Jmanico: Redirected page to Transaction Authorization Cheat Sheet

2015-07-07T00:14:44Z

Redirected page to Transaction Authorization Cheat Sheet

Jmanico: getting started

2015-07-07T00:11:35Z

getting started

New page

__NOTOC__
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
= DRAFT DOCUMENT - WORK IN PROGRESS =

= Introduction =
__TOC__{{TOC hidden}}

Some applications use second factor to check whether sensitive operations are being performed by an authorized user. Common example is wire transfer authorization, typically used in internet or mobile banking applications. For the purpose of this document we will call such process: “transaction authorization”. However, usage scenarios are not only limited to financial systems. For example: an e mail with a secret code or a link with some kind of token to unlock user account is also a special case of transaction authorization. User authorizes operation of account unlocking by using second factor (a unique code sent to his email address).

Transaction authorization is currently performed by various methods. The following are common examples:

* cards with transaction authentication numbers (TAN),
* time based OTP tokens, such as SecureID,
* OTP sent by SMS, provided by phone or sent to email address,
* digital signature using a smart card,
* challenge-response tokens (including “disconnected card readers” or solutions which scan transaction data from computer screen).

Some of these can be implemented on a physical device or in a mobile application.

Transaction authorization is implemented in modern financial systems in order to protect against unauthorized wire transfers as a result of attacks using malware, phishing, password or session hijacking, CSRF, XSS and other. Unfortunately, as with any piece of code, such protection can be improperly implemented and as a result it might be possible to bypass this safeguard. Purpose of this cheat sheet is to provide guidelines on how to properly implement transaction authorization to protect it from bypassing.

= Authors and Primary Editors =

Eoin Keary eoinkeary[at]owasp.org

| valign="top" style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" |

== Other Cheatsheets ==

{{Cheatsheet_Navigation_Body}}

|}

[[Category:Cheatsheets]]

← Older revision		Revision as of 00:14, 7 July 2015
Line 1:		Line 1:
−	~~__NOTOC__~~	+	#REDIRECT [[Transaction_Authorization_Cheat_Sheet]]
−	~~<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">~~[[~~File:Cheatsheets-header.jpg\|link=]]</div>~~
−
−	~~{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|-~~
−	~~\| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" \|~~
−	~~Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''~~
−	~~= DRAFT DOCUMENT - WORK IN PROGRESS =~~
−
−	~~= Introduction =~~
−	~~__TOC__{{TOC hidden}}~~
−
−	Some applications use second factor to check whether sensitive operations are being performed by an authorized user. Common example is wire transfer authorization, typically used in internet or mobile banking applications. For the purpose of this document we will call such process: “transaction authorization”. However, usage scenarios are not only limited to financial systems. For example: an e mail with a secret code or a link with some kind of token to unlock user account is also a special case of transaction authorization. User authorizes operation of account unlocking by using second factor (a unique code sent to his email address).
−
−	~~Transaction authorization is currently performed by various methods. The following are common examples:~~
−
−	* cards with transaction authentication numbers (TAN),
−	* time based OTP tokens, such as SecureID,
−	* OTP sent by SMS, provided by phone or sent to email address,
−	* digital signature using a smart card,
−	* challenge-response tokens (including “disconnected card readers” or solutions which scan transaction data from computer screen).
−
−	~~Some of these can be implemented on a physical device or in a mobile application.~~
−
−	Transaction authorization is implemented in modern financial systems in order to protect against unauthorized wire transfers as a result of attacks using malware, phishing, password or session hijacking, CSRF, XSS and other. Unfortunately, as with any piece of code, such protection can be improperly implemented and as a result it might be possible to bypass this safeguard. Purpose of this cheat sheet is to provide guidelines on how to properly implement transaction authorization to protect it from bypassing.
−
−	~~= Authors and Primary Editors =~~
−
−	~~Eoin Keary eoinkeary[at]owasp.org~~
−
−	~~\| valign="top" style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" \|~~
−
−	~~== Other Cheatsheets ==~~
−
−	~~{{Cheatsheet_Navigation_Body}}~~
−
−	\|}
−
−	~~[[Category:Cheatsheets~~]]

Financial Transaction Authorization Cheat Sheet - Revision history

Jmanico: Redirected page to Transaction Authorization Cheat Sheet

Jmanico: getting started