0

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is meant for people who wish to access their account themselves, but are unable to do so otherwise.

I have never used that computer and remain highly skeptical about this.

My question does not involve the possibility of others capturing the keystrokes by watching or a camera facing the keyboard or the screen, as that doesn't seem to be the case in this particular setting.

Instead, I would like to ask: What measures can the bank take to ensure that no user installs spyware to track other users? Again, the camera can't really see what the user is doing exactly, and the employees are most likely too busy to pay attention.

I have no knowledge of what the system actually looks like, as I have never used that workstation. I don't know whether there is a regular operating system installed with a browser that can access only the bank's website, or, perhaps, rather a software application dedicated for the task, with the access to any other OS features being locked.

  • One thing that came to my mind was having a snapshot that could be rolled back at any time (ideally, each time a user would be finished with their work). Is that how it is done?

  • Do they employ simple forensics to make sure that the integrity of the system has not been tampered with?

  • If neither of the above is likely, what else could be done?

  • And finally, the most scary question: Do the banks even care?

Please note that my expectations toward possible answers either assume that the practice is more common in worldwide banking, or simply arise out of my interest in how it should be done properly (if that's possible at all).

Improve this question
6
  • We can't know how your bank is doing this ... but the "scary" option is not that unlikely. Normal OS, no actions against tampering.
    – deviantfan
    Commented Feb 12, 2016 at 16:13
  • @deviantfan It's true that I have asked my question in a somewhat too specific way. I thought that it was likely for other banks to do that too, and even if they didn't, I would still be interested in what precautions could be taken. I'll edit my question to clarify that.
    – rhino
    Commented Feb 12, 2016 at 16:18
  • the thing you need to look for is "kiosk" computers - they have limited hardware, and they sandbox the user login in such a way that it refreshes when the user logs out
    – schroeder ♦
    Commented Feb 12, 2016 at 16:19
  • 1
    And, if it is a normal PC (not something built like an ATM), there are so many possibilites to do malicious things that writing a list would exceed the max answer length here. To start with, while you're thinking of software, you're forgetting the hardware completely. How about: I buy a keyboard, build something in so that everything is logged, go there, and switch the old keyboard with mine? If the location is safe against cameras, nobody will notice. And while some people check against additional stuff between plug and cable, no one will take everything apart.
    – deviantfan
    Commented Feb 12, 2016 at 16:19
  • 1
    This question is too broad @rhino, and very opinion-based. There are many valid ways which banks could use to protect users.
    – GdD
    Commented Feb 12, 2016 at 16:19

1 Answer 1

Reset to default
3

Any form of hacking involves being able to change the underlying operating system or applications. If an attacker were completely prevented from doing this, then attack is impossible.

Operating systems have vulnerabilities. They always have, and they always will. But what if the OS and all applications ran off of a medium physically incapable of being altered, say on a read-only medium and had no ability to write to permanent storage? Furthermore, if the OS rebooted when each user was finished with the computer, and sufficient physical access to the computer was prevented, it would be exceedingly difficult to hack the computer.

So in my estimation, a secure public computer would need the following properties.

  1. A read only operating system, at the physical medium layer.
  2. No medium capable of writing information anywhere permanently (obviously you still need RAM).
  3. The operating system reboots after every use in order to prevent someone gaining control of the running operating system.
  4. Physical access is extremely limited. No USB ports are available, the physical box is in a locked box that can't be tampered with easily. Even the keyboard is "bolted in" and can't be removed. Think the level of physical security associated with an ATM.
Improve this answer
5
  • This is a sound answer. I especially like the claim addressing physical access, and this is probably what is done in this case (unless it's true that they don't really care). I'll accept the answer if this question gains no more attention.
    – rhino
    Commented Feb 12, 2016 at 16:43
  • @drewbenn I don't see how someone could put in a skimmer on a keyboard that's bolted on.
    – Steve Sether
    Commented Feb 12, 2016 at 18:22
  • 1
    @drewbenn Sure. Nothing is 100%. The easiest attack would be to attack the physical space rather than the computer. Put a tiny spy camera in the lobby and record peoples keystrokes.
    – Steve Sether
    Commented Feb 12, 2016 at 18:59
  • This is a very good answer...except for the fact that the first paragraph is plainly wrong. Hardware keyloggers, user-mode trojan horse malware, malicious firmware rewrites, and plenty of other attack means do not rely on being able to "change the underlying operating system" or already-installed software.
    – mostlyinformed
    Commented Feb 13, 2016 at 5:15
  • Except for that paragraph, though, the answer is quite insightful.
    – mostlyinformed
    Commented Feb 13, 2016 at 5:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .