Greater Than 1

Architecture and Background

Brendan O'connor: Greater than 1: Defeating "strong" Authentication in Web Applications With Phishing, Fraud, and Identity Theft at peak levels, banks, credit unions, credit card companies, and other financial institutions are enhancing the security of their website authentication. This talk will cover the new methods of authentication, such as mutual authentication, device fingerprinting, out of band authentication, one time passwords, and knowledge base archives.

Vulnerability Analysis

We will analyze how these controls are intended to function, what they're really doing, and how we can defeat them. We will also evaluate the effectiveness of specific technologies based on their stated purpose: stopping phishing, fraud, and identity theft.

Exploitation and Demonstrations

Brendan O'Connor is a security engineer from the Midwest. He worked in security for a communications company for four years before switching to the financial sector in 2004.

Remediation and Defensive Strategies

Brendan currently works as a Security Engineer for a financial services company, where his duties include vulnerability research, security architecture, and application security. He has several multi-letter acronyms after his name, drinks too much coffee, and plays an unhealthy amount of Warcraft.