full-disclosure - Most common keystroke loggers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Dec  2 09:21:31 2005
From: mike.benjamin at clarinet.com.au (Michael L. Benjamin)
Subject: Most common keystroke loggers?

Although not particularly secure, this is an interesting method I saw in
use recently.

First you enter your account number, then...

Say your PIN is 0467 they present the screen to the user like this (as
an image):

+---+---+---+---+---+---+---+---+---+---+
| 0 | 1 | 2 | 3 | 4 | 6 | 6 | 7 | 8 | 9 |
+---------------------------------------+
| H | A | S | B | E | J | O | W | V | X |
+---+---+---+---+---+---+---+---+---+---+

In the password field you enter the corresponding letter to your PIN.
Obviously the corresponding
letters are generated prior to the web page being served, and the
server-side is aware of the equivalent
value.

So in this case your PIN transposes to "H E O W", you type that in.

The server checks this, and transposes it back to your pin of "0 4 6 7"
and verifies the user.

Now, a keylogger is going to capture "H E O W". Without any additional
smarts and knowing what appeared
on the screen during the session, the keylogger is useless for
determining the PIN. This will stop any
non-targetted keyloggers. It's possible a hacker could write a specific
keylogger to grab the image from
the page and work out what the numbers/alphas are, but it becomes a more
involved process and is specific
to the website it is targetted at. Overall an improvement on most sites.

M.

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Shannon
Johnston
Sent: Friday, December 02, 2005 01:25 AM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] Most common keystroke loggers?

Hi All,
I'm looking for input on what you all believe the most common keystroke
loggers are. I've been challenged to write an authentication method (for
a web site) that can be secure while using a compromised system.

Thanks,
Shannon
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/