How does SolidPass™ guard against Compromised Midlet Download?
The user receives the SolidPass™ Mobile Application via WAP Push to his mobile phone. Theoretically, an attacker could convince the user to download and install a malicious application instead by sending an SMS that imitates the bank’s WAP push. This makes it possible to get the secret activation code, as the user, thinking he is using the SolidPass™ Mobile Application on his phone, enters his application code into a malicious application which transmits the code to the attacker. But even if the attacker receives the secret activation code in this manner, he still has no access to the user’s online banking login. Thus, compromising the midlet download may lead to a leakage of secret information used on the mobile phone, but nothing else. The security of the whole system is still not compromised because the attacker does not have the online banking login, which is the second authentication factor into the system.
