{"guid":"74515f8e-a752-4cbb-b407-3a70fca5b0b3","title":"(Un)Sicherheit von App-basierten TAN-Verfahren im Onlinebanking","subtitle":null,"slug":"32c3-7360-un_sicherheit_von_app-basierten_tan-verfahren_im_onlinebanking","link":"https://events.ccc.de/congress/2015/Fahrplan/events/7360.html","description":"Neue App-basierte TAN-Verfahren sollen die etablierten Verfahren ablösen und Onlinebanking komfortabler machen. Die Notwendigkeit von dedizierter Hardware entfällt und Transaktionen können mit nur einem mobilen Endgerät durchgeführt werden. Was von den Kreditinstituten als Feature beworben wird, erweist sich in unserer Untersuchung als fatal. In einem Proof-of-Concept-Angriff demonstrieren wir die Manipulation von Transaktionsdaten und zeigen die konzeptionelle Schwäche von App-basierten TAN-Verfahren.","original_language":"deu","persons":["Vincent Haupert"],"tags":["Security"],"view_count":154969,"promoted":false,"date":"2015-12-28T16:45:00.000+01:00","release_date":"2015-12-29T01:00:00.000+01:00","updated_at":"2026-04-07T01:45:04.358+02:00","length":3600,"duration":3600,"thumb_url":"https://static.media.ccc.de/media/congress/2015/7360-hd.jpg","poster_url":"https://static.media.ccc.de/media/congress/2015/7360-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2015/74515f8e-a752-4cbb-b407-3a70fca5b0b3-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2015/74515f8e-a752-4cbb-b407-3a70fca5b0b3-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/32c3-7360-un_sicherheit_von_app-basierten_tan-verfahren_im_onlinebanking","url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_title":"32C3: gated communities","conference_url":"https://api.media.ccc.de/public/conferences/32c3","related":[{"event_id":1728,"event_guid":"3poSeUcpc6woNaI5dhATcQ","weight":8},{"event_id":2163,"event_guid":"P27IBlfmjGfZIib1deB_xg","weight":18},{"event_id":2291,"event_guid":"2f68e356-6c3f-4034-9640-c06d717ed96b","weight":18},{"event_id":2809,"event_guid":"0417a69e-87af-43f9-abbb-0f0666bfda3e","weight":26},{"event_id":2814,"event_guid":"3cb4101c-2042-4883-b6fb-6591994a70c0","weight":70},{"event_id":2826,"event_guid":"9ab1407a-126f-48d9-898d-eae7974324e9","weight":56},{"event_id":2827,"event_guid":"f79c744f-30d1-4175-a173-2e760049337d","weight":41},{"event_id":2837,"event_guid":"9f2e9ff0-1555-470b-8743-9f07f54e9097","weight":12},{"event_id":2846,"event_guid":"527d5a8e-841d-48ad-89d9-b62fbee741b8","weight":56},{"event_id":2868,"event_guid":"0549d204-604a-46c5-92a2-e64b85aa9892","weight":40},{"event_id":2875,"event_guid":"0bdbef2d-1594-4582-b315-7ee5da5505bf","weight":17},{"event_id":2880,"event_guid":"72ad2630-b736-4d4c-8ea1-d982076426bc","weight":9},{"event_id":2882,"event_guid":"df35c860-60fc-4df8-801c-b2f4f91b33b8","weight":8},{"event_id":2886,"event_guid":"088e3078-bab2-433d-8be2-f1a4b37b4d5c","weight":31},{"event_id":2892,"event_guid":"668ba44b-6800-4a8f-9544-b8e5cd7bd86c","weight":23},{"event_id":2899,"event_guid":"0c8f0e98-92ee-42ba-aa75-04fc50344904","weight":14},{"event_id":2907,"event_guid":"3b16ddc9-499b-44b1-9084-b3e328daea30","weight":31},{"event_id":2920,"event_guid":"d516ffe3-d32d-4bed-8289-09d245ac2b2f","weight":37},{"event_id":2922,"event_guid":"47cbd880-f500-4c44-b717-c11ed1da087d","weight":42},{"event_id":2923,"event_guid":"ba780105-8cc1-4e6e-8552-5e3bc150b9ff","weight":51},{"event_id":2925,"event_guid":"e1efc11e-170c-4234-9ac0-4451a6631b01","weight":36},{"event_id":2933,"event_guid":"c50c5193-7389-4858-9352-14ea6d74b77a","weight":23},{"event_id":2935,"event_guid":"f9d33869-f9a2-4570-9e9a-25c56e32082a","weight":15},{"event_id":2938,"event_guid":"03c8501f-d327-4228-a9fe-2635370d25d2","weight":72},{"event_id":2944,"event_guid":"5fb6f7b5-c237-4b64-b786-85e4c95f13ad","weight":28},{"event_id":2947,"event_guid":"422ba0b9-debb-436e-9822-e9a201dec845","weight":8},{"event_id":3615,"event_guid":"74783236-46f4-493c-9574-1b27a44847b7","weight":190},{"event_id":3633,"event_guid":"530f0400-e4e8-4d99-909d-4cfc8121c0b0","weight":8},{"event_id":3640,"event_guid":"700a07e7-a9c4-437b-a4c5-4491b23a9b4a","weight":41},{"event_id":3667,"event_guid":"6347d122-daf0-4b30-851c-32cac06bf6bd","weight":15},{"event_id":3671,"event_guid":"4ef69e6a-026f-4b30-888d-af654b220a3d","weight":18},{"event_id":3689,"event_guid":"1f7eb981-2819-4824-8f40-4ddde0be7bf3","weight":18},{"event_id":3695,"event_guid":"c300b194-2a85-4705-92aa-b4e789882303","weight":30},{"event_id":3701,"event_guid":"155a622a-196e-4e05-a262-88f3a7726bbe","weight":9},{"event_id":3760,"event_guid":"1c75e6a1-e586-4b91-abce-92a4561d0181","weight":10},{"event_id":3762,"event_guid":"25e2df7d-5740-4c2f-bc34-986326d606fe","weight":10},{"event_id":3853,"event_guid":"efeeaebc-3f29-11e7-9ba7-2f214305c877","weight":49},{"event_id":4763,"event_guid":"2ef3b60f-6e5c-4c23-a145-d263685ec13e","weight":9},{"event_id":4764,"event_guid":"da934433-0092-4749-b606-56b65e84214f","weight":15},{"event_id":4767,"event_guid":"f2ca3661-30c8-476e-9d6b-920bb20b21eb","weight":15},{"event_id":4794,"event_guid":"a2887b4a-0c9d-4220-a52f-c65c20ae25d7","weight":131},{"event_id":4800,"event_guid":"a9ebf7e3-abc5-49d9-8efe-316b3bc52902","weight":8},{"event_id":4855,"event_guid":"51b586be-500c-436e-b70c-fc433e65c4be","weight":8},{"event_id":4866,"event_guid":"117a52b4-f675-49dd-aafe-659c07b6bc9c","weight":8},{"event_id":4929,"event_guid":"8e222759-cd6b-403b-8fe1-3517bf7d2802","weight":11},{"event_id":4934,"event_guid":"4d3d9d56-7617-44da-b620-21ce5389a0b2","weight":11},{"event_id":6233,"event_guid":"9fa9eae0-2d2f-4bce-a7f5-1983003b3db7","weight":9},{"event_id":6383,"event_guid":"7177142b-6f15-4fac-af62-c45df7a377a9","weight":11},{"event_id":6430,"event_guid":"462f9320-3a0e-4785-82de-15343803c2ba","weight":9},{"event_id":6462,"event_guid":"23e85d7a-9645-4ae2-9954-63b71abc08d4","weight":8},{"event_id":6474,"event_guid":"f58a2b6d-bde0-483b-a8db-043ea9371cb6","weight":13},{"event_id":6543,"event_guid":"48ed6dea-e67d-4866-8c35-318e9d892363","weight":15}],"recordings":[{"size":21,"length":1845,"mime_type":"audio/opus","language":"eng","filename":"32c3-7360-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.opus","state":"downloaded","folder":"opus-translation","high_quality":true,"width":null,"height":null,"updated_at":"2015-12-29T20:56:47.525+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/opus-translation/32c3-7360-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.opus","url":"https://api.media.ccc.de/public/recordings/9049","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":28,"length":1845,"mime_type":"audio/mpeg","language":"eng","filename":"32c3-7360-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp3","state":"downloaded","folder":"mp3-translated","high_quality":true,"width":null,"height":null,"updated_at":"2015-12-29T20:56:35.968+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/mp3-translated/32c3-7360-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp3","url":"https://api.media.ccc.de/public/recordings/9047","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":null,"length":null,"mime_type":"application/x-subrip","language":"deu","filename":"32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.de.srt","state":"complete","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2020-01-03T19:22:13.239+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.de.srt","url":"https://api.media.ccc.de/public/recordings/44330","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":131,"length":1854,"mime_type":"video/mp4","language":"deu-eng","filename":"32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_sd.mp4","state":"downloaded","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-02-03T14:12:34.607+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/h264-sd/32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_sd.mp4","url":"https://api.media.ccc.de/public/recordings/9050","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":100,"length":1854,"mime_type":"video/webm","language":"deu-eng","filename":"32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_webm-sd.webm","state":"downloaded","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-02-03T14:12:34.686+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/webm-sd/32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/9052","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":360,"length":1854,"mime_type":"video/mp4","language":"deu-eng","filename":"32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_hd.mp4","state":"downloaded","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T14:12:02.679+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/h264-hd/32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_hd.mp4","url":"https://api.media.ccc.de/public/recordings/8711","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":341,"length":1854,"mime_type":"video/mp4","language":"eng","filename":"32c3-7360-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp4","state":"downloaded","folder":"h264-hd-web","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T14:12:02.503+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/h264-hd-web/32c3-7360-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp4","url":"https://api.media.ccc.de/public/recordings/8710","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":291,"length":1854,"mime_type":"video/webm","language":"deu-eng","filename":"32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_webm-hd.webm","state":"downloaded","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T21:01:46.597+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/webm-hd/32c3-7360-de-en-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/9045","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":341,"length":1854,"mime_type":"video/mp4","language":"deu","filename":"32c3-7360-de-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp4","state":"downloaded","folder":"h264-hd-web","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T14:12:02.339+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/h264-hd-web/32c3-7360-de-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp4","url":"https://api.media.ccc.de/public/recordings/8709","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":28,"length":1845,"mime_type":"audio/mpeg","language":"deu","filename":"32c3-7360-de-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp3","state":"downloaded","folder":"mp3","high_quality":true,"width":null,"height":null,"updated_at":"2015-12-29T20:56:04.263+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/mp3/32c3-7360-de-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.mp3","url":"https://api.media.ccc.de/public/recordings/9046","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"},{"size":23,"length":1845,"mime_type":"audio/opus","language":"deu","filename":"32c3-7360-de-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.opus","state":"downloaded","folder":"opus","high_quality":true,"width":null,"height":null,"updated_at":"2015-12-29T20:56:30.247+01:00","recording_url":"https://cdn.media.ccc.de/congress/2015/opus/32c3-7360-de-Un_Sicherheit_von_App-basierten_TAN-Verfahren_im_Onlinebanking.opus","url":"https://api.media.ccc.de/public/recordings/9048","event_url":"https://api.media.ccc.de/public/events/74515f8e-a752-4cbb-b407-3a70fca5b0b3","conference_url":"https://api.media.ccc.de/public/conferences/32c3"}]}