RE: Defeating Citibank Virtual Keyboard protection using screenshot method

["Rogier Mulhuijzen" <rogier.mulhuijzen () office casema nl>]

Seth wrote:
> What is included in the "signed" stuff, and when is that
> challenge/response done?

The Challenge/Response is done when you log in and for transactions.

> If malware is running on the user's computer, can it change the
> destination of a funds transfer invisibly to the user, and still have
> the verification work?
>
> That is, user enters "Pay 100 to Credit Card".  The malware sends the
> bank "Pay 100 to Bad Guy".  The bank tells the user "Verify transfer
> of 100 from your account".  Oops.

The account number you're sending to is used in making the challenge. So
if you were to change the account number, the user would surely notice
that suddenly the challenge isn't matching the account number.


Imipak wrote:
> Something like this?
>
>     http://business.guardian.co.uk/story/0,,2077984,00.html

"Account holders at Barclays, NatWest and Nationwide will be given a
calculator-style gadget which, once they insert their debit card, will
produce a randomly generated number which they will have to key in as
well as their usual passwords and identification numbers."

That sounds like what we (ABNAMRO customers) have. Except that we enter
the challenge on the device as well.

Cheers,

        Rogier


This e-mail message and its attachments are subject to the disclaimer published at the following website of Casema: 
http://www.casema.nl/disclaimer