bugtraq - RE: Defeating Citibank Virtual Keyboard protection using screenshot method

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 10 May 2007 10:18:51 -0700
From: "David Gillett" <gillettdavid@...a.edu>
To: "'Gadi Evron'" <ge@...uxbox.org>,
	"'Jim Harrison'" <Jim@...tools.org>
Cc: "'Int3'" <yashks@...il.com>, <bugtraq@...urityfocus.com>
Subject: RE: Defeating Citibank Virtual Keyboard protection using screenshot method

> But your point above:
> "without installing malware on the victim host"
> 
> Although true on some level, is bogus for the purpose of 
> this work, as it being written makes an automatic 
> assumption on working only after malware is installed.

  The principle of "defence in depth" is that each security 
measure adds to overall security by providing protections that
continue to operate even if other defences have been breached.

  The demonstration that Citibank's "security measure" can be
relied upon ONLY in the case where no other breach has allowed 
malware to be installed on the client machine is thus a proof
by example that it does not actually provide such defence in
depth, and in fact for far too many end users cannot be safely
assumed to provide any security at all.  
  It turns out that any security it is alleged to provide is
entirely dependent on the effectiveness of other security 
measures already in place.

  A "security feature" that only delivers security IF you are
already secure sounds like a good candidate for Schneier's
doghouse.

David Gillett