Feeds

Malware made which can share a smartcard over the internet

'Use a bank or ID card as though you had it with you'

SANS - Survey on application security programs

Security researchers have developed proof-of-concept malware that allows attackers to obtain remote access to smart card readers attached to compromised Windows PCs.

The experimental malware developed by Itrust Consulting allows hackers to share a USB-based smart card reader over the internet. As such the attack goes one step further than previous assaults, such as a recent variant of the Sykipot Trojan that hijacked US Department of Defense smart cards in order to access restricted resources. This so-called 'smart card proxy' attack was software specific, targeting PCs attached to smart card readers running ActivClient, the client application of ActivIdentity.

The experimental malware developed by Itrust Consulting ought to work with any type of smart card and USB-based smart card reader, at least in theory, so it promises to be both more flexible and powerful than that abused by the Sykipot Trojan.

The attack is due to be demonstrated by Paul Rascagneres, a security consultant at Luxembourg-based Itrust Consulting, at the MalCon security conference in New Delhi, India, on 24 November. A summary of the upcoming Smartcards Reloaded - Remotely! presentation sets the scene.

We showcase a new kind of malware that uses a self made driver that make USB over TCP/IP. So the malware shares the smartcard connected in USB of the victim directly to the command and control (c&c) server in raw. The attacker can use the smartcard as if it is directly connected to his machine!

Smart cards are normally used in tandem with PIN codes or passwords for two factor authentication (secure login using something you have - the token, and something you know, a PIN). The prototype malware comes bundled with a key-logging component capable of stealing such login credentials, providing they are entered into an infected PC attached to a smart card reader.The credential stealing attack would not work in cases where users enter their PIN into a physical keyboard included with a smart card reader, IDG reports.

Rascagneres and his team tested their malware prototype with smart cards issued by Belgian banks and the electronic identity card (eID) issued in Belgium.

The drivers created by the researchers are not digitally signed, one way that the attack might be detected. However bad guys might be able to get around detection by either using stolen digital certificates or using malware (such as the TDL4 rootkit) capable of disabling the driver-signing policy on 64-bit versions of Windows 7. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.