A conversation with Professor Mirosław Kutyłowski
Michał Koralewski
: It is hard to imagine modern electronic banking without secure data transmission via the SSL protocol. Kleptographic attacks, as they develop, could however seriously shake faith in the security of online transactions. Can the average Joe protect themselves against these attacks?
Mirosław Kutyłowski
: The average user can significantly limit the danger. First of all, it is better to avoid services where authorization is based solely on a password and customer number. These can be intercepted (kleptography is just one method here; viruses that record what we type on the keyboard are very dangerous). In a situation where a one-time code provided by a token or from a scratch-off list is needed to carry out a transaction, the attack is very difficult – the attacker must act immediately. Secondly, if we use software with unavailable source code, we should only do so if we have complete trust in the manufacturer.
M. Koralewski
: How can one tell that a kleptographic attack has occurred, given that even product compliance tests with a given protocol will not show any suspicious deviations?
The article comes from the magazine “e-Fakty” 3/2006.