Re: keyloggers? - dont doit

[James.Barkley () noaa gov]

The two major attacks you have to look at:

1.  Spyware/keylogger - very real threat
  If your provider offers secure auth mechanism such as OTP (one-time 
password) this is no threat.  Dual authentication means nothing if you 
have a keystroke logger.  Also, if OTP is used, you have to be sure 
that your provider codes against race conditions (e.g. I keylog 95% of 
your OTP and brute force the other 5%).  

2.  Man-in-the-middle attack - less real but real threat (IMHO)
  First, you can verify with an individual provider (cybercafe, etc.) 
if they provide their own DNS and what they do to protect against 
spoofing.  Second, if you cannot verify this, then you are susceptible 
to Man-in-the-middle-attack (I establish ssl and joe-hacker intercepts, 
establishes ssl with me and also establishes ssl with end host, then 
translates from me to end host).  Someone has to be dedicated to 
perform this, but in public spaces it is more right than wrong to 
expect a dedicated hacker.  If someone performs man-in-the-middle I 
don't know what you can do.

my 2 cents

-Jim

----- Original Message -----
From: "lyal.collins" <lyal.collins () key2it com au>
Date: Wednesday, April 6, 2005 11:37 pm
Subject: Re: keyloggers? - dont doit

> SSL falls to spoofed certs/trust lists and or DNS poisoning to 
> create MITM
> attacks.
> Cybercafes can run their own DNS and routing mechanisms, enabling 
> the latter.
> They run and manage their own browsers and trusted cert lists, 
> enabing a fake
> 'root CA" cert to be laoded into browsers, enabing the former.
>
> SSL is a dead duck in every environment unless DNS is known to be 100%
> accurate, and no ARP sppofing  tricks are happening.
>
> yal
>
>
> > On Apr 6, 2005 7:23 AM, Alvin Oga
> > <alvin.sec () virtual linux-consulting com> wrote:
> > >         - anything sent over the internet is sniffable from
> > >         anywhere in the world
> >
> > Delurking just to mention that this isn't correct. Online 
> banking (and
> > other security-sensitive activities) aren't a good idea from shared
> > sites like a cybercafe for all the reasons others have 
> mentioned, but
> > this isn't it. From my desktop here, I almost certainly have no 
> way of
> > sniffing your traffic to your bank, unless I happen to be somewhere
> > along your path.
> >
> > I'd also like to know about SSL being broken. I think you mean 
> one of
> > the common ciphers is broken, which would be substantial news 
> indeed.> 
> > Your conclusion is right but your reasoning is completely wrong 
> AFAICT.> 
> > -- 
> > Kyle Maxwell
> > [krmaxwell () gmail com]
>
>
>
> --