full-disclosure - Most common keystroke loggers?

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu Dec  1 17:52:48 2005
From: foofus at foofus.net (foofus@...fus.net)
Subject: Most common keystroke loggers?

On Thu, Dec 01, 2005 at 10:24:50AM -0700, Shannon Johnston wrote:
> I'm looking for input on what you all believe the most common keystroke
> loggers are. I've been challenged to write an authentication method (for
> a web site) that can be secure while using a compromised system.

I can think of authentication methods that work (i.e., provide acceptably 
reliable assurance that the user is who he/she claims to be, without 
giving an eavesdropper the means to impersonate the user in future 
authentication transactions) under these conditions.

I can't think of a way of providing any assurance that actions taken in
the user's name are authentic representations of the user's intentions
(i.e., a way of ensuring that requests made on the user's behalf are
legitimate) if the user's system is compromised.  Is that part of the
challenge?  

--Foofus.