Bugtraq mailing list archives
Re: Defeating Citibank Virtual Keyboard protection using screenshot method
From: Florian Weimer <fw () deneb enyo de>
Date: Thu, 10 May 2007 23:45:58 +0200
* David Gillett:
But your point above: "without installing malware on the victim host" Although true on some level, is bogus for the purpose of this work, as it being written makes an automatic assumption on working only after malware is installed.The principle of "defence in depth" is that each security measure adds to overall security by providing protections that continue to operate even if other defences have been breached.
Isn't it more like combining several things which aren't unconditionally secure by themselves, in the hope that the result is something you can actually live with?
The demonstration that Citibank's "security measure" can be relied upon ONLY in the case where no other breach has allowed malware to be installed on the client machine is thus a proof by example that it does not actually provide such defence in depth, and in fact for far too many end users cannot be safely assumed to provide any security at all.
Hard to tell. What if the measure helps to prevent customer confidence from eroding any further? I fear you need to do something equally visible against the very visible threat of fake web pages. Otherwise, no one will take you seriously, no matter how well your fraud management processes work.
Current thread:
- Defeating Citibank Virtual Keyboard protection using screenshot method yashks (May 09)
- Re: Defeating Citibank Virtual Keyboard protection using screenshot method Reversemode (May 09)
- Re: Defeating Citibank Virtual Keyboard protection using screenshot method Gadi Evron (May 09)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Jim Harrison (May 09)
- Message not available
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Jim Harrison (May 09)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Gadi Evron (May 09)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Jim Harrison (May 09)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Gadi Evron (May 10)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method David Gillett (May 10)
- Re: Defeating Citibank Virtual Keyboard protection using screenshot method Florian Weimer (May 10)
- Re: Defeating Citibank Virtual Keyboard protection using screenshot method Ansgar -59cobalt- Wiechers (May 10)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method James C. Slora Jr. (May 11)
- Message not available
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Debasis Mohanty (May 10)
- <Possible follow-ups>
- Re: Re: Defeating Citibank Virtual Keyboard protection using screenshot method yashks (May 09)
- Re: RE: Defeating Citibank Virtual Keyboard protection using screenshot method balazs . zolika (May 10)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Rogier Mulhuijzen (May 10)
- RE: Defeating Citibank Virtual Keyboard protection using screenshot method Nick FitzGerald (May 11)