To process mass payments, especially in the case of multibank accounts, companies today generally use offline software for the transmission, approval and execution of electronic payment orders. Transfers are triggered automatically directly from within the ERP software and are transmitted to the bank via secure protocols. This type of payment processing accounts for the majority of the electronic payment orders executed in Switzerland today.
The malware described in the MELANI statement, “Dridex”, which spreads through malicious Microsoft Office documents in e-mails from ostensibly legitimate senders, has recently started focusing on precisely these kinds of offline software solutions. Manufacturers that enjoy a certain popularity in Switzerland are being targeted. Many companies are still somewhat uncertain as to how secure their solution really is and how they can guard against similar hacks.
To begin with, the security instructions that MELANI has been publishing for a long time – using dedicated computers, ignoring e-mails with suspicious attachments, regularly updating operating systems and anti-virus programs etc. – still apply when it comes to ensuring that your own infrastructure is protected. One instruction is of particular note, namely that collective rather than single signatures are to be used. How does that work in practice? After all, it is not as though we still use paper orders that can be physically signed by the company representatives and sent to the bank.
The banks offer two basic solutions (sometimes combined). On the one hand, approval via one channel is possible. This means that the file with the payment orders is sent directly from the offline software to the bank via the EBICS (Electronic Banking Internet Communication Standard) protocol, but the order has not yet been authorised for execution. Approval in the bank’s online banking system then allows the orders to be approved definitively by a second person.
Another secure and flexible type of collective signature is the use of the “distributed electronic signature” (VEU) contained within the EBICS standard. The standard is based on the signature models “transport” (no authorisation), “individual”, “collective A” and “collective B” signatures. For each order, the bank may also define a daily limit (per customer, per account or per order type, depending on requirements). VEU allows customers to mirror 1:1 the signature arrangements in place in their companies and, due to using several channels (e.g. issuance of second signature via a mobile device) results in a very high level of security.
More and more banks in Switzerland are introducing EBICS VEU as an offering within their e-banking solutions. Find out more about it from your bank or direct your questions to info@ppi.ch if you would like more information about EBICS VEU.
Original MELANI statement: https://www.melani.admin.ch/melani/de/home/dokumentation/newsletter/offline-payment-software.html
Carsten Miehling
