Comments on Minded Security Blog: Discretionary controls may lead to social engineer...

Good work! Bests to Minded Security Team. MGX

2011-04-07T10:01:00.340-07:00

Good work! Bests to Minded Security Team.

MGX

Where can I get anti malware device? And how much?...

2011-03-19T17:06:39.497-07:00

Where can I get anti malware device? And how much?

@Jimmy: Thank you @Travis: You are right. I think...

2009-06-07T04:32:58.616-07:00

@Jimmy: Thank you

@Travis: You are right. I think that separators and special characters should be filtered via Input Validation. In addition I would suggest to use some chroma, or a different font type (style and size) to better discriminate from the field and its properties.

Hi Giorgio, very nice post. You mentioned "Tr...

2009-06-07T04:24:17.273-07:00

Hi Giorgio, very nice post. You mentioned "Transfer Details", as it could be bad if they are not displayed on the external device.

However I think thay displaying on a small LCD the transfer details could open social engineering attacks by abusing this field.

E.g. Tranfer Detail: Name: Alice, Amount 100
Could be very misleading

Good post indeed. Travis Lee

Really the social engineering attack could be very...

2009-06-06T05:34:59.631-07:00

Really the social engineering attack could be very practical for luring the user of banking dongles. A surge is expected in such cases.

You are correct mentioning "Transfer Details". "Tr...

2009-05-22T12:03:33.833-07:00

You are correct mentioning "Transfer Details". "Transfer Details" may give more room for social engineering attacks if they are not displayed on the external device.

Since the operator of the receiving institute make his decision upon the information contained in the data transfer, an attacker may forge particular subjects to push the operator in the wrong direction.

E.g. Inserting some information related to the attacker e.g. Surname, name, etc.. (real owner of destination account)

I had some security thoughts reading the article. ...

2009-05-22T11:51:41.581-07:00

I had some security thoughts reading the article. I think that is a pretty known issue, but you give new implications connecting it to Antimalware solutions.

You did not mention the transfer details. They need to be changed?

As mentioned in the article the described social e...

2009-05-22T11:28:48.251-07:00

As mentioned in the article the described social engineering attack could be very practical for luring the user of "banking dongles" into confirming the transaction. Anti-Malware devices are still not very common, so attacks like the one mentioned are more likely to be encountered in the near future.

Nice Article. Did you have observed any fraud at...

2009-05-22T04:25:00.508-07:00

Nice Article.

Did you have observed any fraud attempt trying to force you so called recipient bank "discretionary controls"?