Hacking Citibank's Virtual Keyboard

May 12, 2007

A researcher points out that malware can just as easily capture mouse-clicked PINs as those entered at the keyboard.

In some countries outside of the US, Citibank has a login option to enter your PIN by clicking on the display of a keyboard rather than with the physical keyboard.

Perhaps the idea is to defeat keyloggers, but a researcher has demonstrated that it's easy for malware to capture the PIN anyway.

The technique, posted on the popular Bugtraq mailing list, generated some scorn from readers (not an unusual result on Bugtraq). The two main complaints, both true, are that a) the attack presumes that malware has already been installed on the system; and b) this is an old technique - consider this almost identical thread on Bugtraq from 2005.

The technique, which has been used in some malware for years, is to take a screen shot when the mouse is clicked, noting the coordinates of the click. It's true that to execute this attack, the attacker needs to have the program installed on the system already, a formidable barrier to entry, but not when you consider the point of the virtual keyboard: an attacker would only put a user through this if he/she suspected they may already have a keylogger on their system. The feature is designed for already-infected systems.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Voice, image give clues in hunt for Foley's killer

add to favorites email to friend print save as pdf

Related Stories

Recommended for you

Voice, image give clues in hunt for Foley's killer

Aug 21, 2014

Police and intelligence services are using image analysis and voice-recognition software, studying social media postings and seeking human tips as they scramble to identify the militant recorded on a video ...

Smartphone-loss anxiety disorder

Aug 21, 2014

The smart phone has changed our behavior, sometimes for the better as we are now able to connect and engage with many more people than ever before, sometimes for the worse in that we may have become over-reliant on the connectivity ...

Why conspiracy theorists won't give up on MH17 and MH370

Aug 20, 2014

A huge criminal investigation is underway in the Netherlands, following the downing of flight MH17. Ten Dutch prosecutors and 200 policemen are involved in collecting evidence to present at the International Criminal Court in the Hague. The inv ...

Here's how you find out who shot down MH17

Aug 20, 2014

More than a month has passed since Malaysia Airlines flight MH17 crashed with the loss of all 298 lives on board. But despite the disturbances at the crash site near the small town of Grabovo, near Donetsk ...

Assange talks of leaving embassy, sowing confusion

Aug 18, 2014

WikiLeaks founder Julian Assange sowed confusion Monday with an announcement that appeared to indicate he was leaving his embassy bolt hole, but his spokesman later clarified that that would not happen unless ...

User comments : 0