RE: Defeating Citi-Bank Virtual Keyboard Protection

[Nicob <nicob () nicob net>]

Le vendredi 05 août 2005 à 22:50 +0200, Michal Zalewski a écrit :

> What I proposed (and I'm sure I'm not innovative here) went along the
> lines of hooking up and intercepting the mouse click button, and then,
> at the exact moment of mouse click, capturing the position of the
> mouse pointer, and a bitmap of its nearest surroundings - ideally,
> before the event is delivered to the browser window.

That's exactly what the PoC demonstrated here is doing :
http://nicob.net/SSTIC05/Demo-SSTIC05.avi

And black-hats are already using this kind of tools ...


Nicob

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/