WebApp Sec mailing list archives
Re: keyloggers?
From: Michael Silk <michaelslists () gmail com>
Date: Wed, 6 Apr 2005 05:45:57 -0700
Even with something like that logging in on a public computer like that is a terrible idea. Not only could you not actually be visiting the site you think you are (due to dns manipulation, or many many other trivial tricks assuming total control of the computer) but 'total control' of your account might not be the worst thing that can happen to you. Even if it is a 'one time password' the the key-logger can't repeat, maybe all they wanted was to track the pages you downloaded and view your balance? This could be _more_ of a problem for some people then having their login stolen. [Because as we know, most systems only allow transfer to known accounts, and other little tricks]. After all (in that scenario), it's a more 'passive' attack then the attacker logging in himself and viewing the information. -- Michael On Apr 6, 2005 5:10 AM, P.B. Wagenaar <PB.Wagenaar () chello nl> wrote:
Hi, You will see that more and more banks will start sending temporary 2nd passwords to mobile devices (like sms on your cellphone). Website will ask your username ans password and send you a string through sms to your mobile device. This string will remain valid for a couple of minutes, and then a new request for a new string is needed. You can implement this technique (which isn't new at all!) in numerous ways. Without something like this banking in an internet café is a bad idea. In fact, you should accept that these 'hacks' happen but that banks choose to keep things quiet and spends more money keeping these things out of the media then the amount in the fraude it self. Philip Wagenaar -----Oorspronkelijk bericht----- Van: Yoanne LE MERCIER [mailto:ylemercier.security () gmail com] Verzonden: woensdag 6 april 2005 7:07 Aan: SB CC: webappsec () securityfocus com Onderwerp: Re: keyloggers? Hi. You've asked for best practice when accessing your online bank from an Internet Cafe ? Here it is: Don't. There's simply no way you can be 150% sure of the integrity of the machine you're on. There are thousands of keyloggers, thousands of rootkits or hide_my_processes_with_this_kernel_patch out there, which make it difficult for an average administrator to ensure his machines are free of any of those materials. This may requires a "quite" (...) deep inspection/audit. You don't have admin rights on Internet Cafe machines (if you do, run away, or have fun) You don't have hours to spend when in an Internet Cafe, auditing machines. So don't access your bank online in such place. Or ... Ask your bank for a one-time password mechanism (per example, a list of predefined and ordered passwords), which would prevent any further access with eventually keylogged informations. On Apr 1, 2005 9:48 PM, SB <vidyabalaji () gmail com> wrote:Hi! Any recommendations of Best Practices when accessing your Online Banking account from an Internet Cafe? Assuming your bank does not provide two factor authentication, are there any specific checks you can do, tools you can run on a machine to ensure it is not Logging keystrokes, caching UID/pwds etc Any suggestions or advice in this area is greatly appreciated Thanks SB-- I am using the free version of SPAMfighter for private users. It has removed 906 spam emails to date. Paying users do not have this message in their emails. Try www.SPAMfighter.com for free now!
Current thread:
- keyloggers? SB (Apr 05)
- Re: keyloggers? Louis Baumann (Apr 06)
- Re: keyloggers? Augusto Paes de Barros (Apr 06)
- Re: keyloggers? Greg Stiavetti (Apr 06)
- Re: keyloggers? Yoanne LE MERCIER (Apr 06)
- RE: keyloggers? P.B. Wagenaar (Apr 06)
- Re: keyloggers? - dont doit Alvin Oga (Apr 06)
- Re: keyloggers? - dont doit Kyle Maxwell (Apr 06)
- Re: keyloggers? - dont doit Antoine Martin (Apr 06)
- Re: keyloggers? Michael Silk (Apr 06)
- Re: keyloggers? Antonio Fontes (Apr 06)
- Re: keyloggers? Michael Silk (Apr 06)
- RE: keyloggers? Mehmet Buyukozer (Apr 06)
- RE: keyloggers? P.B. Wagenaar (Apr 06)
- Re: keyloggers? Louis Baumann (Apr 06)
- Re: keyloggers? Zero Burnout (Apr 06)
- <Possible follow-ups>
- RE: keyloggers? Griffiths, Ian (Apr 06)