Re: keyloggers?

[Michael Silk <michaelslists () gmail com>]

Even with something like that logging in on a public computer like
that is a terrible idea.

Not only could you not actually be visiting the site you think you are
(due to dns manipulation, or many many other trivial tricks assuming
total control of the computer) but 'total control' of your account
might not be the worst thing that can happen to you.

Even if it is a 'one time password' the the key-logger can't repeat,
maybe all they wanted was to track the pages you downloaded and view
your balance? This could be _more_ of a problem for some people then
having their login stolen. [Because as we know, most systems only
allow transfer to known accounts, and other little tricks]. After all
(in that scenario), it's a more 'passive' attack then the attacker
logging in himself and viewing the information.

-- Michael

On Apr 6, 2005 5:10 AM, P.B. Wagenaar <PB.Wagenaar () chello nl> wrote:
> Hi,
>
> You will see that more and more banks will start sending temporary 2nd
> passwords to mobile devices (like sms on your cellphone). Website will ask
> your username ans password and send you a string through sms to your mobile
> device. This string will remain valid for a couple of minutes, and then a
> new request for a new string is needed. You can implement this technique
> (which isn't new at all!) in numerous ways.
>
> Without something like this banking in an internet café is a bad idea. In
> fact, you should accept that these 'hacks' happen but that banks choose to
> keep things quiet and spends more money keeping these things out of the
> media then the amount in the fraude it self.
>
> Philip Wagenaar
>
> -----Oorspronkelijk bericht-----
> Van: Yoanne LE MERCIER [mailto:ylemercier.security () gmail com]
> Verzonden: woensdag 6 april 2005 7:07
> Aan: SB
> CC: webappsec () securityfocus com
> Onderwerp: Re: keyloggers?
>
> Hi.
>
> You've asked for best practice when accessing your online bank from an
> Internet Cafe ? Here it is:
> Don't.
>
> There's simply no way you can be 150% sure of the integrity of the machine
> you're on.
> There are thousands of keyloggers, thousands of rootkits or
> hide_my_processes_with_this_kernel_patch out there, which make it difficult
> for an average administrator to ensure his machines are free of any of those
> materials. This may requires a "quite" (...) deep inspection/audit.
>
> You don't have admin rights on Internet Cafe machines (if you do, run away,
> or have fun) You don't have hours to spend when in an Internet Cafe,
> auditing machines.
>
> So don't access your bank online in such place. Or ... Ask your bank for a
> one-time password mechanism (per example, a list of predefined and ordered
> passwords), which would prevent any further access with eventually keylogged
> informations.
>
> On Apr 1, 2005 9:48 PM, SB <vidyabalaji () gmail com> wrote:
> > Hi!
> >
> > Any recommendations of Best Practices when accessing your Online
> > Banking account from an Internet Cafe?  Assuming your bank does not
> > provide two factor authentication, are there any specific checks you
> > can do, tools you can run on a  machine to ensure it is not Logging
> > keystrokes, caching UID/pwds etc
> >
> > Any suggestions or advice in this area is greatly appreciated
> >
> > Thanks
> >
> > SB
>
> --
> I am using the free version of SPAMfighter for private users.
> It has removed 906 spam emails to date.
> Paying users do not have this message in their emails.
> Try www.SPAMfighter.com for free now!