You’d think that in today’s high-tech society, nobody uses text-messages as part of their 2-factor authentication system. But despite hoping that this was dead and buried practice, every now and then we see examples of when it’s being used and subsequently hacked. Recently, Metro Bank in the UK and its customers suffered the consequences from this, which goes to show it’s time we start using better and safer solutions.
Telecom operators use what’s called an SS7 protocol to reroute both text messages and calls, and also offers the possibility of geo-positioning cellphones. The problem is that the owner of the cellphone doesn’t need to be informed of this, meaning anyone with access can reroute text messages and track the whereabouts of the phone as they choose. This could, for example, be the Telecom operator itself, a government agency, or the not-so-friendly hacker.
All the hackers need to do is figure out the user’s login and password to their bank, things that are relatively easy to get your hands on these days. They then simply use the SS7- protocol to reroute the authentication text message to their own phone and immediately get full access to the bank account. This exact thing happened to customers of the Metro Bank in the UK recently, as reported by “Motherboard”. The SS7-attacks drained the accounts of “an extremely small number” of customers according to representatives of the bank. But regardless of the number of victims, this should really not be a hack that is possible to perform any more. Especially not at a bank that millions of individuals and companies trust with their money.
The victims were of course compensated by Metro Bank, and hopefully, both the bank and customers have learnt their lesson and immediately abandon these inadequate practices.
There are however still thousands of services, banks and others that rely on text- messaging for their 2-factor authentication, apparently living in the belief that their system is secure. But implementing just any 2-factor authentication protocol does not mean your system is secure, much like having a seat-belt made out of paper won’t do you much good in a car crash.
So, take a good look at the service providers you use. if they use text messaging as part of their two-factor authentication inform them of their errors and find yourself another supplier. You simply aren’t safe where these practices are being used.
For the adrenalised digital world where connected devices are snowballing and digital transactions are flourishing, the ability to prove a unique digital identity is crucial. In essence, digital identities are becoming one of the most fundamental staple goods in the digital realm.
PRESSMEDDELANDEN Published 27 november 2020
Synch har agerat legal rådgivare till CovR Security AB i samband med bolagets nyligen genomförda finansiering om ca 20 miljoner kronor.
Patrik Malmberg, co-founder och CEO. ”Vi har sedan länge anlitat Synch för legal rådgivning avseende kapitalanskaffningar, kommersiella avtal, regulatoriska – och immaterialrättsliga frågor. Synchs kompetens och erfarenhet kombinerat med deras förståelse för de utmaningar som tillväxtbolag som är inne i en internationell expansion, ställs inför, har varit ovärderlig.”
Covr Security tillhandahåller en mobil multifaktor autentisering som en tjänst (likt ett globalt bank-id) till ett brett spektrum av branscher som är beroende av stark kundautentisering, till exempelvis banker, betalningsnätverk, kreditkortsföretag, eID-leverantörer, IoT-företag och mobiloperatörer. Bolagets användarvänliga lösning bygger på en modern arkitektur med ursprung i nordisk banksäkerhet.
Synchs team i kapitalanskaffningen bestod av Andreas Börjesson och Emma Lundberg. Synchs team för övriga områden består av Erik Myrberg, Veronica Uddsten, Anders Hellström, Mathilda Nordmark och Johan Tydén.
Synch är en internationell advokatbyrå med fokus på digitala affärer och teknologi. Synch erbjuder en flexibel leveransmodell där Digital services kompletterar firmans tjänster inom Advisory services, Projects & Transaction Services och Managed services, SynchWherever. Synchs Projects & Transactions grupp är specialiserade inom privat och publik M&A, venture capital investeringar och finansiering, särskilt i förhållande till teknologi-företag.
A new license agreement with leading health organization Mitera
The supply of digital health care is rapidly being brought into the app economy while at the same time, supporting a much higher degree of patient control.
In light of this, we are delighted to disclose that Covr Security has entered into a partnership agreement with the leading health organization Mitera. Mitera’s main product, mApp, is aimed at providing health care coverage by collaborating with hospitals.
The partnership intends to keep personal health records secure, providing privacy and security to 72 hospitals and up to 1 million users throughout West and Central Africa.
New hire! Navigating online security in the Asia Pacific
Meet Rajiv Madane! Mr. Madane joined Covr Security as Senior Vice President, Asia Pacific, during the spring.
Rajiv Madane has worked internationally with innovative fintech solutions for more than 30 years. He has expert knowledge from digital banking and payments, retail, SME, corporate banking, and wealth management from several leading positions, such as Virtusa and APIX.
Get in touch with him at LinkedIn.
How to keep safe online in a time of uncertainty
In the wake of the COVID-19 devastation, cybercriminals are taking advantage of our digital weaknesses and fear of contracting the disease. Please read our article about different types of socially engineered attacks targeting your security and what to do about it.
At CovrSecurity, we are committed to helping businesses stay safe online. We are always available to share our knowledge on how to implement user-friendly, bulletproof security into your workflows. Schedule a chat with us!
Until next time,
The team at Covr Security
Digital payment and online banking are all about striking the right balance between customer convenience and security. People expect it to be easy, so a complicated authentication process will turn them away. Luckily, onboarding users with COVR’s Multi-Factor Authentication API is not a problem. With this API, they can authenticate their payment directly from their smartphone without interrupting their flow.
COVR’s Multi-Factor Authentication API enables fast and convenient user authentication on smartphones. It keeps you and your users protected from all types of fraud and impostor activity, like identity theft, credit card hijacking, skimming and phishing. Even in risky settings like public wifi and unknown, unprotected networks. The API facilitates compliance, user retention and growth by providing stable and secure authentication and supporting user-friendly onboarding.
The Multi-Factor Authentication API is designed to help you to:
1. Comply with laws against money laundering, financial crime and enhanced privacy for individuals.
2. Defend and protect from online fraud and identity theft.
3. Facilitate people’s expectations on convenient, fast, secure signup and account login experiences.
Upgrade security with user-powered control and push notifications
Enable your end-users to actively protect their digital identity. With the Multi-Factor Authentication API, they control what information they share and with whom.
Thanks to push notifications instead of passwords, the onboarding and login process are a piece of cake. Once the user has logged in, the in-app verification alerts give the user the option to accept or deny authorization with a single tap.
One solution for every authentication scenario
COVR’s API is developed for any industry in need of strong end-user authentication and can be applied throughout all user groups – employees, end-users and third-parties. It works seamlessly across all platforms, applications and use cases. It also lets you authenticate end-users and authorize access throughout all of your business applications quickly.
The unique benefits
1. Benefit from passwordless authentication to access to sensitive information and money transactions.
2. Activate two or more authentication methods to protect your users from every threat.
3. Authenticate and onboard users with QR codes for a smooth end-user experience.
4. Allow users to authenticate themselves to sign contracts, loans and other legal documents.
Fast implementation, scalable and cost-efficient
COVR needs a minimum of infrastructure to scale for unlimited users simultaneously and plugs into existing systems with minimal modification. There’s no need for additional, expensive hardware.
Credit card security
Does your company issue credit cards? Then you know it’s a complicated process for both customer and issuer to re-approve a transaction that has been denied. It involves phone calls, security questions, identity document verifications or other payment methods.
With the Multi-Factor Authentication API, you can allow the credit cardholders to authorize the transaction themselves. This eliminates the problem with payment rejection and false-positive denials. Every smartphone can be reached by the bank in seconds, anywhere in the world. It is also registered to send authorization request push notifications with a response time of a couple of seconds. The result: seamless card transactions, and fully trusted, accepted purchases – both by the bank and its customers.
Reusable identity validation and account recovery
Dealing with stolen credit cards, lost smartphones or hacked accounts? Recovering all the lost data from each online service could be a lengthy and costly task.
With this API, recovery processes run fast, easy and secure. After a new identity verification is done, COVR can reconnect the user with their existing digital identity. Including all their history, transactions and various accounts. As nothing is ever lost, the user can continue to build their online reputation.
People want an ultra-low-friction mobile payment experience that says yes to a lickety-split transaction, with a minimum of taps and without the extra hoo-ha.
Pay on the go, wherever you are, is the catchphrase of today. This is the inevitable reality so let’s take a second to untangle some of the pitfalls and opportunities for banks to get on top of this development.
In-app purchasing, person-to-person payments and e-wallets are all results of consumers’ relentless demand for instant access to their money. Needless to say, this is why the most convenient and readily available device of them all – the smartphone – is becoming the payment channel of choice. Sending money to friends and family, shopping or doing day-to-day things like paying a bill inside various apps are all examples of consumer behaviours that are taking off in a phenomenal way.
“Tap-sign-done”
It’s no longer just well known online payment services like PayPal, Google Wallet and Apple Pay (that have been around long enough to earn trust) that are competing for a piece of the mobile instant payments pie. Thanks to the revised payment services directive (PSD2), the entire payment services ecosystem have entered the race and offer competitive-edge and value-added “overlay” payments that boost consumer instant access. Whether it’s game-changing players like Square, Klarna, Paym and Dwolla or run-of-the-mill banks, the potential success stands and falls with a combination of convenience and security.
The educated guess would be that as long as people can stay secure, they will take the path of least resistance. But convenience will only go so far when it comes to the adoption of mobile payments. Without the underpinning security, this ever-growing trend could halt in mid-stride if consumers don’t trust that their money is a hundred percent secure.
Trust, trust, trust
Even though banks are late to the mobile payment user-convenience party, research shows that consumers still have a much higher level of confidence dealing with their banks, than online platforms and social-media companies when it comes to payments services. This is a slam-dunk advantage that gives banks the chance to stay competitive by drawing from the hard-earned trust they have built with their customers over the years.
As payment innovation has been about striking the right balance between customer convenience and security banks are successively abandoning yesterday’s security methods and have started to evaluate new and more robust alternatives at hand. But bringing about a genuinely effortless mobile user experience and at the same time reach fool-proof security is no easy feat. To begin with, instant payment features radically shortens the time to identify fraud so no matter which way you look at it, you need to invest in extremely secure real-time fraud detection based on strong user authentication. Exceptional user convenience on the smartphone may be the term of the day as it stands, but without up-to-date security tech behind it, it could be good for nothing.
In the near future, those who offer their customers the security and sought-after split-second payment convenience will survive. This is why we have developed Covr, a user-centric mobile security management platform. It will help banks and other financial players to overcome the biggest hurdles in the transition to large scale open banking as it doesn’t require hardware or huge installations costs.
About Covr Security
Covr Security AB, located in Malmo, Gothenburg, Stockholm, Frankfurt and Palo Alto, is a Swedish cybersecurity company. We have developed a next-generation, user-centric mobile security management app for a wide range of heavily regulated digital industries that depend on strong customer authentication and privacy. The Covr app is available both as an off-the-shelf authentication mobile app ready for a quick launch and as a powerful SDK for hassle-free integration into existing mobile applications.
Both Marriott and Voi have recently had data about millions of their customers leaked, the prior by a hack and the latter by poor security set-up. The conclusion: The current systems for ensuring the safety of our customer’s data are far from sufficient.
In late November last year, the hotel chain Marriott announced that they had been the target of a data hack, exposing the information of 500+ million customers. The hackers had access to the customer data since 2014, but it took Marriott five years to realize they had been hacked. During that time, the hackers had access to names, phone numbers, email addresses, passport numbers, dates of birth and arrival and departure information of 327 million of Marriott’s customers. Besides that, for millions of others, the credit card numbers and card expiration dates were also potentially compromised.
Just a few days ago the electric scooter company Voi, that has placed scooters in major cities all over Europe, had 460.000 of their customer’s names, emails and phone numbers exposed openly on the internet. According to the German media company Bayerischer Rundfunk, the data was accessible by anyone without having to break any rules or even be a very proficient hacker.
Both of these incidents are very severe and point to the fact that the systems that many companies rely on to keep their customer’s data safe are insufficient. Whether it be by poor process design, a lack of understanding, or simply an outdated IT-system, there is a great need for better ways to protect the data customers entrust companies with. Poor PR is also not the only thing that can come from such data leaks. In light of the recent EU-directive GDPR, companies now also run the risk of getting hefty fines. In the Marriott-case, the data-breach has been deemed one of the most severe in history, and it will take several months for regulators to investigate the situation fully.
Had the companies instead ensured that the customer data could only be accessed by authorized personnel and had warning systems in place, the breach would either never have been possible or stopped a lot earlier. As a customer in today’s tech-world, your personal data can wreak havoc in your personal life on a scale previously unimagined. A leak such as the ones at Marriott and Voi, should therefore simply not be possible, especially since there are systems available that would have prevented them.
It’s time that companies accept their responsibility, and take measures to ensure that such leaks are not possible. Finding secure IT-systems is not an impossible feat, rather, there are companies like Covr Security that make sure that your customer’s data will remain safe and secure, while still allowing the information to be accessed by the right person at the right time. Security is not just a fancy word to be thrown around in the corporate visionary document, it’s a necessity to ensure that you have a business in the years to come.
Download the app
