WebApp Sec: Re: Re: Defeating Citi-Bank Virtual Keyboard Protection

[mike () securityfocus com, sharecube () securityfocus com, com () securityfocus com]

Hi Bipin,

I saw your .txt file (although I didn't try the .wmv). The simple trick is to hit the SHIFT and type extra characters 
before you DELETE them and then enter the real data.

The trick would only work for extremely simple keyloggers, say those that were created in 1995. But in 2005, keyloggers 
is just another name for spyware that probably watches Windows, IE forms, and is pretty sophisticated about how it 
filters data.

Mike