Search

The paper discusses means to identify potential impacts of data flows on customers’ security, and privacy during online payments. The main objectives of our research are looking into the evolution of cybercrime new trends of online payments and detection, more precisely the usage of mobile phones, and describing methodologies for digital trace identification in data flows for potential online payment fraud. The paper aims to identify potential actions for identity theft while conducting the Reconnaissance step of the kill chain, and documenting a forensic methodology for guidance and further data collection for law enforcement bodies. Moreover, a secondary objective of the paper is to identify, from a user’s perspective, transparency issues of data sharing among involved parties for online payments. We thus declare the transparency analysis as the incident triggering a forensic examination. Hence, we devise a semi-automated traffic analysis approach, based on previous work, to examine data flows, and data exchanged among parties in online payments. For this, the main steps are segmenting traffic generated by the process payment, and other sources, subsequently, identifying data streams in the process. We conduct three tests which include three different payment gateways: PayPal, Klarna-sofort, and Amazon Pay. The experiment setup requires circumventing TLS encryption for the correct identification of forensic data types in TCP/IP traffic, and potential data leaks. However, it requires no extensive expertise in mobile security for its installation. In the results, we identified some important security vulnerabilities from some payment APIs that pose financial and privacy risks to the marketplace’s customers.

Testability and error rates are fundamental requirements for forensic investigations methods. For digitized forensics (e.g. fingerprint or fiber traces) signal processing and pattern recognition concepts are used. The quality of the acquisition process is sparsely researched. In our article we outline a first approach to address this and to open the discussion about the general challenge. We propose using Visual Quality Indices (VQI) as objective measure to compare scanned (digitized) traces for 3 different 3D contactless sensors (in-tensity + topography data) and 1 sensor with spectrometer-based wavelength output. We propose a fitness matrix containing VQI results for trace data acquired for each sensor and suggest using the number of outliers (non-occupied elements of the main diagonal) as fitness measure. We compare 182 data sets using 4 contactless sensors for 2 consecutive scans of 13 traces (3 fingerprints + 10 fibers, with 78 intensity and 78 topography data sets for the three 3D sensors and 26 for the spectography-based wavelength output). We compare the 2 consecutive scans vice versa by computing VQIs for all 7 outputs (intensity, topography and wavelength output) per trace, yielding 196 (14×14) single comparisons per trace and VQI (in all 356720 comparisons). We research the best performing VQIs to select intra-sensor, intra-trace data from intra- and inter-sensor data, giving a starting point for further inter-sensor investigations. Our research shows the Luminance Similarity Score (LSS) performing best in intra-sensor, intra-trace scenarios for fingerprint traces and Mean Squared Error (MSE), Peak Signal-to-Noise Ratio (PSNR) and PSNR in the YUV Color Space (PSNRY) equally performing best for synthetic fiber traces as a first result for further discussion.

In future applications of contactless acquisition techniques for latent fingerprints the automatic localization of potential fingerprint traces in crime scenes is required. Our goal is to study the application of a camera-based approach1 comparing with the performance of chromatic white light (CWL) techniques2 for the latent fingerprint localization in coarse and the resulting acquisition using detailed scans. Furthermore, we briefly evaluate the suitability of the camera-based acquisition for the detection of malicious fingerprint traces using an extended camera setup in comparison to Kiltz et al.3 Our experimental setup includes a Canon EOS 550D4 digital single-lens reflex (DSLR) camera and a FRT MicroProf2005 surface measurement device with CWL6002 sensor. We apply at least two fingerprints to each surface in our test set with 8 different either smooth, textured and structured surfaces to evaluate the detection performance of the two localization techniques using different pre-processing and feature extraction techniques. Printed fingerprint patterns as reproducible but potentially malicious traces3 are additionally acquired and analyzed on foil and compact discs. Our results indicate positive tendency towards a fast localization using the camera-based technique. All fingerprints that are located using the CWL sensor are found using the camera. However,the disadvantage of the camera-based technique is that the size of the region of interest for the detailed scan for each potential latent fingerprint is usually slightly larger compared to the CWL-based localization. Furthermore, this technique does not acquire 3D data and the resulting images are distorted due to the necessary angle between the camera and the surface. When applying the camera-based approach, it is required to optimize the feature extraction and classification. Furthermore, the required acquisition time for each potential fingerprint needs to be estimated to determine the time-savings of the camera-based localization approach throughout the entire acquisition of traces. The analysis of camera images of printed fingerprint patterns shows positive tendencies, too. However, only small sections of the fingerprint are sharply acquirable within a single photo, large sections of the image are usually blurred due to the depth of field of the camera lens.

A machine-assisted analysis of traces from crime scenes might be possible with the advent of new high-resolution non-destructive contact-less acquisition techniques for latent fingerprints. This requires reliable techniques for the automatic extraction of fingerprint features from latent and exemplar fingerprints for matching purposes using pattern recognition approaches. Therefore, we evaluate the NIST Biometric Image Software for the feature extraction and verification of contact-lessly acquired latent fingerprints to determine potential error rates. Our exemplary test setup includes 30 latent fingerprints from 5 people in two test sets that are acquired from different surfaces using a chromatic white light sensor. The first test set includes 20 fingerprints on two different surfaces. It is used to determine the feature extraction performance. The second test set includes one latent fingerprint on 10 different surfaces and an exemplar fingerprint to determine the verification performance. This utilized sensing technique does not require a physical or chemical visibility enhancement of the fingerprint residue, thus the original trace remains unaltered for further investigations. No particular feature extraction and verification techniques have been applied to such data, yet. Hence, we see the need for appropriate algorithms that are suitable to support forensic investigations.

The adaptation and extension is necessary to apply the CERT-taxonomy to malware in order to categorise the threat (e.g., Trojan horses, Viruses etc.) as a basis for countermeasures. For the adaptation of the taxonomy to include malware a new entry in the tools section is needed (malicious software). This entry will cover the Trojan horses mentioned earlier. The proposed extension of the CERT-taxonomy will include the attacker-model, the vulnerability and the objectives. Within the attacker-model a new entry should be added, the security scan. This type of penetration testing by security-experts is similar to the works done by ‘white hat’- hackers. However, such penetration testing is done by contractors on request, within strict margins concerning ethics and the assessment of potential damages before such testing takes place. The objectives within the CERT-taxonomy need a supplement, the security evaluation. This of course is the addition necessary to complement the introduction of the security scan. A very important vulnerability, social engineering, should be added to the taxonomy as well. It describes a very effective way to attack an IT-System. Two types can be distinguished, social engineering with the use of computers (e.g. e-mail content, phishing) and social engineering using human-based methods (e.g. dumpster diving, impostors).

The Trojan horse can be used in cyber-warfare and cyber-terrorism, as recent attacks in the field of industrial espionage have shown. To coordinate methods of defence a categorisation of the threat posed by Trojan horses in the shape of a list of tuples is proposed. With it, a set (consisting of methods for the distribution, activation, storage, means of execution, communications, malicious functionality) can be defined, which describes the Trojan horse by its features. Each of these aspects can be accompanied by methods of self-defence (e.g., armouring or encryption) against detection and removal by protection software. The list of tuples and therefore the categorisation of the Trojan horse properties is a vital first step to develop and organise counter measures against this kind of threat. A new category of Trojan horses, the special and universal Trojan horse, is proposed. This type of malware is particularly well suited for cyber-warfare and cyber-terrorism, as it unlikely to be picked up by common protection software (e.g., virus scanner). To achieve this, a Trojan horse is tailor-made for one special attack of a particular computer system and can provide espionage or sabotage functionality. If it is not used on large-scale attacks, anti-malware software producers will have little or no chance to extract a signature for this code. Systems being spied upon without notice can deliver vital information for the attacker. In addition, the attacker can choose to permanently or temporarily disrupt IT-infrastructure (e.g., denial-of-service, destruction of hardware). The universal Trojan horse can be updated by the attacker to achieve an extended functionality which makes it universal. The above-proposed list of tuples can be a tool to describe such special and universal Trojan horses which will be introduced in the full item description.