A recent cyber security threat has recently caught my attention in the news: India’s need to secure offline, rather than online, microfinancing solutions. Microfinancing, which was developed in 1974, provides banking services and small loans to impoverished and technologically-disconnected areas in India and other developing nations in South-East Asia and Africa as a way of stimulating the economy.
Offline mobile banking has taken hold of India primarily due to the country’s lack of reliable internet coverage. These services, offered through new smartphone applications created by Kotak Mahindra and DCB, completely leapfrog brick and mortar banking institutions by offering accessible, inexpensive, and advanced financial services to people in remote areas.
This major technological advancement has had enormous success in bringing financial inclusivity to millions of people, but has left banks vulnerable to various kinds of security threats: traditional point of sale attacks, DDoS attacks, as well as potential tampering by employees or anyone else who has physical access to the device have become, to nobody’s surprise, a prominent problem in this area.
Mobile banks in India have found a way to secure their offline banking black boxes with a security solution that brings end-to-end encryption in a microSD-sized form factor. Instead of relying on manufacturer software updates or antivirus solutions, microfinance bankers embed a small microchip that isolates sensitive financial data using hardware, rather than software.
This low-power, highly flexible, hardware-isolated computational and storage container that isolates data inside the host architecture thereby making virtually impervious to attack, since the data on the container is encrypted and requires a special key for access. This innovation has changed Indian microfinancing security drastically, allowing both customers and bankers to feel more secure with their transactions.
How does offline microfinancing work?
Much of microfinancing relies on giving small loans to remote populations, who can use that money to start their own businesses and improve the economy of their region.
On a more practical level, banks send loan officers into “the field” in order to conduct offline banking in remote areas. These officers still need access to the Internet for the initial setup of the application on their Samsung tablet. But after the software has accessed their information once, they will be able to go to rural areas in order to conduct business.
The loan officer then uses their tablet to record transactions and approve loans, syncing their data with the mainframe once they are back in their headquarters. Often, they do this simply because there is no internet connection in the area. Even when there is internet in the area, however, the connection is often not secure, which often causes significant and lasting damage to the banking institution.
Security threats that affect microfinancing
Microfinance tablets may be compromised if a hacker can access and change the transactional data on device. This way, hackers can then steal customer payment information without the merchant or customer realizing.
Here are some of the risks associated with India’s current microfinancing model:
- The tablet can be infected in the field if it is connected to a malicious Wi-Fi network that can then inject malware into the bank;
- The tablet is compromised physically, meaning that the hacker accesses, modifies, or saves transactional details while using the device without the loan officer’s awareness;
- Stolen or lost tablets can similarly be compromised and then connected to the mainframe to alter records;
- Loan officers that have been compromised can manipulate the transactions for the benefit of themselves or a third party, especially when the device is not connected to the internet; and
- Biometric authentication can be easily spoofed if the loan officer is using a local Wi-Fi network.
The important question for merchants and customers is this: how does the malware get into a POS system in the first place? Cybercriminals can use physical devices like card skimmers, or use other social engineering techniques to penetrate the systems. In other words, it’s possible for a merchant to interact with a hacker without their knowing, which makes them all the more threatening.
Securing mobile banks via hardware, rather than software
In order to secure these offline microfinancing solutions from the five kinds of attack, Indian bankers have been moving the transactional database and processing onto an encrypted mini-computer, housed in a microSD chip that is then inserted in the tablet’s microSD slot.
The data is then encrypted and made unavailable to the user of the device. Once the day is finished and the loan officer returns from the field, the microchip is removed from the memory, the data is synchronized with the mainframe and the chip itself is sanitized and prepared for the next mission.
This approach uses the built-in security properties of hardware isolation. By shifting all of the POS processes to another processor, hardware solutions can effectively sandbox important data and make them simply inaccessible from the IoT device itself.
The future of POS security rests in the power of embeddable microchips and the power of process isolation. By inserting a Linux-powered computer into the architecture of an non-secure IoT device, you will be able to create a hardware Root of Trust that completely seals any endpoint from a variety of physical and virtual security breaches.