RE: Defeating Citibank Virtual Keyboard protection using screenshot method
- From: "Rogier Mulhuijzen" <rogier.mulhuijzen@xxxxxxxxxxxxxxxx>
- Date: Wed, 16 May 2007 10:49:50 +0200
What is included in the "signed" stuff, and when is that
The Challenge/Response is done when you log in and for transactions.
If malware is running on the user's computer, can it change the
destination of a funds transfer invisibly to the user, and still have
the verification work?
That is, user enters "Pay 100 to Credit Card". The malware sends the
bank "Pay 100 to Bad Guy". The bank tells the user "Verify transfer
of 100 from your account". Oops.
The account number you're sending to is used in making the challenge. So
if you were to change the account number, the user would surely notice
that suddenly the challenge isn't matching the account number.
Something like this?
"Account holders at Barclays, NatWest and Nationwide will be given a
calculator-style gadget which, once they insert their debit card, will
produce a randomly generated number which they will have to key in as
well as their usual passwords and identification numbers."
That sounds like what we (ABNAMRO customers) have. Except that we enter
the challenge on the device as well.
This e-mail message and its attachments are subject to the disclaimer published at the following website of Casema: http://www.casema.nl/disclaimer
- Prev by Date: vbulletin < 3.6.6 [permanent xss]
- Next by Date: RE: Apple Safari on MacOSX may reveal user's saved passwords
- Previous by thread: Re: Defeating Citibank Virtual Keyboard protection using screenshot method
- Next by thread: Re: Defeating Citibank Virtual Keyboard protection using screenshot method