Earlier this week, an Indian researcher, Yash K.S., documented how easy it was for criminals to capture the authentication used to login to Citibank accounts when they use a virtual keyboard (used in Asia but not yet in the US). Read about the hack here.
This is yet but one more example of the futility in deploying stronger authentication for accessing bank accounts. While some stronger authentication, like one-time passwords, will thwart malware keyboard loggers, they won't stop man in the middle phishing attacks. In the case mentioned above, the virtual keyboard will still be prey to malware attacks. Instead of using a keyboard logger, the malware will simply use screen capture software to obtain the pin.
Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com
del.icio.us