Hacking Citibank's Virtual Keyboard

May 12, 2007

A researcher points out that malware can just as easily capture mouse-clicked PINs as those entered at the keyboard.

In some countries outside of the US, Citibank has a login option to enter your PIN by clicking on the display of a keyboard rather than with the physical keyboard.

Perhaps the idea is to defeat keyloggers, but a researcher has demonstrated that it's easy for malware to capture the PIN anyway.

The technique, posted on the popular Bugtraq mailing list, generated some scorn from readers (not an unusual result on Bugtraq). The two main complaints, both true, are that a) the attack presumes that malware has already been installed on the system; and b) this is an old technique - consider this almost identical thread on Bugtraq from 2005.

The technique, which has been used in some malware for years, is to take a screen shot when the mouse is clicked, noting the coordinates of the click. It's true that to execute this attack, the attacker needs to have the program installed on the system already, a formidable barrier to entry, but not when you consider the point of the virtual keyboard: an attacker would only put a user through this if he/she suspected they may already have a keylogger on their system. The feature is designed for already-infected systems.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Report: FBI's anthrax investigation was flawed

add to favorites email to friend print save as pdf

Related Stories

Recommended for you

Report: FBI's anthrax investigation was flawed

11 hours ago

The FBI used flawed scientific methods to investigate the 2001 anthrax attacks that killed five people and sickened 17 others, federal auditors said Friday in a report sure to fuel skepticism over the FBI's ...

Study reveals mature motorists worse at texting and driving

Dec 18, 2014

A Wayne State University interdisciplinary research team in the Eugene Applebaum College of Pharmacy and Health Sciences has made a surprising discovery: older, more mature motorists—who typically are better drivers in ...

Napster co-founder to invest in allergy research

Dec 17, 2014

(AP)—Napster co-founder Sean Parker missed most of his final year in high school and has ended up in the emergency room countless times because of his deadly allergy to nuts, shellfish and other foods.

LA mayor plans 7,000 police body cameras in 2015

Dec 16, 2014

Mayor Eric Garcetti announced a plan Tuesday to equip 7,000 Los Angeles police officers with on-body cameras by next summer, making LA's police department the nation's largest law enforcement agency to move ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.