Maybe Those Hot, New Smart Cards are Not Too Secure

The U.S. government has been stepping up its use of smart cards to help lock down its computer networks, but hackers have found ways around them. Over the past 18 months, security consultancy Mandiant has come across several cases where determined attackers were able to get onto computers or networks that required smart cards and passwords. In a report released yesterday January 27, Mandiant calls this technique a smart card proxy. The attack works in several steps. First, the criminals hack their way onto a PC. Often they will send a specially crafted e-mail message to someone at the network they are trying to break into. The message will include an malicious attachment that, when opened, gives the hacker a foothold. After identifying the computers with card readers, the criminals install keystroke logging software on them to steal the password typically used in concert with the smart card. When the victim inserts the smart card into the hacked PC, the criminals then try to log into the server or network that requires the smart card for authentication. When the server asks for a digital token from the smart card, the criminals redirect that request to the hacked system, and return it with the token and the previously stolen password.