Hello, and welcome to the session in which we will discuss the enterprise risk management system. This is part two of five. And the reason I have to clarify this, because I already covered governance culture, which is one of the components of ERM. And within that component, we had five principles in this session, specifically, I'm going to be focusing on strategy and objective settings. And we're going to have four principles. Now, although I am covering each component separately, because we have five components for ERM, and in total of 20 principles, all these components and principles are interrelated. So just want to make sure you're aware of this. So if you did not watch one of five, I strongly, you do, you do so. In other words, if you're not familiar with governance and culture, you do so. Now this topic is covered in the CPA on the CPA exam, BEC section, as well as the CMA exam and in your accounting information system. So whether if any of these applies to you, especially if you're a CPA or a CMA candidate, I strongly suggest you take a look at my website, farhatlectures.com. I don't replace your CPA review course. I can do so. I wish I can, but I can't. But I can be a useful addition to your CPA review course or to your CMA. I can add 10 to 15 points to your score by explaining the material differently. You might need that alternative explanation. You might need that backup explanation. I can do that. Your risk is one month of subscription. Your potential gain is passing your certification, passing the exam. And if not for anything, take a look at my website to find out how well is your university doing for the CPA exam. I do have resources for other accounting, finance, CPA, CMA sections. Please connect with me on LinkedIn and take a look at my LinkedIn recommendations. Like this recording, share it, connect with me on Instagram and Facebook. So let's go ahead and get started. Once again, I'm going to go over the definition of ERM. It's the cultural capabilities and practices integrated with strategy, setting, and performance. I'm going to stop here. And the reason I'm going to stop here is because in the prior session, the reason I'm going to stop here. In the prior session, we basically looked at the culture, capabilities, and practices. In this session, I'm going to be looking at integrated with strategies, strategy, setting. Okay. And the reason I said this, because when I first, when the first time I looked at this definition, I told you this definition, it's going to be, it's going to take you an hour, an hour and a half of lecture to go over it. So this is the definition that we went over this part in the prior session in corporate governance. In this session, we're going to be looking at integrated strategy and objective setting. In the next session, we'll deal with the performance. And that's going to be the most extensive one. And obviously, you know, how to manage your risk in creating, preserving and realizing value. And those two, we'll cover them at the end. I may even combine them together. We'll see how it goes. So this is basically what we are looking at here. So let's go ahead and start to talk about strategy and objective setting. So the four principles in this session are analyze business contacts, define risk appetite, evaluate alternative strategies, and formulate business objectives. So all of those will be under the strategy and objective setting. And this umbrella, the whole umbrella we are dealing with is E, R, M. So it's good to keep that in mind, to keep that in mind. Before we proceed any further, I just want to talk about the core values, not talk about them. Just remind you that those were in the prior session, those core values were part of culture and governance. And specifically, we spoke about the core values, mission and statement. And the reason I'm mentioning this is because in this session, we're going to be talking about strategies. How do we, how do we create strategy? Well, to create a strategy, you have to have those missions, visions, and core values. And your strategy must support whatever you believe in. In the session, in the prior session, we spoke about Johnson & Johnson as a sample company. Well, that's great. We do have core values. We do have missions. Now our strategy obviously should support those mission. So we're going to integrate the enterprise risk management system with strategies to understand our risk profile and how we're going to be relating strategies and business objective to our vision, to what we do. So the first thing we're going to have to do is to understand what is a business context. They simply put every business function in a certain environment. It could be a risky environment, not so risky, stable environment, not so stable. What are, what could be some business context? Those are events, relationship trends and other factor that influence your organizational strategy and business objective, depending what business you are in, at what time you are operating, in which economic environment. That's going to determine how you're on your company, how you're on your strategy. Now, there are many factors that could influence the organization strategy and business objective. Some of these factors are internal and some are external. Let's discuss each one of them just to kind of give you an idea. What are we talking about here? How do we analyze the business within a specific context? Internal. For example, what capital do you have? Capital means what type of assets do you have? How much cash do you have on hand? If you have a lot of cash versus not a lot of cash, is your company liquid or not liquid? What type of property, plant and equipment you have? What type of intangible asset? That's going to determine what type of strategy you are going to undertake. And it's going to determine what type of risk you are going to accept based on your capital, based on your resources. Your capital are your resources. Also, part of kind of interrelated capital, basically people were going to treat them separately, but think of them the same. Your people are your capital. What type of knowledge you have? Skills? What type of a culture you have within your company? What type of values do you have? That's going to determine or that's going to align your strategies with your mission, with your core values. So you have to keep that in mind. Those are internal environment. For example, if you have people at your company that are rigid, that they don't think outside the box, well, you cannot be, you cannot be, you cannot consider yourself an innovative company. And even if you do, you are going to fail. So on the other hand, if the people that you employ are open-minded, they think outside the box, they're visionary, then your strategy will have to accommodate this. So those are internal factors. Processes. What type of processes do you have? Processes are activities, tasks, a change in management. What if each company will have a different processes and that will determine, that will help align the company toward a particular strategy? Technology. What type of a technology are you using? Is it new? Is it old? Is it average technology? Also, we have external factors that's going to influence your strategy. It's going to influence what type of business objective you are going to have. It's going to influence your mission statement. For example, there are political factors. Like, for example, when Trump is president versus Biden, well, the tax policies, it's going to influence how you operate. For example, if the tax policies for a certain administration don't favor you operating in the U.S., you might want to move to China. You want to move to Mexico to operate depending on that political environment. And that political environment is external environment.  Economic environment. That's a big one. Interest rate, inflation is of obtaining credit. For example, if interest rate is low and we have practically no inflation and we have a lot of credit, what companies do they borrow money to expand? So it's an expansion time. So your strategy, if you said, well, I'm going to set a strategy to expand my business, this makes perfect sense because the economic environment, the external environment will support that decision. Also, there are social factors, external factors. For example, customer preference. If the customer is now on Instagram or Facebook or Twitter, well, guess what? Then you have to align your strategy for that social media. Demographics, for example, in the area in which you are operating, people are young. Then if your strategy is not to serve those people, then it's going to be an effective strategy versus if you are operating in an area where mostly are retirees. For example, if you're operating in Florida, well, your business strategy will be different because the average age is much higher. A technology. What are the changes in artificial intelligence, big data, R&D? That's also going to influence how you're going to set up your strategies and business objective. Legal external environment laws, regulation, industry regulation, that's going to affect your company greatly, especially if you are in a company that are heavily regulated like oil, banking, insurance, so on and so forth. Environmental factors, climate change, natural catastrophe that could affect your business. So you have to take these internal environment, external environment in order to understand in what type of business environment you are dealing with. And that's going to influence what type of strategy and business objective you are creating for your business. A few more type of business contacts that we can think of. Your business contacts could be complex, could be unpredictable, could be dynamic. And we're going to have to define each one of them real quick. Dynamic is, for example, you might be in an industry where there's low barriers of entry. It means anybody can start a business. What does that mean? It means changing risks can appear anytime. I'll give you an example you may or may not agree with it. For example, think of Uber. Uber, I believe it's a dynamic industry because practically anyone who can create app servers, they can start a business like this. You may disagree with this, but it has a low barrier of entry. As a result, changing risks can appear anytime who are considered dynamic. Or you might be operating in a complex environment. Well, here you have many interdependencies and interconnection. For example, if you are a company like Coca-Cola or PepsiCo to be more specific, you are operating in many different countries.  And a company like PepsiCo, they're in so many different businesses. So the risk here, you have unique external environmental factors, and they're going to affect your business differently because you're in so many businesses. So your business is considered complex. Or it could be your business is unpredictable, changes occur rapidly and anticipated. And here we are dealing with technology companies or pharmaceutical companies for that matter. But technology companies will be better. I mean, well, you might consider Uber technology company and predictable means it can change very quickly. And your product could become obsolete because of new technology. Yes, daddy? Real quick. Nothing. Okay, let me finish this. I just want to sit in your lap. Okay, good. I have more, okay? I have more. I'm just going to sit with you. Okay, okay. You can sit with me. Okay. The next thing we want to do is define the risk appetite. This is two of four. I mean, I failed to mention that we are dealing again.  We are dealing with the second level of enterprise risk management. Let me just kind of go back up here, strategy and objective. We are done with analyzing business contacts. Now we're going to be dealing with the fine risk appetite, which is two of four. So when you see this two of four, so you understand, I don't want you to lose track of what we are doing. So in this context, we have to define risk appetite. What is first of all, what is risk? What is risk? Risk is the possibility that an event will occur and affect the achievement of the strategies and the business objective. It will occur basically negatively. It will affect it negatively. This is what a risk is. So something will happen and it will be real what you are thinking about. Now, different risks occur for different companies. For example, a restaurant company, the risk is way different than an airline company, way different than a beachfront property. Each one of them will have a different risk. For example, the restaurant, they are concerned about food safety. Airline companies are concerned about airplane safety or maybe a credit if they need to borrow money to survive. A beachfront property, they're worrying about maybe a hurricane happening and the beachfront property will be destroyed. So risk and all these factors will affect their business objective. It will not allow them to get to their business objective or reach their strategy. So what is risk appetite? What's the risk appetite? How much risk you are willing to take or accept? Different companies, as we spoke about in the prior session, different companies will have different risk appetites. Some companies are risk averse. They will try to avoid risk at any cost. In some companies, they embrace risk. They don't care about risk because they believe with risk comes return and they're willing to take on more risk. So the risk should be considered within the context of their mission, vision, culture, prior strategy and risk capacity. So everything we're going to be talking about in this session is it has to be within their mission, vision and culture and core values. So it has to be less than their risk capacity. Risk capacity is the maximum amount of risk you can take on. And risk can be expressed in many different ways for a company. For example, it can be qualitatively. For example, they can define risk as low, medium or high or it can be defined quantitatively with some numbers. For example, we will accept percentage of sales. For example, bad debt as 10% of sales or 5% of sales or bad loans, 3% of the total loans. Or we can define this as a standard deviation or we can define it as beta if we are a finance company. So you can define risk in so many, so many different ways. Just terminology, what's risk inventory? Every company should have a risk inventory. And what's risk inventory? You have to identify all the risks that could affect your business and its strategies. Those risks may or may not happen, but you need to be aware of them, inventory them, make sure you're aware of them. Because at some point of the environment changes, of the economic macro environment changes, they may become more probable or less probable, you want to be aware of them. There's something called inherent risk. This is the risk that exists in the absence of management action to curtail this risk. So this risk is present regardless of management action. They exist. Now what can we do? We can mitigate this risk. Once we mitigate this risk, if we take inherent risk, inherent risk, and we mitigate that risk, what's left is the residual risk, residual risk. So we always try to mitigate the inherent risk to come down to the residual risk. It's the risk that remains after management action to alter, not to later, to alter its severity, to reduce that risk. Obviously we want residual risk of zero, but that's not really possible because we live in the real world. So make sure you are aware of what's actual residual risk. It's inherent risk minus some mitigation. The company buys insurance, moves to another state if there's any risk in that particular state. Whatever the risk is, you mitigate that risk. And bear in mind, just want to make sure we're keeping the big picture in mind, the board of directors approved risk appetite and communicate this throughout the organization. So remember the board's on the top and it's going to communicate this information. This how much risk are we willing to take? Because you don't want to have a rogue manager or a rogue head of an apartment taking on a lot of risk. Another thing we want to do is we want to evaluate alternative strategies. That's part of ERM, part of our ERM, part of our strategy and objective. Because we may undertake strategy, but it may not be the only one or it may not be the optimal one. Therefore we want to look at alternative strategies. Although we're looking at alternative strategies, that's fine. We want to keep in mind our risk profile and we want to keep in mind that we have mission, vision, core values that must be aligned. Although those are alternative strategies, alternative like I'm an alternative to your CPA review course. Yes, they are alternative, but they still have to be aligned with your mission, vision and core values. They cannot violate those. How do we create alternative strategies? Well, hopefully you are familiar with this scenario analysis. We could do what happened if sales increases by a certain percentage or decrease by a certain percentage. What happened if we go through a recession? What happened if GDP contracted? What happened if GDP expanded? Well, those are scenario analysis. We could do SWAT analysis. We could look at our strength, weaknesses, opportunities and threat. Look at our opportunities, look at our threats and create strategies, alternative strategies if they materialize. Whether an opportunity materializes or threat materialize. We could look at competitors and analyze what they're doing and try to create alternative strategies in case they take different route. So this is how we evaluate alternative strategies and strategies should be changed. So we should not accept any strategies if it fails to create, realize or preserve value. Now you want to know what does create, preserve and realize value is. What is create value? When do you create value of the company? Well, you create value when the benefit is greater than the cost. You undertake an action and the benefit of that action is greater than the cost. How do we quantify this? Usually you can quantify this in NPV, net present value. Look at your net present value if it's positive. We assume we are creating value or as long as revenue is more than expenses. We can measure this through an income statement. What does realize is how do we realize value? We realize value when we cash out like a realized transaction. When actually when we transfer the benefit to the shareholder or to the company in retained earning, which eventually goes to the shareholder when we cash out. This is when we realize the value. And how do we preserve the value of the company? Well, we want to undertake any activities that sustain the company resources, sustain their assets. Don't let them erode. Don't let them go down like maintenance, R&D, creating new intangible asset and value eroded, which is it's not here. When does value eroded occur? When management don't produce or create value. So if you undertake a project and the costs are greater than the benefit, what you did is you eroded the value of the company in a sense that you are losing resources. You have less resources now as a result of undertaking this transaction. The key is to increase your assets, to increase your resources in terms of cash by undertaking activities. So this is what we mean by evaluating alternative strategies. Now also you want to formulate business objective and this is four of four, the principle four of four in this session that has to do with strategies and objective setting. So you have to have objective, business objective. Again, all your business objective has to be within your risk appetite, core values, mission statement, and vision. I mean, I know I mentioned this, but a lot of CPA questions, they throw the statement and you want to make sure your business objective, your strategies, your alternative, your alternative strategies are they all align with those concept. Okay. And you could have four type of business objectives. You could have strategic objective and here you are looking at the big picture. And this is usually expressed in the mission statement. It tells you what's the direction of the company. For example, one strategic objective is to, for example, conquer new market every two years. Just a big picture. This is a strategic objective. Okay. You might have operational objectives. Operational objectives are day-to-day operation, how to effectively use your resources. And we could have hundreds of examples of this. For example, one objective will be to reduce employee turnover. How would you reduce employee turnover? What steps you will take to do so well? You will train your employees, you will compensate them well. You support them. You have life, life for balance, so on and so forth. But again, and you could have so many operational objectives and ways to achieve those operational objectives. Also, you want to have reporting objectives. Those reporting objectives deal with financial reporting, whether it's internal or external. You want to make sure that your financial report, whether internally or externally, they are reliable, accurate objective. Now, how would you make sure that's the case? Well, you will have good accounting department. You'll have good internal control. You will make sure you have checks and balances. You'll bring an external auditor, so on and so forth. So you have so many different steps to do so. Compliance. Obviously, you want to have compliance as a business objective. You want to make sure we are complying with the law in the area we are operating with any regulation in our industry. You want to make sure your employees are complying with company policies and procedure. How would you do that? You will train the employees. You will remind them about, look, we have certain laws, procedures and company policies you have to be in compliance with. In compliance with it. If someone violate them, well, you don't reward them. You will either fire them or you discipline them and you make sure everyone is aware of this. This way you want to achieve your business objective, which is compliance business objective. Again, all these objectives should be specific. Now, I gave you, you know, examples, for example, conquer new market. That's a specific, but it has to be measurable. For example, how big should be the market? Is it a million dollar market, two million dollar market, five, 10, so on and so forth. It has to be observable. I can see it. We can touch it in a sense that we can measure it. We can measure it and observe it and we can obtain it. If it's not obtainable, well, business objective are useless. Actually, they're demoralizing if they are. Same thing with reducing employee turnover. Well, this is a key. Employee turnover. For example, if the employee turnover per year was 15% or 20%, we want to reduce it down to 10%. This is measurable. Can I see it? Is it obtainable? Can I reach that? If not, I should not, I should not, you know, I should not put pressure on HR. Maybe we want to bring it down to 15% or whatever that number is. This is what we mean by business objective should be specific, measurable, observable, and obtainable. Now, what I did in the session, we went over strategic and objective setting, which is part of ERM. So we are done with one. We are done with two. In the next session, we would look at three, which is performance. And here, again, we're going to be dealing just explaining this term in this definition of ERM is defined as cultural capability. A cultural capabilities, practices integrated with strategy setting. We're done with all of those and performance and performance that or get their organization rely on to manage risk. And we'll talk about managing risk, obviously, in this in the performance session. Okay. So the next session, I would say it's a major one. It's a big one. Again, at the end of this recording, I would like to remind you whether you are an accounting students or a CPA candidate, especially if you are a CPA candidate, I strongly suggest you visit my website. I don't replace your CPA review course. I don't, but I can be a useful alternative. I can give you additional explanation, additional resources, multiple choice through false. That's going to help you pass the exam. Good luck. Study hard and stay safe.


Five African presidents who paved the way to freedom. Five, Thomas Sankara Burkina Faso. Sankara was the president of Burkina Faso for four years before he was assassinated. He is known for his radical reforms and his commitment to social justice. Four, Patrice Lumumba, Congo. He was a leading figure in the Congolese independence movement and he was known for his outspoken opposition to Belgian colonialism. Three, Olustin Obasanjo, Nigeria. He was a military leader who believed that Nigeria should be at United Country. Two, Nelson Mandela, South Africa. Mandela was the first black president of South Africa and he is best known for his fight against apartheid. One, Quame Cruma, Ghana. Cruma was the first president of Ghana and he is considered to be the father of African independence. He was a strong advocate for Pan-Africanism and he worked to unite African countries.


It's a pleasure to introduce the next speaker, Vincent Hauquat. He's studying computer science in Erlangen. He's doing his master with a focus on IT security. But the work he is presenting us now, he actually completed before during an assistant position beforehand. And it is about insecurity of app-based ton of indication in online banking. Give us a welcome, applause for Vincent, please. Welcome from my side. My name is Vincent Hauquat. Last autumn, my colleague and I had a look at the security of app-based ton of indication. Maybe one of you has already heard about it on Heise. Two weeks ago, I got a call from the German bank institution, Mr. Mayer, as I want to call him now, asked me what he's doing between what I'm doing between Christmas and New Year. He actually wanted to know if his PR department actually needs to get ready for a new attack or he just, Vincent says that he hopes that the bank already has a template drafted up. It makes it easier for the next time it happens. But online banking is so established these days that it affects us all. A special property of it is that in the time between its creation in the 80s and now, it turned into a two-factor authentication procedure. You usually have a username and password and a ton. Mostly, the ton procedure was modified for security reasons. It usually works this way. For completeness' sakes, I want to draft it up here. You log into the portal. You use your username and password. You create a transaction. And in the second step, you have to verify it with a ton. Usually, it used to be an old system where you had a list on paper. The new system or newer is with using a phone. But this is also leaky or insecure as we found. And then there's also the special hardware devices that are pretty commonplace. This last one is actually already pretty safe. But if you believe the banking institution, then there is a pressing need in the population to always and everywhere be able to execute your transactions. So let's have a show of hands who, at the moment, is doing an online transaction. So if you want to do it everywhere, of course, you don't want to have an extra device that you have to carry with you. So what they did is they discovered a device that everyone always has with them. And it's called the smartphone. And it's, of course, it's secure. OK, now you only have one device instead of two. And therefore, you only have a one-factor procedure in result. So what happens is you use your banking app on the smartphone, use your username and password, create a wire transfer. And then you have to switch to the TAN app. And instead of just using the paper, you go to the TAN app. And most banking companies in Germany are already a big fan and apply this kind of system. The ones that haven't are pretty sure they're already working on it, so they can catch up.  But let's detail how the actual attack would look like. Well, we already know that Malware in the official app stores for the mobile systems is in the fiction. On my own chair at university, there's a guy called Dominik Meyer. And he showed that the Google Play Store just can effectively protect against Malware. The idea was to bring some Malware to the Google app store. And it was his bachelor thesis. And he told his tutor, yeah, that he was ready already. So it was really quick. And that was in 2014, by the way. And what he did was he zipped a root exploit. Well, he just zipped it and he uploaded it. There was no password, nothing else. Just uploaded it. But that's not only a theory. At the same time, we made this app. There was the app Brain Test that had about 100, 500,000 downloads. This app actually did what the theory might be to the mobile 10 area. And it hacks the software and just relates on the hardware. I chose the Sparkas for this example because it's my bank and is one of the first companies to offer this. So we tried to see what can you actually do and how can you attack it. Well, the first thing, you could copy the app or you could reverse engineer the protocol. But that's pretty much concentrated on the TAN app. The problem itself of the TAN area was the two-factor authentication. You could manipulate the transaction. So we manipulate the transaction the user makes in real time. So how did we do this? How was the scenario we thought about? On the left, you can see the Sparkas app. You use it to log into your online banking and to fill in the transaction file. And this goes to the Sparkas and server. And that sends a message to the actually app. And so they are requested to change to the S-TAN app and to transfer it to the Sparkas app. And it's so much automated that you actually ask yourself why you have two apps for this. What we do before, after filling in the information on the Sparkas app, we manipulate the data. And we change the address. We change the amount. And the Sparkas sends the same details to the TAN app and then shows it there. And before showing it there, we manipulate it to the original data. So the user can't see this and just says OK and accepts the payment. What are the security measures for this? So the Sparkas app is pretty easy on this. So it doesn't really have security measures. You have a route. You can see if you have the route on the device. On the other side, the S-TAN app tries to use more measures than one to keep itself safe from malware. But all these measures, even the Sparkas is not sure about all these measures. And if they are really working, they have a route detection. If route is not available, the app just quits. It's a static analysis, by the way. And it's TÜV approved. It's German quality. So from this mark on, we were pretty amazed. But then we see what the actual security measures are. So we found out the Sparkas isn't so sure about their own security measures. So they bought something from Promen. They made a native library, the so-called Promen Shield. And the library is, of course, encoded. And it's upfascated with a special key. So you can't just patch out the library. Yeah, just take it out. They took strings from the Java logics and pushes it into the library. The app itself sets static fields with strings, or they have an index. So that makes it difficult to just pull down the library from the app. It detects routes, debuggers, repackaging. But it doesn't really handle it. So that's the reason is they want to sell a library that works with any software so that it's not personalized on this app. Well, so this is how it's implemented. There's callbacks in the Java code for the events, for example, debuggers or route. The app itself implements the interface. And if it detects it, it calls the code. So on the button, there's a routing status. It's in a parameter Z. And it checks if it's rooted or not. And then it quits just if you don't have the root status. If this event comes, the methods end and the app runs. It's a paradox because this app doesn't have a status. It just delivers strings. Even if root is already detected, I didn't think it was so easy. So we look at the transaction itself. So at first, you have the login window with a name and a password. And you also have the information that the device is rooted, by the way. And in this case, I made a transaction to the tax payment place. And on the next place, we manipulated the data in the background. And you can't really see it. And you are asked to change to push turn so you can put the push into the turn into the actual app. So we do this with our password again in the push turn app. And it's highly likely that it's the same password than in this Sparkhassen app. And then we look at the transaction details. It's 10 cents. So this might be the eBahn, whatever. And it looks good to my turn to Sparkhassen. And then we just remember the last two digits of the transaction number. And you can set the transaction. But if we look into our transaction details, there's a different amount of money on a transaction to the tax payments.  So this is the statement from the Sparkhassen. Well, it's an old version. Yeah, that shouldn't work anymore. So there's a new version since 16th October in a Google Play Store. It's not possible anymore. So well, it's nothing new for us. The Sparkhassen didn't really read it carefully. So we already said that in the current version, the kind of way the attack works, it works differently in the new app. But we can still do it with a little more work. So let's see how the new app works. In order to drive an attack against the new version, we just have to think about what's different this time. Well, at PromoNor, maybe the bank, they realized that it doesn't really make sense what they did so far. Therefore, they don't use Java callbacks anymore, but rather just crash the app if they detect root or debugger or whatever. And then they open a page in the browser. And therefore, you can't just circumvent the root detection anymore that way, or at least it easily. So what we did is we used the expose in order for a proof of concept. And the dot doesn't work anymore. So that's bad. But in order to still make it work, we first have to circumvent root detection and the expose detection. So how does it work? So far, I did pretty well with the approach of just thinking about how I would do it. So what I would do is I would just look through the file system with characteristic things. So and it turns out, yeah, that's what they did. They look for s-fit-su. So what you do is you rename these programs in the file system that these characteristic files that the app is looking for. And suddenly it works again. But that's annoying, because obviously you still want stuff for the other apps to work. And if you rename it, then it doesn't work anymore. So what happens is you usually don't just run the command and not use the full path, but rather just the command name, because it uses the path expansion. So what you did is you changed the path. And it still works everywhere. And the app just doesn't realize it anymore. Perfect. A little bit more paradox now, because the actual app recognizes this, but the promo library doesn't. So you still get the warning in the app, even though it now doesn't crash anymore. So how does the expose detection work? Same approach. What would I would do? Probably they just look for something characteristic that is unique for exposed. And this list shows you what they're looking for. So we now have to get rid of this somehow. And it still has to work. The first four, you can just delete or rename or whatever. You don't need them. So that's easy. And the other three are a little more tricky, because you actually use them. But let's just rename them. And you obviously have to resolve the dependency among them. But it's not enough. So this is actually working a little better than I expected. So they actually look in the executable and look for the string exposed. And then they determine that if they find this string, then obviously it's installed. So I just recompile it, and it works. That's it. So let's do a demo. Same approach. We open the app. We enter our password. This time, we actually look at the specific version of the app. So I can show you this is the version from the 7th of December. That's the most recent one until two hours ago. So let's enter our wire transfer not to the tax collectors, but rather to the library of my university. I actually have to pay a fine. My bank account isn't filled, as you can see. So I had to use something small. But OK, here you can see the push time app has already opened up. So the integration actually was increased. So here you can see again the free URL I want to transfer. And let's have a look at the version again of the push time app. So yeah, this is also the latest version. So yeah, the data is correct. Time is correct. Everything's OK. So let's just confirm. So we go back to the original app. Yeah, the transfer was received. And if you now look into the details of the transaction, so I already paid for some Christmas shopping. And here is the four-year 20 instead of the three-year that I actually was confirming. So yeah, it still works. So wow. And it also has a different info line. So I'm a little quicker than I thought. So we have more time for questions. What can you say about app-based transactions? It's pretty weak. The callbacks are a little more difficult to hack. So you can't just have root. But it's still a game that Sparkhase and other distributors will lose at some point. The root detection, for example, usually causes hassle for the users because it has false positives on some points. So you have to ask yourself if this transaction method is still good for them. But what I actually did was quite weird. I actually circumvented stuff that a normal user does. So I didn't really prevent a real attack. Someone who's actually rooting his own machine has really much difficulties. And a normal user won't install a binary somewhere. Root isn't set for this hack. In this case, it would have been easy enough to use a root exploit.  And I still have a few slides here. And I want to thank you for your attention. Thank you very much, Vincent. Thanks a lot, Vincent. Great talk. So, and we now have time for questions. So if you're online, please write in the IRC. Guys in the room, just go to the microphone. We'll give you a few more minutes to think about it. And I look up. Dear people who are asking questions from the net, I can't see you right now. But if you have any questions, you can read a question. Then I'll just do it. Shata A wants to know, are there also weaknesses in the optic ton procedures? So with phototun, you mean with this ton, kind of, you mean phototun? QR ton and phototun is pretty similar. You scan a code. And then you get a ton. But that differentiates from the device. You can't really use it on one device. Of course, you can scan the QR with your own device. But it's a little different here. And there's a lot of more weaknesses there. So you can copy the app. But that's not comparable to the scenario we had with the mobile ton systems. I'd like to ask you a question. You described how the app is actually hardening itself against debugging. How exactly did you find the transaction details and how did you manipulate them so that you could transfer them to the bank? The problem is that there are only measurements on the analysis basis. So you can't really shoot an attack. The attack itself was made in post. That's a special framework that hooks JavaScript. For the proof of concept, this was easy enough. So most measures that are documented here can't really save yourself from a real attack. Because they usually just only if so, the Sparkers can say, well, yeah, this attack doesn't work anymore. I'm interested in how the app scans against exposed. That looks pretty ridiculous. Can you do this in a proper way that actually would work? Or is there without hope? Yeah, that's a little difficult to make it properly. You need to have trustworthy requests. And who's allowed to be a macro stick? So that's a little difficult. And I don't have an idea right now to how to make it more efficient or to efficiently prevent it. Thanks for the demonstration. I was actually really delighted to see that the distribution into two apps actually doesn't give you anything as an added value. What's your estimation that is it possible in the future to have apps of an authentication mechanism in Android that actually do what they should after routing? Or this looks like a signer approach than what they tried so far? That's really deep into what you are told about. There's a secure world and an insecure world. There's a trust down in RIM that's not used in Android. Samsung has something like Nox that's similar, but you have to buy it. And you don't know how long it might take on Android. So it will take a while, I guess. I can deduce from your explanations that there is a fundamental problem with the combination of two apps on the same device that it actually renders the two-factor authentication useless, and the security can only improve by using two separate devices that have to be compromised. That's what I was talking about. And I have a quote on this. By the way, it's not what I'm only talking about. Even in the Buffin Journal, the ton shouldn't be on the same smartphone that they use for online banking. If someone hacks your smartphone, he can use both methods. That's really clever. You get it to the point. Some people wanted to know, maybe this has already been answered, but if you have two different procedures, maybe app and PC, if it's secure then. Well, it's still have same problems like you are and Photo10. But it's still quite safe. If I use this 10 methods on my computer, it's not worse than an SMS ton, for example. It's comparable. Yeah, this seems relatively new from my own experience. I know that when you use mobile 10 with my device, then I'm not allowed to start the transaction from the same device. So they actually filtered mobile host names. And then the vendor that created the software that they actually released the same app under a different logo.  So I have a different quote here. The MARSI is the internet standard for internet payments. The time is over right now. So you have to have strong customer authorization. But you can interpret everything into this here. So it has a Q&A that's longer than the actual text of this information. And after that, app-based security measurements and the actual online banking have to be on different machines. So it's actually questionable whether this method is supposed to be allowed to live. May I ask how you do wire transfers? Or what do you recommend? I use Chypton. And I actually use it on my mobile device. But usually just when I'm longer somewhere, I don't really have the need to make transactions wherever I am. I actually can say Chypton is really good. Thank you very much. Thanks a lot. He actually promised to stay here if you have some questions. So just walk up to him and chat him up. You guys have been listening to the translation.