Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
A researcher has developed malware capable of remotely stealing two factor PINs generated by USB smartcards.
The malware was unique in that it used a driver to access the USB port and ship PINs stolen using a keylogger to a remote command and control server.
Author and penetration tester Paul Rascagneres (RootBSD) said the malware would work on most USB smartcards.
"I did not test the proof of concept on all providers, but as the malware shares the USB device in raw, we do not target any specific smartcard," Rascagneres said.
"Normally it will work on every smartcard or usb device."
The use of a driver to swipe smartcard tokens was unique, Rascagneres said, because existing malware had used the Windows application programming interface to steal PINs.
"The driver is used to make the USB available over IP and to connect to a remote machine," he said.
Attackers could deliver the malware through classic vectors including malicious email attachments or exploit kits.
Users could mitigate the threat and others like it by using a hardware keypad or by monitoring latency.
Rascagneres will present a proof of concept instance of the malware at the Malcon event this month.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.