Electronic Banking and Virtual Keyboards

Dominic White

 
Random Entry: Crazy Mozilla and Firefox spoof
< Ubuntu Shirt: Week One | When you strike a women you strike a rock. >

Electronic Banking and Virtual Keyboards

Many online banking websites make use of a virtual, dynamic keypad to try and thwarte keyloggers. They are a silly idea and easily defeated. This, is one of the many methods and was just posted to Packet Storm Security. My bank uses it and I wish they wouldn't.

Monday, August 8. 2005
Posted by Dominic White in Security
Comments (4) | Trackbacks (0)

Last modified on 2005-08-08 14:26
 

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

#1 Aubrey Kilian wrote (Link) (Reply)
Posted on Monday, August 8. 2005
I also use StandardBank, and I never use that stupid popup keyboard thing. A better security measure is to ensure good OS security in my opinion. If you keep your OS's house clean, you can type your password into your internet banking site safely. My Windows machine is never directly accesible from the outside (I have a Netgear ADSL modem), and I don't use Internet Explorer to browse dubious sites. ZoneAlarm firewall, Ad-Aware anti spy/adware, and I feel comfortable that my machine is 'protected'. That said, I do my internet banking from work using Firefox running on Ubuntu. Even better. :-)
 
#1.1 Dominic White wrote (Link) (Reply)
Posted on Monday, August 8. 2005
That is a necessary defense, but it is imperfect and not enough. It does not defend against mitm attacks, hardware keyloggers or a very sneaky software keylogger. (Where keylogger can include the virtual keyboard logging functionality). Their virtual keyboard is an attempt to defend against simple keyloggers. I like the idea of one-time passwords. It limits the window in which an attacker can use a password if it is disclosed. FNB has those cute little tokens. However, even those aren't prefect, particularly against mitm attacks, but are much better.
 
#1.1.1 Shiu (Reply)
Posted on Thursday, September 8. 2005
what is the technique to recognise inputs/numeric on virtual keypad, ie i am interested in "numeric recognition", "replay attack". thank heaps
 
#2 Shaun (Reply)
Posted on Monday, August 8. 2005
One of the banks I use (in Switzerland) couriered me a booklet of lengthy one time keys that I must use in a set order. I cannot see why more banks shouldn't make use of this feature - of course the booklet becomes a security risk, but hey, that's what a safe is for.
 

Add Comment

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA