IBM Introduces Hardware Security Device ZTIC for Online Banking

Submitted by lalit on November 5, 2008 - 11:36am.

IBM says that more and more attacks to online banking applications target the user’s home PC, changing what is displayed to the user, while logging and altering key strokes. MELANI     a security firm concludes “Two-factor authentication systems […] do not afford protection against such attacks and must be viewed as insecure once the computer of the customer has been infected with malware”.
In order to foil these threats, IBM has introduced the Zone Trusted Information Channel (ZTIC), a hardware device that can counter these attacks in an easy-to-use way. The ZTIC is a USB attached device containing a display and minimal I/O capabilities that runs the full TLS/SSL protocol, thus entirely bypassing the PC’s software for all security functionality.
The ZTIC achieves this by registering itself as a USB Mass Storage Device (thus requiring no driver installation) and starting a "pass-through" proxy configured to connect with pre-configured (banking) Websites. After starting the ZTIC proxy, the user opens a Web browser to establish a connection with the bank's Website via the ZTIC. From that moment on, all data transmitted between browser and server pass through the ZTIC; the SSL session is protected by keys maintained only on the ZTIC and, hence, is inaccessible to malware on the PC.
In addition, all critical transaction information, such as target account numbers, is automatically detected in the data stream between browser and ZTIC. This critical information is then displayed on the ZTIC for explicit user confirmation: Only after pressing the "OK" button does the TLS/SSL connection continue. If any malware on the PC has inserted incorrect transaction data into the browser, it can be easily detected by the user at this moment.
There is no information available about pricing or when IBM is going to release the device. You can get more information about the ZTIC on Zurich IBM website.