bugtraq - RE: Defeating Citibank Virtual Keyboard protection using screenshot method

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 16 May 2007 10:49:50 +0200
From: "Rogier Mulhuijzen" <rogier.mulhuijzen@...ice.casema.nl>
To: "Seth" <sethb@...ix.com>, <bugtraq@...urityfocus.com>
Cc: <imipak@...il.com>
Subject: RE: Defeating Citibank Virtual Keyboard protection using screenshot method

Seth wrote:
> What is included in the "signed" stuff, and when is that
> challenge/response done?

The Challenge/Response is done when you log in and for transactions.

> If malware is running on the user's computer, can it change the
> destination of a funds transfer invisibly to the user, and still have
> the verification work?
> 
> That is, user enters "Pay 100 to Credit Card".  The malware sends the
> bank "Pay 100 to Bad Guy".  The bank tells the user "Verify transfer
> of 100 from your account".  Oops.

The account number you're sending to is used in making the challenge. So
if you were to change the account number, the user would surely notice
that suddenly the challenge isn't matching the account number.


Imipak wrote:
> Something like this?
> 
>     http://business.guardian.co.uk/story/0,,2077984,00.html

"Account holders at Barclays, NatWest and Nationwide will be given a
calculator-style gadget which, once they insert their debit card, will
produce a randomly generated number which they will have to key in as
well as their usual passwords and identification numbers."

That sounds like what we (ABNAMRO customers) have. Except that we enter
the challenge on the device as well.

Cheers,

	Rogier


This e-mail message and its attachments are subject to the disclaimer published at the following website of Casema: http://www.casema.nl/disclaimer