Malware funnels smartcard PINs to remote servers

Powered by SC Magazine
 

USB authentication targeted.

A researcher has developed malware capable of remotely stealing two factor PINs generated by USB smartcards.

The malware was unique in that it used a driver to access the USB port and ship PINs stolen using a keylogger to a remote command and control server.

Author and penetration tester Paul Rascagneres (RootBSD) said the malware would work on most USB smartcards. 

"I did not test the proof of concept on all providers, but as the malware shares the USB device in raw, we do not target any specific smartcard," Rascagneres said.

"Normally it will work on every smartcard or usb device."

The use of a driver to swipe smartcard tokens was unique, Rascagneres said, because existing malware had used the Windows application programming interface to steal PINs.

"The driver is used to make the USB available over IP and to connect to a remote machine," he said.

Attackers could deliver the malware through classic vectors including malicious email attachments or exploit kits.

Users could mitigate the threat and others like it by using a hardware keypad or by monitoring latency.

Rascagneres will present a proof of concept instance of the malware at the Malcon event this month.

Copyright © SC Magazine, Australia


Malware funnels smartcard PINs to remote servers
 
 
 
Top Stories
How hard do you hack back?
[Blog post] Taking the offensive could have unintended consequences.
 
Five zero-cost ways to improve MySQL performance
How to easily boost MySQL throughput by up to 5x.
 
The big winners from Defence’s back-office IT refresh
Updated: The full list of subcontractors.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  68%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1009

Vote