FW: Beating 2 factor authentication systems

["Richard M. Smith" <rms () computerbytesman com>]

FYI, Attached are my follow-up comments to this AP story that came out today
about the Feds requiring banks to implement 2-factor authentication systems
for online bank accounts.

-----Original Message-----
From: Richard M. Smith [mailto:rms () computerbytesman com] 
Sent: Monday, October 17, 2005 4:33 PM
To: BBERGSTEIN () ap org; 'Richard M. Smith'
Subject: Re: Feds Want Banks to Strengthen Web Log-Ons 

Hi Brian,

   >>> but also with something they physically have, 
   >>> like a hardware token with numeric access codes 
   >>> that change every minute

I think that phishing scams can still beat a hardware token which visually
provides access codes.  A phisher simply needs to ask for an access code on
their fake login forms and then use the stolen login information right away.

A USB token is probably a better choice against phishing scams, but needs
better software support from Microsoft in Internet Explorer to be
user-friendly. 

However, I believe that any two-factor authentication scheme would still be
beatable by spyware running on a victim's computer.  A spyware program could
lurk in the background waiting for a victim to successfully logon to their
bank account. Once logged in, the spyware would inject JavaScript code in a
browser window which would write a check and mail it to the bad guys.
Another option would be to change all billing addresses to go to the bad
guys.

Richard M. Smith
http://www.ComputerBytesMan.com
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.