bugtraq - New Paper: MitM Attacks against the chipTAN comfort Online Banking System

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20091124114909.GA17663@otis.atalante.redteam-pentesting.de>
Date: Tue, 24 Nov 2009 12:49:10 +0100
From: RedTeam Pentesting GmbH <release@...team-pentesting.de>
To: bugtraq@...urityfocus.com
Subject: New Paper: MitM Attacks against the chipTAN comfort Online Banking
	System

Abstract
========
ChipTAN comfort is a new system which is supposed to securely authorise online
banking transactions by means of a trusted device. It is assumed that chipTAN
comfort specifically protects against man-in-the-middle attacks. Such attacks are
currently putting bank customers who are using the iTAN system at risk. RedTeam
Pentesting examined chipTAN comfort and showed that even when using this sys-
tem, man-in-the-middle attacks can compromise online banking security.

The full paper is available in German and English at

http://www.redteam-pentesting.de/publications/MitM-chipTAN-comfort

-- 
RedTeam Pentesting GmbH                    Tel.: +49 241 963-1300
Dennewartstr. 25-27                        Fax : +49 241 963-1304
52068 Aachen                    http://www.redteam-pentesting.de/
Germany                         Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen, Claus R. F. Overbeck

Content of type "application/pgp-signature" skipped