3 ms·
One possible attack is to change the details of a transaction before the page post it. To the user it would appear as she's transferring money to Bob, but it'd
by slig 8y ago
One possible attack is to change the details of a transaction before the page post it. To the user it would appear as she's transferring money to Bob, but it'd go to Eve.
- magicalhippo 8y agoMy bank has two-factor using some special applet thingy on my phone (not a regular app, it's tied into the SIM card somehow). It shows me the details (amount and destination account) which I have to confirm using my password (in combination with a key from the SIM). Much more difficult to circumvent, assuming the user pays attention...
- chii 8y agoThen, the malicious script can just pop up an official looking dialog box with a message saying that they are 'testing' the confirmation system, and please accept/agree to the next sms/alert from the app. Having direct control of the user interface is very powerful.
- magicalhippo 8y agoOf course one has to have a minimum of awareness for any protection mechanism to work.
- moviuro 8y agoEve should be among the known receivers though, which is a world of slow (~72hours to add an IBAN to my list for instance). There are banks that try to make it faster though, with MFA, though the MFA system is usually SMS.