From: Javier Fernandez-Sanguino (jfernandezgerminus.com)
Date: Tue Nov 22 2005 - 08:23:20 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Kurt Seifried wrote:

>> a) have two factor transaction signing (SMS or token based) to
>> prevent unauthorized transfers via phishing
>
>
> This doesn't prevent phishing per se. I can setup a phishing site that
> acts as a man in the middle proxy to the bank's site. You log into my
> site, I log into the bank's site, get a challenge, send the number to
> you the victim, you reply and I forward it to the bank, voila.

It doesn't prevent phishing, but it raises the bar quite a bit. Notice
that a MITM for a bank needs to be crafted _for_that_bank in
particular, compare that against the current status in which most
phishing attacks are just based off the same template, with the same
tools, that do not have to know of the bank's application logic but
just mirror its aspect.

Granted, once you have C/R systems everywhere attackers will focus on
it and, "attacks always get easier, they never get worse" (Scheneier
dixit). That means that you will eventually have phishing toolkits
too. In the meantime, however, attackers will still go for easier
targets (banks with passwords that can be stored either through fake
sites or trojans). So banks can expect fraud to go down a bit.

Just my 2c

Javier

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]