have the issue patched.

  • this would be a reasonable use for a trusted computing platform. It is ironic that the big companies discredited the method by not protecting the user and his rights but getting wet dreams about doing drm (and then fucking it up even for the people willing to live with it).

    Seriously. Booting from a CD without an additional authentication mechanism does not solve the problem. Ii is just a fix to the fact that on nowadays computers, the way which code gets installed in the system is still an pretty undefined

  • Or just do your online banking from your smart phone. Sure, it might have come pre-infected with a botnet, but it still probably doesn't have a keylogger running.
  • If the banks simply created a custom disk for every customer, that included things like passwds, accounting software, etc. It would not be such a pain and people would try it. The feeling of security that the bank and the customer would get out of it would be worth it.

    The only downside is that the disk itself could be stolen, but then so can your bank card or visa. The other obvious problem is that people may think that the reason the disk is safe is because it's Ubuntu and just install it on disk, and t

  • FFS (Score:4, Insightful)

    by foo fighter ( 151863 ) on Thursday March 25, 2010 @09:43PM (#31620792) Homepage

    If you are going to go to the expense of creating and distributing physical media, just implement two-factor authentication.


    In my opinion, pressing a little button on your bank-branded, credit card-sized PIN generator (such as the ones I have from Bank of America and PayPal/eBay) you keep in your wallet next to your credit cards and ID is waaaay easier than trying to remember what bullshit answer I gave to yet another off the wall "security" question. It's clearly much more secure.

  • by slashbart ( 316113 ) on Friday March 26, 2010 @04:26AM (#31623060) Homepage
    My Dutch bank ING uses my cellphone for authorization of transactions or changes online. I can log in and view my account data with just a password, so that might get compromised, but for a transaction or for instance changing over to a new cellphone number, I need a transaction number that is being sms-ed to the cellphone.
    My other Dutch bank ABN/AMRO uses some kind of calculator thingy that provides a transaction number based on a value you receive from the banks webpage.
    The same ING bank also provides a very simple system where you have a sheet of paper with transaction numbers, and the webpage just asks you for your next TAN code.

    What do all these have in common? Right, a separate transaction authorization outside the browser. How hard is that?

You are in a maze of little twisting passages, all different.