full-disclosure - Re: FW: 21 Million German bank accounts stolen - but accounts are still more secure than many other ones

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 12 Dec 2008 10:35:56 +0100
From: Simon Richter <Simon.Richter@...yros.de>
To: Viktor Larionov <viktor.larionov@...va.ee>
Cc: full-disclosure@...ts.grok.org.uk, mars@...f.de
Subject: Re: FW: 21 Million German bank accounts stolen
	-	but accounts are still more secure than many other ones

Hi,

On Thu, Dec 11, 2008 at 03:45:26PM +0200, Viktor Larionov wrote:

> By baking trojans, I meant trojans injecting additional payment information
> into your bank transfers - e.g. you make 5 payments, but the trojan makes
> also the sixth one, still browser with the help of a trojan displays you
> only 5 of them.

That wouldn't work, since the additional transaction would require a
one-time password as well. Replacing a transaction works if you have
control over the browser, but many banks have reacted already and offer to
send the password via SMS along with a copy of the transaction data so you
have a second channel.

During the next year, I expect a trojan that infects phones and looks for
messages with account data and passwords, then forwards them over the
internet (hooray for always-on UMTS) so they can be matched to hijacked
browsers.

What I'd like to see in the next two years (but I'm not holding my breath)
would be a (standardized?) "security module" in mobile phones that is
independent from the rest of the system and can take over display and
keypad, indicated via a dedicated LED; this way, the message containing the
password could be encrypted without a trojan ever having a chance to access
it.

> Still there are very successfull strategies used by banks to fight this -
> mostly based on social analysis of your behavement, but that's another
> story.

Yes, I was without access to my bank account for a whole week because it
doesn't fit my usual behaviour pattern to rent a room in a shady district
of Madrid. :-/

   Simon

Download attachment "signature.asc" of type "application/pgp-signature" (316 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/