Malware funnels smartcard PINs to remote servers

Powered by SC Magazine
 

USB authentication targeted.

A researcher has developed malware capable of remotely stealing two factor PINs generated by USB smartcards.

The malware was unique in that it used a driver to access the USB port and ship PINs stolen using a keylogger to a remote command and control server.

Author and penetration tester Paul Rascagneres (RootBSD) said the malware would work on most USB smartcards. 

"I did not test the proof of concept on all providers, but as the malware shares the USB device in raw, we do not target any specific smartcard," Rascagneres said.

"Normally it will work on every smartcard or usb device."

The use of a driver to swipe smartcard tokens was unique, Rascagneres said, because existing malware had used the Windows application programming interface to steal PINs.

"The driver is used to make the USB available over IP and to connect to a remote machine," he said.

Attackers could deliver the malware through classic vectors including malicious email attachments or exploit kits.

Users could mitigate the threat and others like it by using a hardware keypad or by monitoring latency.

Rascagneres will present a proof of concept instance of the malware at the Malcon event this month.

Copyright © SC Magazine, Australia


Malware funnels smartcard PINs to remote servers
 
 
 
Top Stories
Tech SWAT teams kicking down the digital door
From dam engineers in Ecuador to Sydney light-rail gurus, Cardno's global CIO Karen Wagner is linking up her widespread organisation.
 
Brandis hits telcos with new security reforms
Civil penalties for those who don't comply.
 
When does an insurance company turn into a software vendor?
The lines are blurring for ASX-listed Cover-More Group.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Is site blocking effective in stopping piracy?


   |   View results
Yes
  2%
 
No
  86%
 
Somewhat
  12%
TOTAL VOTES: 509

Vote