full-disclosure - Most common keystroke loggers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat Dec  3 00:15:50 2005
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Most common keystroke loggers?

Lionel Ferette wrote:

> > Using crypto all the way from the web server to a smart-card (so all the
> > compromised system can see is encrypted data it can't get the key for) can
> > help yere. 
> Even then, you would need a card reader with integrated pinpad. Otherwise, the 
> keylogger can still sniff the PIN code entry - and then generate any 
> signature it wants by accessing the PC/SC layer directly (been there, done 
> that).

I'm not entirely convinced of that.  _Some part_ of displaying the 
transactions and accepting/rejecting the transactions has to occur 
"securely" (off the compromised machine), but I don't think it 
necessarily has to be the stage you suggest...

Regards,

Nick FitzGerald