bugtraq - RE: Defeating Citibank Virtual Keyboard protection using screenshot method

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 9 May 2007 14:19:47 -0700
From: "Jim Harrison" <Jim@...tools.org>
To: "Gadi Evron" <ge@...uxbox.org>
Cc: "Int3" <yashks@...il.com>, <bugtraq@...urityfocus.com>
Subject: RE: Defeating Citibank Virtual Keyboard protection using screenshot method

Without getting into SMTP latency comparisons...

Perhaps I missed something, but where is the threat demonstrated sans
code installation?
I'm not trying to disparage anyone's work, but as you yourself pointed
out, there is nothing demonstrated here that doesn't qualify as common
malware.

-----Original Message-----
From: Gadi Evron [mailto:ge@...uxbox.org] 
Sent: Wednesday, May 09, 2007 1:42 PM
To: Jim Harrison
Cc: Int3; bugtraq@...urityfocus.com
Subject: RE: Defeating Citibank Virtual Keyboard protection using
screenshot method

On Wed, 9 May 2007, Jim Harrison wrote:
> Granted, it's an interesting methodology, but until you can
demonstrate
> circumvention of the CitiBank keylogger without installing code on the
> victim host, a threat is not indicated and cannot be taken seriously.

Even though I was the first to point out this is old news for the
malware
scene in online/e fraud, I'd be the first to bow down before Int3 and
say
"thank you for sharing your work with us". Many don't.

But your point above:
"without installing malware on the victim host"

Although true on some level, is bogus for the purpose of this work, as
it
being written makes an automatic assumtion on working only after malware
is installed.

Although you are right, in practice this is already an heavily abused
technology, and.. 
'Getting malware on a system', who ever heard of such a ridiculous
idea? :)

	Gadi.

> 
> -----Original Message-----
> From: Int3 [mailto:yashks@...il.com] 
> Sent: Wednesday, May 09, 2007 11:14 AM
> To: Jim Harrison
> Cc: bugtraq@...urityfocus.com
> Subject: Re: Defeating Citibank Virtual Keyboard protection using
> screenshot method
> 
>  
> This is not malware, it will only help people to experiment and see
the
> result without writing one for themself. 
>  
> Regards,
> Yash K.S
>  
> On 5/9/07, Jim Harrison <Jim@...tools.org> wrote: 
> 
> 	(copied here without permission)
> 	Step by Step Demo:
> 	
> 	- Download POC from http://tracingbug.com/downloads/citihook.zip
> <http://tracingbug.com/downloads/citihook.zip>  and
> 	unzip to some directory
> 	- Launch citihook.exe, this will watch only
> 	https://www.online.citibank.co.in/ URL
> 	
> 	Effectively, "Let me install my malware on your machine to
> demonstrate
> 	how vulnerable it is."
> 	
> 	P-p-p-p-p-p-leeeze (three anti-social points for that quote)!
> 	The "problem" ceases to be a vulnerability at this point. 
> 	
> 	-----Original Message-----
> 	From: yashks@...il.com [mailto:yashks@...il.com]
> 	Sent: Monday, May 07, 2007 3:03 AM
> 	To: bugtraq@...urityfocus.com <mailto:bugtraq@...urityfocus.com>
> 
> 	Subject: Defeating Citibank Virtual Keyboard protection using
> screenshot
> 	method
> 	
> 	Severity: Critical
> 	
> 	Platforms Affected:
> 	
> 	Microsoft Corporation: Windows 98 Any version 
> 	Microsoft Corporation: Windows Me Any version
> 	Microsoft Corporation: Windows XP Any version
> 	Microsoft Corporation: Windows 2000 Any version
> 	Microsoft Corporation: Windows 2003 Any version
> 	Microsoft Corporation: Windows NT 4.0 Any version
> 	Citi-Bank: Citi-Bank Virtual Keyboard Any version
> 	
> 	Browsers:
> 	Microsoft Internet Explorer Any version
> 	Mozilla FireFox Any version
> 	Any browser runs on Win32 platform ( With slight modification ) 
> 	
> 	Original URL :
> http://www.tracingbug.com/index.php/articles/view/23.html
> 	
> 	Regards,
> 	Yash K.S <yashks@...il.com > | www.tracingbug.com
> 	
> 	All mail to and from this domain is GFI-scanned.
> 	
> 	
> 
> 
> 
> All mail to and from this domain is GFI-scanned.
> 


All mail to and from this domain is GFI-scanned.