@article {24196,
	title = {  Risk Assessment of a National Security Infrastructure},
	journal = {IEEE Security \& Privacy},
	volume = {7},
	year = {2009},
	pages = {34-41},
	publisher = {IEEE},
	abstract = {In Norway, BankID is the banking industry{\textquoteright}s public-key infrastructure (PKI) of choice for authenticating Internet customers. But do BanklD{\textquoteright}s differences from standard PKIs make it a riskier choice? This assessment, based on both publicly available information and usage experiences, addresses that question.},
	keywords = {bank data processing, Internet, public key cryptography},
	doi = {10.1109/MSP.2009.17},
	author = {Kjell J{\o}rgen {Hole} and Klingsheim, A.N. and Netland, L.-H. and Espelid, Y. and Tjostheim, T. and Moen, V.}
}
@inproceedings {24237,
	title = {Identity Theft: Much too Easy? A study of Online Systems in Norway},
	journal = {12th International Conference on Financial Cryptography and Data Security (FC08)},
	volume = {Volume 5143 of the series Lecture Notes in Computer Science},
	year = {2008},
	pages = {192-196},
	abstract = {Governments and commercial companies connect more and more computer systems to the Internet, giving people easier access to ser- vices. Many of these online services handle personal information. Leak- age of such information can facilitate large-scale identity theft. This paper determines how personal information leaks from online systems of national importance, discusses proof of concept software to demon- strate the seriousness of the problem, and suggests how to improve the situation.},
	author = {Klingsheim, A.N. and Kjell J{\o}rgen {Hole}}
}
@article {24200,
	title = {Open Wireless Networks on University Campuses},
	journal = {IEEE Security \& Privacy},
	volume = {6},
	year = {2008},
	pages = {14-20},
	publisher = {IEEE},
	abstract = {Open wireless networks raise privacy issues and entail increased risk of malicious attacks and illegal downloading activities. Such networks are nonetheless attractive-particularly to universities-because they enhance usability and thus expand access to nonsensitive system resources. At universities, such access brings numerous benefits to students, faculty, and the surrounding community alike. Here, the authors describe the challenges of removing individual user authentication requirements at the perimeter of a university network in which mobile device users access system resources over wireless links to the wired infrastructure. The authors discuss how to mitigate the security and privacy risks entailed in an open network of this sort, and also describe how IT departments can vary the network{\textquoteright}s degree of openness.},
	keywords = {authorisation, radio networks, telecommunication security},
	doi = {10.1109/MSP.2008.92},
	author = {Kjell J{\o}rgen {Hole} and Netland, L.-H. and Espelid, Y. and Klingsheim, A.N. and Helleseth, H. and Henriksen, J.B.}
}
@inproceedings {24236,
	title = {A Proof of Concept Attack against Norwegian Internet Banking Systems},
	journal = {12th International Conference on Financial Cryptography and Data Security (FC08)},
	volume = {Volume 5143 of the series Lecture Notes in Computer Science},
	year = {2008},
	pages = {197-201},
	abstract = {The banking industry in Norway has developed a new secu- rity infrastructure for conducting commerce on the Internet. The initia- tive, called BankID, aims to become a national ID infrastructure sup- porting services such as authentication and digital signatures for the entire Norwegian population. This paper describes a practical man-in- the-middle attack against online banking applications using BankID. The attack gives an adversary access to customer bank accounts in two dif- ferent online banking systems. Proof of concept code has been developed and executed to demonstrate the seriousness of the problem.},
	author = {Espelid, Y. and Netland, L.-H. and Klingsheim, A.N. and Kjell J{\o}rgen {Hole}}
}
@inproceedings {24235,
	title = {Robbing Banks with Their Own software{\textemdash}an Exploit against Norwegian Online Banks},
	journal = {23rd International Information Security Conference (SEC 2008)},
	volume = {Volume 278 of the series IFIP {\textendash} The International Federation for Information Processing },
	year = {2008},
	pages = {63-77},
	publisher = {Springer},
	abstract = {The banking industry in Norway has developed a new security infrastruc- ture for conducting commerce on the Internet. The initiative, called BankID, aims to become a national ID infrastructure supporting services such as authentication and digital signatures for the entire Norwegian population. This paper describes a man-in-the-middle vulnerability in online banking applications using BankID. An exploit has been implemented and successfully run against two randomly chosen online banking systems to demonstrate the seriousness of the attack.},
	author = {Espelid, Y. and Netland, L.-H. and Klingsheim, A.N. and Kjell J{\o}rgen {Hole}}
}
@article {24201,
	title = {Challenges in securing networked J2ME applications},
	journal = {IEEE Computer},
	volume = {40},
	year = {2007},
	pages = {24-30},
	publisher = {IEEE},
	abstract = {An increasing number of smart phones support Java 2, Micro Edition. Mobile application developers must deal with J2ME{\textquoteright}s inherent security weaknesses as well as bugs in implementations on real devices. The new Security and Trust Services API for J2ME addresses some of these challenges, although it too has shortcomings.},
	keywords = {application program interfaces, Java, mobile computing, security of data},
	doi = {10.1109/MC.2007.49},
	author = {Klingsheim, A.N. and Moen, V. and Kjell J{\o}rgen {Hole}}
}
@article {24202,
	title = {Lessons from the Norwegian ATM System},
	journal = {IEEE Security \& Privacy},
	volume = {5},
	year = {2007},
	pages = {25-31},
	publisher = {IEEE},
	abstract = {This case study focuses on real-world ATM card misuse, illustrating how too much secrecy led to a deterioration of PIN-based authentication procedures, and why a bank{\textquoteright}s refusal to share technical information is a threat to customers during a conflict.},
	keywords = {automatic teller machines, message authentication},
	doi = {10.1109/MSP.2007.168},
	author = {Kjell J{\o}rgen {Hole} and Moen, V. and Klingsheim, A.N. and Tande, K.M.}
}
@article {24233,
	title = {Vulnerabilities in E-Governments},
	journal = {International Journal of Electronic Security and Digital Forensics},
	volume = {1},
	year = {2007},
	pages = {89-100},
	publisher = {InderScience Publishers},
	abstract = {This paper shows that more than 80\% of the E-Governments in the world are vulnerable to common Web-application attacks such as Cross Site Scripting and SQL injection. Industrialized countries were found to be more vulnerable than under-developed countries (90\% vs. 50\%). The paper also describes some malicious data mining possibilities on the Norwegian E-Government, and how information can be combined and used to create other practical attacks.},
	keywords = {cross site scripting, e-government, Electronic government, electronic security, Privacy, SQL injection, vulnerabilities, web application attacks},
	doi = {10.1504/IJESDF.2007.013595},
	author = {Moen, V. and Klingsheim, A.N. and Simonsen, K.I.F. and Kjell J{\o}rgen {Hole}}
}
