Re: The end of Phishing in sight?

[Mark C <securitylists () uniontown com>]

Not sure I follow you... I phish someone to my site and I convince them 
to enter their SecurID PIN/Token on my fake page, where my script 
promptly and almost instantly uses their credentials to log into 
victim's bank on the fly.  Bank sees one entry-- the Phisher's. 

SecurID makes it a little tougher, but certainly nowhere near the point 
of being "Secure" IMO, especially since I have a full 3 minutes to 
complete this sequence. 

I might even be able to make my script forward a second token 
verification request to the victim as I am logging into their bank, and 
have them enter the second sequential token, which I think then buys me 
a much larger window of opportunity (if I correctly understand how these 
tokens resync themselves to the central ACE server.)

If I get time I just might throw together a demo of this since I have a 
SecurID/ACE server in our lab, it would go a long way to show banks how 
this really isn't an answer. 

-Mark Coleman



Henderson, Dennis K. wrote:

> Securid's pins are consumed as they are used, pin sync or login. Log 
> it all you want.... no dice.
>  
>  
>
>     ------------------------------------------------------------------------
>     *From:* funsec-bounces () linuxbox org
>     [mailto:funsec-bounces () linuxbox org] *On Behalf Of *Security Lists
>     *Sent:* Monday, October 17, 2005 3:39 PM
>     *To:* funsec () linuxbox org
>     *Subject:* Re: [funsec] The end of Phishing in sight?
>
>     I believe a SecurID token has a full 3-minute window of
>     opportunity (more if you can get the user to enter two subsequent
>     token #'s I believe, that's what's needed for token resync
>     sequence), Phisher could simply script an instant automated MITM
>     that would log them in on-the-fly, PIN and all.
>
>     -Mark C
>
>
>     Dave Killion wrote:
>
> >     On 10/17/05, *Paul Schmehl* <pauls () utdallas edu
> >     <mailto:pauls () utdallas edu>> wrote:
> >
> >
> >         OK, I'll bite.  Are the banks going to be forced to provide
> >         the readers?
> >         Or is online banking going to become a thing of the past?
> >
> >
> >     ETrade is already providing certain select customers with SecurID
> >     tokens.
> >
> >     -- 
> >     Dave Killion, CISSP
> >     Contributing Author, Configuring NetScreen Firewalls
> >     PGP Key Fingerprint:
> >     E477 488D 4340 D04F DD94 2A65 048C B376 D50B 45C8
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Fun and Misc security discussion for OT posts.
> > https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> > Note: funsec is a public and open mailing list.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.