The “H” stands for Hardened, which indicates that the software has been specifically designed at the architectural level for securing transactions and intended to work as a single-purpose security application.
In a nut shell, it means that a great deal of attention and resources have been dedicated to protecting the software against all known attacks.
One important part of hardening is concerned with uncoupling as much as possible the application from the operating system resources so as to render it “zero-footprint”. This activity is required not only because it prevents inheriting the vulnerabilities of the operating system, but also because it guarantees mobility and avoids the need for any installation procedure before one can run the application.
Given enough time and resources, any system can be hacked. Anybody claiming the opposite is either ignorant or dishonest. Nonetheless, the relevant question is not IF, but HOW a system can be hacked. In other words, the ultimate goal of hardening is to make the work of e-criminals extremely complex/costly and to lower as much as possible the return on investment (ROI) of the hacking activity. The e-crime business is a global industry which in many ways follows the rules and requirements common to legitimate industrial activities. The profit of e-criminals is driven mainly by their ability to quickly deploy successful and scalable attacks. Our products have the advantage of enjoying the lowest hacking ROI when compared to other secure applications available in the market today.
One can consider software hardening efforts to be somewhat similar to those required to build effective anti-viruses. In our products, however, the protections are not deployed about the operating system but are rooted inside of the application and cannot be turned off without first understanding the internals of the application itself. This means that any successful attack against our products requires a considerable effort and, more importantly, will be applicable only to the specific build for which it was developed. In other words, the e-criminals must first go through the work of unraveling the obfuscated code of our product before they can design a successful piece of malware.
Once a malware attack is developed and launched, however, it will be effective only until the target code presents the same vulnerabilities which were exploited to build the malware. This means that by applying appropriate changes to the H-Browser code will “immunize” the application from the malware, effectively thwart the attacks and force the e-criminals back to the work bench. Interestingly, the practice of pushing secure updates can be applied proactively to frustrate any ongoing hacking efforts and prevent any scalable attacks. This underlines a real strength provided by proper application hardening, inasmuch the full control over the application code and of the protection layers enables one to engage the e-criminals even before they have deployed any attack.
Our products deploy the most comprehensive and extensive set of protections for Internet transactions presently available in the market. For example, the H-Browser has never been hacked to carry out a fraudulent transaction. The H-Browser has been audited by several independent companies and is certified for use against Man in the Browser attacks by Indentrust, the global leader in trusted identity solutions for financial institutions (http://www.identrust.com/).
From the end user’s perspective, the H-Browser looks and operates just like any standard Web browser with no appreciable loss in rendering performance. The functional limitations imposed by the H-Browser largely depend on the security level required by the financial Institution. Typically, end users will not be allowed to surf on Web sites which are not included in the application’s internal whitelist (called Access Control List) and will not be allowed to view multimedia content.
No. The H-Browser and Firefox share the same rendering engine which lies at the core of both applications. The difference in the ability to render HTML pages between the two applications will be noticed only with pages containing Flash or multimedia content, which is typically handled by third party extensions and plugins. This difference, however, is irrelevant in the context of e-banking transactions for which all Banks have learned to avoid using multimedia objects.
The problem with allowing Flash content lies in the nature of such objects which typically require their own independent network layer support, interfaces and process handling. This enables very powerful attacks to be launched against the browser bypassing the protections that are deployed at the application’s or PC level. In the case of the H-Browser, no external components are allowed to run which can offset the hardening techniques in place.
A fundamental requirement of browser hardening entails decoupling the application’s context as much as possible from the underlying operating system. For example, the application should use only its own crypto and SSL libraries, and not expose any internal resources to the operating system. When such decoupling is enforced properly, the hardened application will effectively be isolated from any active threats which exploit specific vulnerabilities of the operating system (typical of the so-called Man in the PC attacks). This implies that in order to carry out a fraudulent transaction the e-criminals will be forced to also attack directly the hardened browser even if they have full control of the PC. As explained above (ref. 2.4), this is the purpose of the hardening activity, i.e. to lower the hacking ROI by adding additional layers of protections that require substantial skills and resources in order to be removed.
The Proactive Security Updates (PSU) constitute a fundamental component of the hardening assurances, inasmuch they guarantee the ability to both prevent and respond to malware attacks.
Differently from the standard maintenance updates of non-hardened software, the PSU are designed to keep the H-Browser equipped with the strongest protections developed using the knowledge acquired from a constant monitoring of the malware strains observed in the wild. One can compare this activity to the way anti-virus updates are provided regularly to respond to infections, except for the fact that anti-virus updates are mostly reactive rather than preemptive. The deployment of any “secure” software without an adequate service for security updates is inevitably exposed to targeted malware attacks without having the ability to fight back and prevent scalability to the entire population of users.
From the end users’ perspective there is no difference, except for the portability advantage of carrying the application on a USB stick.
From a security point of view, storing and running the H-Browser from a USB device (possibly equipped with a Smart Card) provides a host of additional tools for protecting both the browser’s executable code and resources, as well as the transaction process itself (e.g. using digital signing). In general, is fair to say that a deployment based on the use of an external hardware device is always more secure than a software-only deployment. Nonetheless, the security of a transaction carried out using a software-only version of the H-Browser is still much higher than that provided by standard browsers.
The hardened applications developed by EISST are today used by thousands of users from some of the most prestigious financial institutions in the world. The experience gathered by providing security and hardening services to such prime customers positions EISST as one of the most reliable and knowledgeable partners for securing data and transactions for both enterprises and financial institutions.
The H-Browser has successfully passed several detailed security audits by independent companies. As a conclusion to one of such studies, the Swiss company Compass Security AG (www.csnc.ch), expert in penetration testing and ethical hacking, has released the following statement: “To the best of its knowledge, Compass is not aware to this date of alternative solutions and products which can match the range and strength of the H-Browser protection mechanisms implemented to safeguard Internet-based e-banking transactions.”
EISST has been working in the field of application hardening since early 2002, well before large scale Man in the Browser attacks had surfaced as a major threat to Internet transactions.
EISST has developed a complete suite of hardened applications coupled to a remote management system which can provide customers with a scalable platform for secure data management and Internet transactions in support of a number of different business use case scenarios.
Measuring security is indeed a difficult task, especially when vendors are not forthcoming and tend to play into the gray areas offered to them by technical complexities. The following, however, is a list of questions we suggest considering when comparing “secure” browsers:
- Is this browser “zero-footprint” and which operating system resources does it use?
- What attack vectors does the browser protect against?
- Has this browser undergone a detailed security audit?
- Is the browser continuously protected also using proactive security updates?
- What is the experience in application hardening of the software provider?
- Who is currently using this “secure” browser?
- What is the track record of this browser against malware attacks?
Start an online chat session
8:00 AM - 5:00 PM Mon-Fri
+44 (0)20 79 483 237
8:00 AM - 5:00 PM Mon-Fri