RE: Defeating Citibank Virtual Keyboard protection using screenshot method



Seth wrote:
What is included in the "signed" stuff, and when is that
challenge/response done?

The Challenge/Response is done when you log in and for transactions.

If malware is running on the user's computer, can it change the
destination of a funds transfer invisibly to the user, and still have
the verification work?

That is, user enters "Pay 100 to Credit Card". The malware sends the
bank "Pay 100 to Bad Guy". The bank tells the user "Verify transfer
of 100 from your account". Oops.

The account number you're sending to is used in making the challenge. So
if you were to change the account number, the user would surely notice
that suddenly the challenge isn't matching the account number.


Imipak wrote:
Something like this?

http://business.guardian.co.uk/story/0,,2077984,00.html

"Account holders at Barclays, NatWest and Nationwide will be given a
calculator-style gadget which, once they insert their debit card, will
produce a randomly generated number which they will have to key in as
well as their usual passwords and identification numbers."

That sounds like what we (ABNAMRO customers) have. Except that we enter
the challenge on the device as well.

Cheers,

Rogier


This e-mail message and its attachments are subject to the disclaimer published at the following website of Casema: http://www.casema.nl/disclaimer



Relevant Pages

  • Re: Gotcha Capitalism
    ... Gotcha! ... account in my name only in a different financial institution and then ... bank and closed out the account. ... pay cash for everything and payoff my credit card balances at the end ...
    (soc.retirement)
  • Re: PayPal is SCUM
    ... file the dispute and I get my money back immediately. ... primary payment source as your credit card and your problems are ... and feel at liberty to ''lock'' your account at any given time if THEY ... you go to the bank and fill out an unauthorized ACH ...
    (rec.games.pinball)
  • Re: Cyber Crimes?
    ... >>>Given this sobering information about seniors and consumer fraud, ... Bank of the West's real site has a warning about ... >>except they wanted me to create an account before submitting. ... >>your credit card will be locked. ...
    (soc.retirement)
  • Re: Tequipment.net bleh.
    ... for my clock sync guess. ... make the bank charges for this account quite small. ... With the credit card the company deals with ...
    (sci.electronics.design)
  • Re: WTF? (OT) Rant
    ... > - not what our bank calls it, but it works the same: it takes money ... > out of our checking account whether we use it like a credit card ...
    (rec.pets.cats.anecdotes)