bugtraq - RE: Defeating Citibank Virtual Keyboard protection using screenshot method

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0705120133150.5790@faramir.hugo.vanderkooij.org>
Date: Sat, 12 May 2007 01:46:20 +0200 (CEST)
From: Hugo van der Kooij <hvdkooij@...derkooij.org>
To: Bugtraq mailinglist <bugtraq@...urityfocus.com>
Subject: RE: Defeating Citibank Virtual Keyboard protection using screenshot
 method

>> Sure, they're a lot more expensive and a lot more "high-tech" but
>> unless they are doing end-to-end client and server authentication and
>> strong crypto _AND_ have their own input and output devices that cannot
>> be interfaced from the host OS _AND_ are required for verifying
>> (virtually) every step of every transaction (in other words -- if you
>> have any of the real-world implementations of banking OTP cards used
>> anywhere in the world, the answer is "no"), they are effectively no
>> better than the Citi OSK's as they are trivially MiTM'ed via on-client
>> malware.

In fact the system used by the major Dutch banks is audited rather 
extensively. The OTP system is based on an external smartcard reader and a 
smartcard application on the bank card. They have no physical connection 
so the web interfcae will present you with a challenge and you must use 
that challeng, your card and your pin to generate the proper response. 
Then you have to type in this response.

It is a combination of:
  - What you have (the card with the smartcard application)
  - What you get (the challenge from the server)
  - What you know (your pincode)

To the best of my knowldge the transaction value is also part of the 
calculations. So you can not fix the actual amount and let the other 
parts just pass by.

I would welcome you to explain us how one can do a MITM attack on that. It 
is many times harder to break into this sort of system then many of the 
soft targets relying on fixed username+password prompts.

Dutch law requires extensive external audits on these systems.

Hugo.

-- 
 	hvdkooij@...derkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)