Citadel Attack Targets Password Managers

[Mousey]

From Dark Reading - Don't know if you can access without account...

You do not have permission to view link Log in or register now.

...The new Citadel configuration is the first known malware program that appears to have been explicitly designed to steal master passwords from password managers. Dana Tamir, director of enterprise security at IBM Trusteer, told Dark Reading that it contains instructions for logging users' keystrokes when certain processes are triggered on an infected computer.

...

 

[vinylweatherman]

The malware does not appear to infect sheets of A4, so I'm probably OK

Maybe the old way is best, as ANYTHING that is stored on a device connected to the internet could become a target for a malware attack.

The best idea might be a "dumb" device that has password protection, but that cannot connect to any other device, not even by a cable. Even offline storage like a USB stick can be attacked in the time it takes to connect it to a PC in order to look up one of the passwords.

The security industry has created this problem because there are hundreds of sites and services that have "secure login", but there is no overall standard, and each one thinks that they are the only service a user has, thus it should not be a problem remembering all the secure details rather than storing them in a retrieval system.

They should all look at moving to biometric security, so that the user doesn't have to remember anything, their passwords are encoded in their DNA, and "retrieved" through scanning various body parts such as the Iris or fingerprint. More than one method should be used, along with one other offline system such as a key generator that supplies a one off login PIN for each access.

If the user doesn't have to remember hundreds of different passwords and other codes, they won't feel the need to use any kind of retrieval system. Ideally, the iris and fingerprint scanners will only transmit data one way, outward, so that no malware can get in and "infect" the device in order to compromise it. Instead of the scanners being updated over the internet, they will be "chipped" by having the updated EPROM posted out to the user in as secure a manner as possible, and the EPROM itself should have a code key so that it is paired with the unique device it is meant for, so that if stolen in transit, it can't be cloned or compromised between the sender and the recipient.

Our chip & pin machines were "hacked" by having bogus engineers visit the premises and adding extra chips or flashing compromised software onto them. The weakness was insecure management of technical support, rather than a direct malware attack on the device itself.