迂回和安全地使用PIN/TAN系统
Outflanking and securely using the PIN/TAN-System
摘要：
PIN/TAN系统是一种用于电子商务的认证和授权方案。像其他类似的计划一样，它被犯罪分子成功地攻击。在对各种攻击进行简单的分类后，我们完成了对真实的万维网交易系统的恶意代码攻击。在这样做的过程中，我们发现它真的很容易包抄这些系统。这甚至得到了用户行为的支持。我们给出了一些简单的行为规则来改善这种情况。但其影响是有限的。此外，提供商通过在其安装中存在实现缺陷来支持攻击。最后，我们表明，PIN/TAN系统是不适合在高度安全的应用程序中使用。
英文摘要：
The PIN/TAN-system is an authentication and authorization scheme used in e-business. Like other similar schemes it is successfully attacked by criminals. After shortly classifying the various kinds of attacks we accomplish malicious code attacks on real World Wide Web transaction systems. In doing so we find that it is really easy to outflank these systems. This is even supported by the users' behavior. We give a few simple behavior rules to improve this situation. But their impact is limited. Also the providers support the attacks by having implementation flaws in their installations. Finally we show that the PIN/TAN-system is not suitable for usage in highly secure applications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
