Hey Martin! Yep, in case of such card readers, it's safe and secure...for now, until the bad guys think of something more sophisticated like Simon described earlier this morning. Unfortunatelly in our district we haven't seen anything alike for now - only plain smart-cards, but I hope we'll see this in the near future. :)
What concerns SMS autentification and payment confirms - in our district the system is being still tested on authentification, no payment confirms are available. But you know the story...first cases we'll see in our small Estonia - and our banks will difently start thinking on this. Regards, vik -----Original Message----- From: Martin Salfer [mailto:m...@soif.de] Sent: Friday, December 12, 2008 12:12 PM To: full-disclosure@lists.grok.org.uk Cc: viktor.lario...@salva.ee Subject: Re: [Full-disclosure] 21 Million German bank accounts stolen - but accounts are still more secure than many other ones -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Dear vik, Nice to see that people from all over the world read and answer full-disclosure. :-) Yes, you're right. Those trojans that log and intercept data on the fly are really a pain for most online banking customers. Fortunately some banks are already technically prepared to resist those trojans. Some banks already demand a class 3 smart card reader, which means the reader itself must be equipped with a separate display and keyboard. (costing roughly 100 € in total). Such devices look alike the credit card machines at a checkout. The amount of every single transaction must be displayed and acknowledged on the separate card reader, which has its own OS/firmware. This means, any PC trojan would completely fail intercepting, as any alteration would be visible on the display or would invalidate the RSA signature. A successful trojan would need to breach two security zones: the PC OS plus the super hardened card reader OS. The crucial point is to use separate smart card readers that have an own OS/firmware. (not Windows for sure) Fancy card readers, aren't they? ;-) Best regards, Martin Salfer Viktor Larionov wrote: > Dear Martin of good old Germany, > > You are absolutely correct on the poor security and other things...but you > actually should keep in mind, that US internet banking, as far as I am > concerned by the amount and complexity of operations is way behind Germany > and Europe in general. > In example, US residents, correct me if I'm wrong, it's not every bank in US > where you can make a wire transfer, or apply for a mortrage all online. > > That's one side of the coin - another side of it, is banking trojans - as > like Torpig, Apophis - keeping theese trojans techniques in mind, there's > actually no smart card, one-time password, RSA to help you. > > And if you have a list of Deutsche bank clients, modifying Torpig a bit for > Deutsche bank and blasting this thing out to the clients is good start > point - at least from my point of view. > > And I'm not even talking about personal privacy and etc. aspects. > There's surely more than one way to use this data. > > Kindest regards, > vik > from poor young Estonia :) > > P.S. > > By baking trojans, I meant trojans injecting additional payment information > into your bank transfers - e.g. you make 5 payments, but the trojan makes > also the sixth one, still browser with the help of a trojan displays you > only 5 of them. > You press accept - and you'r done. Correct me if I'm wrong, but I somehow > remember that Torpig was one of the bad things doing such tricks - as I > already said, forget about RSA or one-time passwords in theese cases :))) > > Still there are very successfull strategies used by banks to fight this - > mostly based on social analysis of your behavement, but that's another > story. -----BEGIN PGP SIGNATURE----- iD8DBQFJQjkCy4+E3T5McJsRA31AAJ9qb9SxszRcNK1igUP++D9eJub9+wCfR4WS AUgbWdcxZncL+RtEnT3H36Y= =4s/o -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
