~welcome to e-commerce world~

Post by Jackie, 3 July 09 @ 10:07 pm

Electronic currency is a digital symbol of physical money. It allows consumers to pay for goods or services by sending a number from one computer to another. It is done by transferring funds electronically, from one party to another, where it is cleared and protected by a strong encryption. This benefits the users as it offers more safety and less risk to them.

Furthermore, as E-commerce is evolving to be used widely, electronic currency is making it simpler for consumers to spend online. Usually, a user can purchase electronic currency by connecting to the Internet and certifying ownership of their account. This is followed by the user withdrawing the required amount and the bank issues a unique random number in an electronic coin format. The electronic coin has a serial number whereby the bank signs with their private key. The user will then store the electronic coins on their hard drive.

A unique type of electronic currency is E-Gold. E-Gold is an electronic currency issued by e-gold Ltd., a Nevis corporation. It is done by integrating an account system that allows the consumers to use gold as money. When one consumer carries out the e-gold payment, only the rights over it changes to the other party. The gold however, is still kept in the treasury vault.

1. Mondex.

• Electronic currency can be transferred by a system called Mondex. Mondex is a type of smart card that keeps 5 different types of currencies and transmits cash on the internet. A consumer can make a purchase from any online vendors that accept Mondex by inserting their Mondex card into the card reader and validating with the vendor’s Mondex device, the value of the transaction will be transferred onto the vendor’s card.
  

2. Mark Twain.

• Another type of electronic currency system is Mark Twain. Firstly, a consumer must open a World Currency Access (WCA) account. The WCA is a money market deposit account that bears interest and is accessible to customers free of the electronic currency program. To use electronic currency from their WCA account, a consumer must make transfer of funds by telephone, facsimile, mail or e-mail, from the WCA account to an individual "electronic currency mint" non-interest-bearing account. Following this, the electronic currency amount is downloaded from the electronic currency mint to the consumer’s computer via the internet. The funds are then transferred again to a pooled account at Mark Twain’s. Vendors who are paid by electronic currency can then cash in the amount received.
  

Electronic currency provides some of the benefits as follow:

1. Confidentiality

• Electronic currency is known to be anonymous. For instance, when a consumer sends electronic currencies to a vendor, the vendor will have no idea who the consumer is. This is a completely different feature as compared to credit cards. Furthermore, using electronic currencies can protect the confidentiality of the consumer as banks are also unable to obtain consumer’s personal information.
  

2. Security.

• Electronic currency is protected by encryption of RSA cryptography which makes it difficult to crack the code. Cryptograph is created by using digital signature. Digital signatures require an electronic private key on the sender’s part and a public key on the recipient’s part. Thus, even though people have doubts about internet safety, consumers carrying out electronic currency transactions are probably more secured while carrying out transactions online as compared to conventional way of doing business.
  

There are still some of the disadvantages of electronic currency:

1. Fraud.

• When a consumer misplaces their private key and funds are withdrawn by an unknown party, the bank will not know about it. The consumer will then be liable for any transaction carried out. Furthermore, if the security code is hacked and message interrupted, the unknown party can commit fraud on the intended recipient of the message.

2. Peer-to-peer double spending.

• This only occurs when consumer decides not to have the bank as an intermediary. This is because if the consumer includes the bank as an intermediary, the bank will check for double spending on behalf of the consumer and stop it immediately. However, if the consumer chooses a peer-to-peer transaction, nothing can be done if there is double spending on a transaction.

Post by Jaeme, 3 July 09 @ 10:07 pm

According to the statistics of credit card debts in Malaysia, the number of Malaysians declaring bankruptcy due to credit card debts has been increasing. However, as of May 2009, the number of people declaring bankruptcy has reduced.

There are a few causes of credit card debts:

1. Less income, more expenses.

• Most of the people have lesser income as compared to the expenses they incur. When their income is unable to cover their expenses, they will conduct payments using their credit cards. At this time, they do not think about the ability of paying back the installments of the debts.
  
  

2. Saving little or none at all

• You should save at least 4 months of living expenses in case of a rainy day. For instance, if you lose your job in June, you will have enough money to maintain your current lifestyle up until September. After these 4 months, you may be able to find a new employment. Therefore, having enough savings for a rainy day is always a worthwhile investment.

3. Poor money management.

• Many families accumulate lots of debts. This is due to them not having a monthly spending plan and keeping their monthly bills properly which makes them unaware of the amount of bills they have to settle. Hundreds of ringgit is charged each month on items which they don’t actually need, at the same time, incurring higher interest.

4. Big medical expenses.

• Unfortunately, medical expenses are quite high, especially on serious diseases. Almost all the hospitals receive credit card payment. When you need treatment and you do not have enough money, you will usually use your credit card to pay, although you may not be able to repay the expenses.

References:

http://www.3debtconsolidation.com/top10-causes.html

How to prevent your credit card debts?

1. Spending plan.

• Spending plan can help you to deal in controlling your monthly expenses. For instance, by having the spending plan, you expenses will not exceed your income.

2. Adjust your shopping habits to reduce credit card debt.

• Some people have a habit of shopping and usually they will spent too much of money that they can’t afford to pay. To reduce credit card debts, consumers need to adjust their shopping habits to may help to reduce your debt.

3. Pay card with higher interest rate first.

• A higher interest rate will always cost more money in the long run. To prevent this situation from happening, paying off the credit card debt with the highest interest rates may save a lot of money.

4. Debt consolidation.

• If you consider to switching your debt from one credit card to another, check the fine print before you start transferring the balance. Usually credit card companies try to sweeten the deal by advertising a zero or a very low interest payment on the balance transfers for a certain period. But then, after the time period is up, the amount of debt left is charged a much higher interest rate. This would only benefit credit card customers who can pay the amount of the debt in full at this low rate, otherwise they will run the risk of incurring higher interest rate on the debt.
  

References:

http://consumereducation.suite101.com/article.cfm/credit_card_debt_solutions#ixzz0K6vny9ST&D

http://consumereducation.suite101.com/article.cfm/credit_card_debt_solutions

http://www.rebuild.org/news-article/top-four-techniques-to-get-credit-card-debt-under-control/

Post by Ching Wen, 3 July 2009 @ 10:06 pm

With the current technological advancement, payment methods for mobile phone bills are becoming more convenient than it has ever been. One of the most convenient ways of payment is using mobile payment.

Mobile payment system can be done via mobile phones. It is where money is transferred from one party to another, by means of an intermediary or directly, without an intermediary. Mobile payment system is also introduced in ticketing, peer to peer fund transfers purchases on the internet and purchase of goods.

There are certain potentials in using mobile payment system. Mobile payment system makes consumers to potentially increase their desire in the purchasing of goods. Furthermore, it makes consumers feel at ease as they can buy the goods at the moment they have the desire to do so. For corporate purposes, it can enhance customer service by introducing new products or services via offering more convenient payment method for purchase. Besides that, it brings a positive effect to the company image; as the companies can save cost compared to traditional payment method. Mobile payment systems have become universally and widely accepted to customer, merchants and companies. Payment through mobile is also handy as consumers do not need to search for ATM machines to withdraw money for making payments. Mobile payment system is much more secured compared to cash or credit card.

There are several examples of mobile payments available in Malaysia:

1. MobileExec

• It provides commercial grade short message service (SMS) to people and business that want fast and reliable messaging services.
  

2. Mobile Money

• A PIN-based Mobile Payment solution for the limitation and bottlenecks created by cash, check and credit card. It allows registered user pay for goods and service at anytime, anywhere by using mobile phone with a 6-digit security PIN via SMS.
  

3. Paybox.

• “Paybox” was set up as a holistic mobile banking system which allows customers to access their accounts at any banks.

There are four types of mobile payment can be used by user, which are stated as follow:-

1. SMS based transactions, which is based on sending SMS for payments. This is the easiest but less secured method. It is less secured because any hacker can read the SMS details. It is also unreliable as the services varies, relying on SMS server traffic.

2. Direct mobile billing method which usually charges a fee for the payment made. However, this method is more secured than SMS, which is attributed by two-way authentication.

3. Mobile web payment using web pages or additional software on user’s mobile to make payment. It is done by wireless access protocol (WAP) to make payments, which is also more secured and works better as compared with the other type of payment methods.

4. Near field communication is a smart card installed in a user’s mobile phone whereby the mobile phone can be used for payments in shopping malls.

Relatively, advantages in mobile payment could affect the consumers’ adoption of mobile payment. By comparing the traditional payment methods with mobile payment methods, consumers are able to make purchases anywhere and anytime.Consumers do not need to wait hours in queue for counter payments; they can merely use their mobile phones to conduct payments which can save time. Furthermore, consumers feel comfortable and convenient carrying out mobile payments due to its low-value transaction costs. Low-value transactions are payments for movie tickets, transportation and so on.

Cost saving is one of the strategies that consumers adopt by using mobile payment system. In making transfer of funds or payments, consumers need to pay transaction cost first. By providing low transaction cost, the consumers tend to adopt mobile payment system.

Furthermore, another type of adoption strategy is by educating the consumers about mobile payment system. By widely spreading and advertising about the mobile payment strategies, consumers will feel more confident and comfortable while using mobile payment systems. This is because some consumers do not have knowledge about mobile payment system and some of them do not even know what mobile payment system is. Therefore, the government or any other related parties should advertise and provide seminars on how to use mobile payment systems. Besides that, the government should promote the relative advantages of using mobile payment, so that consumers will feel more confident while using it.

Although mobile payment brings a lot of benefits to consumers, there are certainly security risk involved while conducting mobile payments. Mobile payment system should include essential features that protect confidential information of the users. Service providers should enhance their security system and carry out updates regularly. These will increase consumer’s adoption of using mobile payment.

Moreover, the service provides should design the websites so that the WebPages fit nicely into the mobile screens.This can create a more user friendly system where consumers do not get confused nor frustrated while using mobile payments.

Lastly, lower selling price of mobile phones can encourage consumers to use mobile payment systems. Consumers are able to perform mobile payments by purchasing a mobile phone for less that RM200, which has General Packet Radio Service(GPRS) enabling them to connect to the internet and to perform mobile payments.

References:

http://project.hkkk.fi/helsinkimobility/papers/Mobile%20Applications_2_3.pdf

http://is2.lse.ac.uk/asp/aspecis/20020144.pdf

http://www.watblog.com/2009/06/03/mobile-payments-to-touch-190-million-worldwide-by-2012-a-detailed-look-at-types-of-mobile-payments/

Post by Jaeme, 26 June 09 @ 9:26pm

In order to ensure that our personal and financial data are being safeguarded appropriately, we need to take certain precautions while conducting online transactions. There are certain safety measures that one can choose from depending on the confidentiality of information exchanged and the level of security required by each individual or organization. Below are 7 types of precautions to ensure protection while conducting business online.

1. Antivirus and anti-spyware software.

• Antivirus is software designed to protect your computer against malicious software. Malicious software includes viruses, Trojan Horse, worm and other codes which can steal any unsecured information from your computer. In order to make an antivirus software an effective defense, users are required to scan through their computer regularly and keep the antivirus software up-to-date to recognize the version of malicious software. Therefore, with the right antivirus software, it can provide protection for computers to fight against viruses that can cause damage to computers and more importantly, to ensure that any personal and financial data will not be stolen.
  
• Anti-spyware is a program designed to detect and prevent unwanted spyware installation and remove those program that have been installed. Adware and Spyware are dangerous programs that will enable website developers to access users personal and financial data from their computers. Spyware can be activated while downloading certain files from the internet. This software should be included on the internet as a security measure and should be able to update automatically.

2. Firewall software.

• A firewall is simple program or hardware device that filters the information coming through the Internet into ones private network or system. Firewalls are used to prevent unauthorized internet users from accessing to a private network, especially an intranet. All messages entering or leaving the intranet will pass through the firewall which will examine each message and lock those messages that do not fulfill specified security criteria.
  
  
  

3. Message encryption.

• A popular technique for protecting messages in transit is called public-key infrastructure (PKI) cryptography. PKI is a scheme for securing e-payments by using public key encryption and various technical components. PKI confers integrity (the data haven't been manipulated), authenticity (the identity of the sender is known), nonrepudiation (the data can't be disowned) and privacy on the data. Any one attempting to corrupt or damage the contents will cause the initial binary digits sent by the computer to be messed up and when the receiver receives the message in normal text, it will also be a clutter when the recipient views it. Therefore, the recipient will know the message will have already been corrupted.

4. Browsers encryption.

• The actual way for encrypting the Web-based information interchange is by using the Secure Sockets Layer (SSL). It can be used to encrypt email messages using a symmetrical one-time electronic key. This key functions when the server and browser connection is opened. When the connection ends, the encryption expires with it.

5. Digital signature.

• An identifying code that can be used to authenticate the identity of the sender of a document. It is equal to a personal signature and cannot be easily repudiated or imitated. There is a simpler PKI process using the same algorithms referred to above as `sign' a message whereby the private key of an individual can be used to `hash' the message. This can then be verified against the sender's public key. This ensures the data's authenticity and origin without conferring privacy, and is called a `digital signature'.

6. Password.

• You should choose a password that is difficult for someone to crack. A strong password should consist of a combination of letters, symbols, and numbers in order to secure your personal and financial data. Furthermore, you should not use passwords such as license number plate, IC number, birthdates or phone numbers as passwords and always make sure you change your password occasionally.

References:

http://www.howstuffworks.com/firewall.htm

http://www.jmir.org/2002/2/e12/HTML

How to determine a phishing e mail?

1. Generic Greeting.

• Phishing e mails usually are sent in a large batch. Phishers usually will use such generic greeting such as “Dear customers”. The phishers do not to type all the customers’ name out and sent one-by-one. This is because it takes a lot of time, and they wish to get as much information as they can in a short period. If you receive such an e mail that does not contain your name, please do not click on the link and always be on the alert of such schemes.

2. Spelling errors.

• Phishing e mails usually will contain some spelling error. Once you see any errors in the e mail, it is clearly a phishing e mail.
  
  

3. Requests for personal information.

• The reason why phishers send phishing e mails to users is to track their personal information. If you receive such an e mail that requires you to provide personal information, usually it is an attempt to be a phishing email.
  

4. Sense of urgency.

• Phishing e mails usually will contain “If you do not update your personal information by clicking the above link, your account will be suspended or terminated”. They want you to provide information right away. Therefore, you will be afraid that if you do not act fast, something will happen to your account. The faster you provide information to them, the faster they can move on to the next victim.

5. Fictitious Link.

• Usually phishing emails will have a link for you to go to the website. However, the link that appears in that e- mail may not be the link that constitutes to the real organization. Roll your mouse over the link and see whether it matches the link that appears in the e mail; do not click on the link if there are any discrepancies. Websites that is safe to enter personal information will begin with “https” (s stands for secure); do not proceed if the link does not contain “s”.
  
  
  

How to determine a phishing website?

1. Poor resolution.

• Since phishers created the phishing website urgently, the website will be in a poor quality and will have a short lifespan. Be aware if the resolution of the logo and text strikes you as poor.

2. Fictitious URL.

• Although the link contains the name that you recognize, it may not necessarily the real link to the real organization. Read URLs from right to left – the real domain is at the end of the URL. Websites that are not safe to enter personal information will NOT begin with “https”. Be aware of such URL’s that begin with an IP address such as: http://12.34.56.78/firstgenericbank/account-update/ -- it is likely to be phishers.
  

References:

http://www.phishtank.com/what_is_phishing.php

http://www.phishinginfo.org/how.html

Examples of Phishing:












Process of phishing:

1. Planning.

• Phishers will determine which business to target and then determine how to get the customers’ e mail address of that business. They usually use the same mass-mailing and address collection as a technique.

2. Setup.

• The phishers will create a method of delivering the messages and collecting the data once they have determined which business to spoof and who their victims are. The phisher usually do this by sending e-mails which has the link to the fake web page.

3. Attack.

• Phishers will send false messages that would look like it is from a recognized source.

4. Collection.

• Phishers will then collect the information from the victims when they click on a link and perform any updates as stated in the link which they were brought to.

5. Identity theft and fraud.

• Phishers will then use the information they have gathered from the victims to make illegal purchases or commit fraud.

Ways to Prevention Phishing.

1. Awareness and Education.

• The main reason criminals can conduct phishing is because of the internet users’ lack of education and awareness of the existence of financial crimes targeted on them.
• Besides that, internet users may not know what are the internet policies and procedures when it comes to the confidentiality of consumers account information and maintenance issues. The company can distribute the general information on phishing in the company email or company’s website.
• Furthermore, companies also can remind the customers about their corporate policy and procedures when contacting customers regarding their account information. Both customers and employees need to have an understanding on how phishing works, understand how to determine whether an online transaction is secure and if it is authentic.

2. Targeting Hosting site.

• This method may be useful for those who seek to shut down the phishing site. The phishing e mails are used with the same method of mass- mailing infrastructure such as spam, affecting institutions and even law enforcement systems are made aware of a site hosting, resulting in the site to shut down.
• Companies that are affected have to implement ways to allow customers to submit the phishing e mails that they have received. These e mails, along with the web access logs for monitoring any suspicious activities, can help to indicate the existence of new phishing site. According to Anti-Phishing Working Group’s trends reports, it showed an approximate decrease of 10% in the average time online for a phishing site between the months of October 2004 and April 2005.

3. Web browser toolbar.

• A web browser toolbar has the ability to identify if a customer is viewing a possible phishing site. This toolbar functions by referring to a database of known FQDNs and IP address that have been reported as hosting phishing sites. It requires the phishing site to be observed and reported to the database.
• Certain toolbars offer a detection of potential phishing site by checking for certain heuristics that usually indicate that the site is not a legitimate commercial site. Example: the server IP address belongs to a network associated with a broadband service provider in a different country, other than the user.

4. Strong Authentication and Authorization.

• Two-factor authentication is a mechanism requiring two or more authenticators, usually consisting of something you know (such as a password or PIN) and something you have (such as a credit card or hardware token). For online transactions to be carried out safely, two-factor authentication is being implemented by providing the customer with a hardware token for generating a continually changing component for their authentication credentials. The goal is to protect the users if their authentication credentials have been captured by an attacker via electronic surveillance. The timeliness of the ever-changing component limits the attacker’s ability to use the credentials in the future.
• Another countermeasure being implemented by certain banks is the use of transaction numbers (TANs) for authorizing individual transactions. Customers will be sent a list of TANs with their monthly statement, and they are required to enter the next unused TAN when authorizing a transaction online. In addition, banks use another way whereby users receive a request for their TAN via an out-of-band mechanism, such as an SMS message on their cell phone.

5. Virus, Spyware, and Spam Prevention.

• With the marked increase in phishing malware, products that detect, prevent and execute the installation of malicious codes are an essential part for an environment of secured home computing and online buying and selling. These products must enable and, in the case of anti-virus and anti-spyware products, they must have up-to-date signatures. A large portion of recent malware attempts were done before a detection signature was able to detect and neutralize the malware. Furthermore, the attempts was to disable anti-virus and anti spyware software.
• Spam prevention has also contributed to the fight against phishing. Phishing emails use the same distribution mechanism as spam and they usually have several of the same characteristics. Email filtering based on content blacklisting, Bayesian filtering, blocking mail from known spamming/phishing relays, anti-forgery solutions such as Sender Policy Framework (SPF) and Sender ID, and other heuristics specifications towards phishing can help prevent a great number of phishing emails from reaching potential victims in the first place. However, spammers are continually evolving their tricks for bypassing filters [Schmidt] and the phishers can leverage this.

References:

http://computer.howstuffworks.com/phishing.htm

http://www.us-cert.gov/reading_room/phishing_trends0511.pdf

http://www.phishtank.com/what_is_phishing.php

http://www.phishinginfo.org/how.html

• An independent program that has the ability to self-replicate, which consumes the resources irrespective of the computer program being run or turned off.

2. Trojan Horse.

• A program that appears to be useful information but it contains hidden functions that presents a security risk and causes damage to your computer.

3. Marco virus.

• Macro viruses infect files that are created using certain applications or programs that contain macro viruses or worms. These mini-programs run a series of operations so that they are performed as a single action, thereby saving the user from having to carry them out one by one.

4. Denial of service attacks. (DOS)

• DOS attacks are growing to be very sophisticated. It attacks on websites where the attacker uses specialized software to send the data packets to the targeted computer or business with the aim of overloading their resources. Traditional DOS attacks usually attacks from one computer to another. It causes the network to shut down, thus making the websites inaccessible by users.

5. Distributed denial of service (DDOS) attack.

• DDOS happens when the attacker usually sends a list of IP addresses to the targeted computer. The attacker will then instruct the computers to send data packets against the given IP address by using false source address when all components are ready. The target servers can only survive DDOS attacks if they disconnect from the internet. This usually takes around 4 to 6 hours of recovery time for large corporations.
  
  
  

6. Identity theft and online fraud.

• Personal identity theft on internet happens when attackers gain and use information retrieved from the victim to make illegal purchases or commit fraud. The most common forms of online frauds are the sale via Internet of counterfeit documents; such as fake IDs and diplomas, and recommendation letters sold as credentials.

7. Data theft.

• Data theft occurs when there is stealing of information and also exploitation of personal data.

8. Social engineering.

• An attack using social pressure to trick computer users into compromising computer networks to which those individuals have access into. For instance, a phishing e mail would consist of such phrase: “Please update your personal data by clicking the above link within 48 hours, otherwise your account will be terminated”.

References:

http://www.bsagovernment.com/downloads/MajorOnlineThreats.pdf

• It is a fully integrated service offered by Trustgate which is intended to protect intranet, extranet and Internet applications. It is done by combining presentation, flexibility, and magnitude with impressive availability and security. Besides that, companies are able create a strong PKI and Certification Authority (CA) system with full control over security policies, PKI hierarchies, authentication models, and certificate lifecycle management which can be done efficiently and effectively by reducing time and cost when MPKI is used. This service also enables a quicker operation and less operating costs while providing an arena that is able to integrate with software solutions that can be easily purchased from outlets or vendor.
  

2. MyTrust.

• Using MyTrust, users are able to transform their SIM cards into Mobile Digital Identity for a secured and trusted financial services performed online. MyTrust application can be conveniently done with a digital signature where users can digitally place their signature when conducting transactions simply via their hand phones.

3. SSL Certificates.

• Another type of third party certification is the SSL Certificate which is used for Internet, intranet and server security which is offered by VeriSign. VeriSign is the world leading SSL provider.

i) Global Server ID (GSID)

• It is by far the strongest encryption programme available in the market for protected communication via Server Gated Cryptography (SGC) technology. This technology validates your web sites to secure communications and transactions carried out on the site. Furthermore, GSID comes with a VeriSign Secured Seal that can be shown on your website. This seal is a verification that your web site is authentic, giving your customers assurance that any business carried out on that website is safe from intruders.

ii) Secure Server ID

• Using Secure Server ID, users can transfer sensitive and confidential information on intranets, web sites, and extranets. This programme also comes with a Verisign Secured Seal.

iii) Managed PKI for SSL (Multiple Server Certificates)

• It is designed for companies which have 5 or more SSL Certificates in the organization. It can be used specially for numerous servers.

4. Personal ID

• This application can be applied for the use of transactions, documents, and e-mails. The types of Personal IDs are:-

i) Secure Transaction with Digital ID.

• Users can secure private and confidential information by using Digital ID to sign and encrypt transaction details. Digital ID uses a private key and public key application for authentication, authorization, and integrity.

ii) CryptoSuite.

• CryptoSuite is used to protect your files and documents by merely clicking the mouse once. It applies the Digital Certificate to encrypt files and documents so that only the proposed recipient with the public key can have access by decrypting it.

iii) Secured E-mail.

• It also uses Digital ID to sign. Furthermore, it also encrypts your e-mails so that no one can have unauthorized access to it. The Digital ID is an electronic replacement for a handwritten signature and it provides assurance to your intended recipient that the e-mails are from the actual sender. The encrypted e-mail secures them from being read by intruders.

5. MyKad PKI.

• It enables the MyKad holders to carry out online transactions with the government and private organizations. In order to do so, users will need MyKey which works with their MyKad to authenticate themselves and to digitally sign transactions.

6. SSL Virtual Private Network for Remote Access Services (SSL VPN).

• Trustgate’s SSL VPN solution is based on the Secure Socket Layer (SSL) which can be organized to access several intranet sites with only a sole sign-on. All a user needs is a basic browser and Internet connection. This is practical if suppliers, partners, and customers need to access the organizations network from remote areas. Furthermore, this solution has a policy to authenticate users and the type of devices they use. This policy may be extended to two-form authentication. For example, tokens, downloaded Java applets, challenge-respond or static password stored in your device, or a one-time password which will be sent by SMS to your mobile. This provides extra security features for an organization.

References:

http://www.msctrustgate.com/