Solutions to ‘Man in the browser’ online banking security threat

27 11 2007


As reported by Computer World UK malware is shifting towards intercepting traffic inside the browser – a kind of man in the middle attack, rather than keystroke logging or phishing. This style of malware would intercept the password entered on the webpage using exploits in the browser. How about this solution to combat this?

Banks should offer their own applications to use for online banking – for instance, a virtual machine that saves it’s state running something like damn small linux + a web browser. This could be packaged with qemu.

You’d boot the virtual machine, use your banking, then when you closed it off, the virtual machine wouldn’t save changes, so it would always be the same.

This could be distributed on read only flash memory, or even plain old CDs to avoid malware modifying the image.

So: how do you do this?

1. Download DSL Embedded edition

2. Unzip it, and click dsl-base.bat

3. Up comes DSL linux, it boots using QEMU in a matter of seconds

4. Use your online banking as you wish (Ctrl – Alt releases the window so you can get back to your other applications)

5. That’s it…

The protection of using both Linux and a virtual machine in windows in 5 steps!

Now, if only banks would redistribute this, you can imagine how easy it would be to rebrand DSL, and to auto open firefox on the correct page.

Comments?

StumbleUpon Toolbar Stumble It!


Actions

Information

6 responses

29 11 2007
Jud

I’m interested in installing your program on my machine. Through a odd set of circumstances, my operating system was installed on E:\ drive and I have no C drive:. When I try to download and unzip the program has nowhere to go, as it is looking to open C:\unzipped\dsl-4.0-embedded and put it in a file in Cdrive.
I’m running Windows 2000, pro on a Pentium 3 generic 500 Mhz.
Have you any ideas that might help me?

29 11 2007
richbradshaw

Try using something like 7zip to extract the file: get it here, http://downloads.sourceforge.net/sevenzip/7z442.exe .

Once it’s installed, just right click on the zip file, and you can choose to extract here. Do that and it will unzip it.

7zip works for loads of different file formats as well, so it will prove useful in the future!

30 11 2007
Jud

Thank you for your kind attention and reply. I’ll do what you suggest.

30 11 2007
Jud

I managed to get the program running, and so I’m off to my long-put-off journey into Linux territory. I see a large learning curve around the bend.
Thanks again

30 11 2007
richbradshaw

Brilliant!

Remember that this Linux is designed to be small and fast, not good looking and full of software.

19 06 2008
Advantages and Disadvantages for Internet Banking

Advantages and Disadvantages for Internet Banking…

Lansner\’s latest North County suffers smallest home- sales slump Deep discounts help O. C. homebuying bump O. C.’ s home pain? 1 lost every 3 minutes SoCal prices fall record 27% in May What Lansner wrote as O. C. homes cracked 500,000 May’ s me…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s




Follow

Get every new post delivered to your Inbox.

%d bloggers like this: