Malware funnels smartcard PINs to remote servers

Powered by SC Magazine
 

USB authentication targeted.

A researcher has developed malware capable of remotely stealing two factor PINs generated by USB smartcards.

The malware was unique in that it used a driver to access the USB port and ship PINs stolen using a keylogger to a remote command and control server.

Author and penetration tester Paul Rascagneres (RootBSD) said the malware would work on most USB smartcards. 

"I did not test the proof of concept on all providers, but as the malware shares the USB device in raw, we do not target any specific smartcard," Rascagneres said.

"Normally it will work on every smartcard or usb device."

The use of a driver to swipe smartcard tokens was unique, Rascagneres said, because existing malware had used the Windows application programming interface to steal PINs.

"The driver is used to make the USB available over IP and to connect to a remote machine," he said.

Attackers could deliver the malware through classic vectors including malicious email attachments or exploit kits.

Users could mitigate the threat and others like it by using a hardware keypad or by monitoring latency.

Rascagneres will present a proof of concept instance of the malware at the Malcon event this month.

Copyright © SC Magazine, Australia


Malware funnels smartcard PINs to remote servers
 
 
 
Top Stories
 
Myer CIO named retailer's new chief executive
Richard Umbers to lead data-driven retail strategy.
 
Empty terminals and mountains of data
Qantas CIO Luc Hennekens says no-one is safe from digital disruption.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  35%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 4146

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  26%
 
I DON'T support shutting the OAIC.
  74%
TOTAL VOTES: 1413

Vote