Man-in-the-Middle Bank Fraud Attack
This sort of attack will become more common as banks require two-factor authentication:
Tatanga checks the user account details including the number of accounts, supported currency, balance/limit details. It then chooses the account from which it could steal the highest amount.
Next, it initiates a transfer.
At this point Tatanga uses a Web Inject to trick the user into believing that the bank is performing a chipTAN test. The fake instructions request that the user generate a TAN for the purpose of this "test" and enter the TAN.
Note that the attack relies on tricking the user, which isn't very hard.
Posted on September 14, 2012 at 11:23 AM • 28 Comments