Modern banker malware undermines two-factor authentication

TalkBack 1 of 15:

Next »

• Thread View
• Flat View

Ok, ill buy that..

Yes Two-factor authentication doesnt help avoid the already infected. Now what the bank SHOULD have one (other than the user having a fully patched system and AV if hes on Windows) is when the website detected that there was activity from another IP address - represented another verification system, much like this is your "login key" [a picture that you selected] along with a challenge question/answer set by the person. Or am I missing something and the fruadulant transaction was done from the same IP address?

The system should ALWAYS be challenging you and verifing your credentials. Also the preferences to access and change the security question, 'login key', phone number, etc should be protected by another OTP check and/or PIN - that differs from the initial logon check. Maybe we should have these sites start making an encrypted link from they KEYBOARD to the browser window? That could help too... Just my thoughts..

Posted by: JT82   Posted on: 09/23/09  (Edited: 09/23/2009 @ 09:15) You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Implementing Software RAID on Dell PowerEdge Servers Dell Software RAID is an inexpensive storage method offering fault tolerance ... Download Now
• July 14th: The Virtual Presenter's Series: Start Right! Design Right! Present Right! Citrix Online Presenting online is a completely different ballgame from presenting in ... Download Now
• MICROSOFT SHAREPOINT: NEW USE, SECURITY RISKS AND BEST PRACTICES Trend Micro Web 2.0 technologies are transforming business and many believe that ... Download Now