CS Mar-Apr 2024

iometric cybersecurity
the previous year, making it the
fastest-growing fraud category.
How can banks effectively protect their
clients from these kinds of financial losses
and minimise losses for themselves, as
obligatory fraud reimbursement regulations
are being introduced in the UK and around
the world? Traditional user authentication
and fraud detection tools, deployed by
many banks, typically use various device
fingerprinting techniques that are quite
effective against scams where the fraudster is
in an unusual location or accesses the online
banking application from a browser or device
that is not recognised as the standard for a
specific user. The problem is that when the
user hands over the cursor and keyboard
control to someone else who is remotely
transacting in the victim's account on the
victim's own device, through the usual
browser, and from the usual IP address,
device fingerprinting becomes completely
useless in spotting the fraud.
During a remote desktop session, the cursor
movements and typing of the remote agent
are instantly mirrored on the user's screen,
and these cannot be differentiated by a
human observer from the interactions of
the user working locally on their own
computer. A few years ago, there used to be
a slight time lag and some skipping cursor
movements, but the latest versions of the
common remote desktop tools are free from
these
issues.
Luckily, there are
still some very subtle
data patterns that can be
detected by the most sophisticated AI
systems, such as Cursor Insight's patentpending
Remote Access Detection solution,
which is part of the Graboxy Cybersecurity
Platform.
SUSPICIOUS ACTIVITY FLAGGED
Cursor Insight has been for years at the
forefront of innovation in the field of
biometric cybersecurity, with the Graboxy
Continuous Authentication tool winning
prestigious awards, including the 'Cyber
Product of the Year' at the National Cyber
Awards and the 'Remote Monitoring Security
Solution of the Year' at the Computing
Security Awards in 2023. A fundamental
feature of Graboxy is the continuous
monitoring of user interactions and the
use of AI to analyse data transmitted through
the user's web browser.
The data is only monitored and analysed on
the server side, so nothing has to be installed
by the client. The technology is capable of
building accurate biometric profiles by
finding behavioural patterns that can be
associated with individual users.
Graboxy can passively authenticate users
in the background by comparing real-time
interactions, including mouse movements,
to the biometric profile belonging to the
user. Suspicious sessions with a high
likelihood of an ongoing account takeover
or other types of unauthorised access can be
quickly flagged for further security checks or
additional re-authentication. This solution
can be effectively used to detect a fraudster
controlling the user account through a
remote desktop session.
The Graboxy Remote Access Detection
Solution adds an additional security layer on
top of passive continuous authentication. It is
able to, within a few seconds and in real time
identify any remote access session, which is
almost always a sign of a scam attempt in
online banking and payment applications.
The unique advantage of this solution is that
it uses predefined machine learning models
trained specifically to differentiate between
local and remote users. It means that no
individual profiles need to be built over time,
and no rule or algorithm calibration is
required, unlike most AI-based solutions. It
works straight out of the box and can easily
be combined with already deployed fraud
detection solutions through its API.
WINNING THE BATTLE
Fighting against cybercrime and online
financial fraud is a dynamic race where both
the attackers and the defenders tirelessly
innovate and try to outsmart the other side.
The stakes are high, especially with remote
access scams, where, unlike with the most
common types of scams, the hackers could
potentially steal complete life savings in a
matter of minutes. Educating banking clients
not to hand over the control of their devices
to strangers who are offering unwanted help
during a phone call is, of course, essential;
awareness can and should be raised to help
people protect themselves.
But, just like many customers still often
voluntarily share their login credentials,
PINs and SMS one-time passwords with
scammers, the human factor remains
the weakest link that fraudsters exploit in
the case of remote access scams as well.
Investing in technologies that offer protection
from the latest forms of cyber fraud
remains a necessary tool to win the fight.
www.computingsecurity.co.uk @CSMagAndAwards March/April 2024 computing security
23