1

I have a linux run as firewall between my PC and the Internet router.

Now, if my Windows PC is infected with Banking Trojan that will eavesdropping any online banking activities and redirect traffics to the attacker control center.

Let say I have an account with Citibank and I know the Citibank online banking web address IP address. Now I go to the firewall and run a script that DENY all connection except Citibank IP address. I even has Citibank web address and IP set in my windows hosts file.

If I make an online transaction on Citibank website, that will send a Transaction Authentication Number through SMS to confirm the transaction.

In such case, am I safe from Men-in-The-Middle attack with such restricted firewall setting?

1

Your methods would protect you against the exact scenario you outline but attackers don't have to attack you in the way you specify. Minor modifications in the way the banking trojan works will leave you vulnerable.

If the trojan just MITM's you directly rather than forwarding you to an external site it can change the details of a legitimate transaction so a simple authentication code sent via SMS won't help. Also badguys can hijack phone numbers and trojan phones as well.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.