WebApp Sec mailing list archives
RE: keyloggers?
From: "P.B. Wagenaar" <PB.Wagenaar () chello nl>
Date: Wed, 06 Apr 2005 14:10:23 +0200
Hi, You will see that more and more banks will start sending temporary 2nd passwords to mobile devices (like sms on your cellphone). Website will ask your username ans password and send you a string through sms to your mobile device. This string will remain valid for a couple of minutes, and then a new request for a new string is needed. You can implement this technique (which isn't new at all!) in numerous ways. Without something like this banking in an internet café is a bad idea. In fact, you should accept that these 'hacks' happen but that banks choose to keep things quiet and spends more money keeping these things out of the media then the amount in the fraude it self. Philip Wagenaar -----Oorspronkelijk bericht----- Van: Yoanne LE MERCIER [mailto:ylemercier.security () gmail com] Verzonden: woensdag 6 april 2005 7:07 Aan: SB CC: webappsec () securityfocus com Onderwerp: Re: keyloggers? Hi. You've asked for best practice when accessing your online bank from an Internet Cafe ? Here it is: Don't. There's simply no way you can be 150% sure of the integrity of the machine you're on. There are thousands of keyloggers, thousands of rootkits or hide_my_processes_with_this_kernel_patch out there, which make it difficult for an average administrator to ensure his machines are free of any of those materials. This may requires a "quite" (...) deep inspection/audit. You don't have admin rights on Internet Cafe machines (if you do, run away, or have fun) You don't have hours to spend when in an Internet Cafe, auditing machines. So don't access your bank online in such place. Or ... Ask your bank for a one-time password mechanism (per example, a list of predefined and ordered passwords), which would prevent any further access with eventually keylogged informations. On Apr 1, 2005 9:48 PM, SB <vidyabalaji () gmail com> wrote:
Hi! Any recommendations of Best Practices when accessing your Online Banking account from an Internet Cafe? Assuming your bank does not provide two factor authentication, are there any specific checks you can do, tools you can run on a machine to ensure it is not Logging keystrokes, caching UID/pwds etc Any suggestions or advice in this area is greatly appreciated Thanks SB
-- I am using the free version of SPAMfighter for private users. It has removed 906 spam emails to date. Paying users do not have this message in their emails. Try www.SPAMfighter.com for free now!
Current thread:
- keyloggers? SB (Apr 05)
- Re: keyloggers? Louis Baumann (Apr 06)
- Re: keyloggers? Augusto Paes de Barros (Apr 06)
- Re: keyloggers? Greg Stiavetti (Apr 06)
- Re: keyloggers? Yoanne LE MERCIER (Apr 06)
- RE: keyloggers? P.B. Wagenaar (Apr 06)
- Re: keyloggers? - dont doit Alvin Oga (Apr 06)
- Re: keyloggers? - dont doit Kyle Maxwell (Apr 06)
- Re: keyloggers? - dont doit Antoine Martin (Apr 06)
- Re: keyloggers? Michael Silk (Apr 06)
- Re: keyloggers? Antonio Fontes (Apr 06)
- Re: keyloggers? Michael Silk (Apr 06)
- RE: keyloggers? Mehmet Buyukozer (Apr 06)
- RE: keyloggers? P.B. Wagenaar (Apr 06)
- Re: keyloggers? Louis Baumann (Apr 06)
- Re: keyloggers? Zero Burnout (Apr 06)