Trying to crack IB Secure Device
-
DBS Internet Banking is actually secure enough after they introduced One Time Pin verification for adding new payee. Stupid MAS set new rules to make the matter more complicated. It's totally unnecessary.
IB Secure Device generates only 6 digits.
so 10^6 possibibilities
You can only log in wrongly for 4 to 5 times
There is no communication between the device and the internet banking server.
It could only mean one thing, there is a set of fixed numbers stored in the device, each time the device will show one number. This set of numbers are authentic, the others are all false numbers.
It looks like each number can only be used once. (I tried already)
But I'm not sure after how long it will cycle?? I will try write down a used number and see after a few months, can it be used again?
If numbers can be reused then a hacker who already got the victim's pin and a used number from the device through keylogger just need to patiently wait for the time the number can be reused.
If numbers cannot be reused, then after the user used up all the numbers, DBS must give him a new device. So I assume there must be enough numbers stored for the user to use, 1000 should be ok, who use internet banking more than 1000 times?
so the chance of guessing a correct number is 1000 / 10^6 = 1 / 1000
quite high!
So only way to crack it is to guess what's the mathematical function it uses to generate the numbers, from the information given: use the device to generate a few numbers for analysis. -
You must think that the person who came up with it never went thru the same brainstorming session as you above huh>
-
haahaa
-
it probably all relies on an algorithm, perhaps taking into account the time, date and so on and maybe other stuff.
happy cracking it.
-
it's a formula... i can't tell u
-
You sure you wanna crack it? What if they send a hit squad after you? Haha
-
the token's ID (which is not known to u) is tagged to ur account
the numbers generated on the token is matched with the token ID by a formula or some logic
the lifespan is not on the number of numbers able to be generated but the lifespan of the batt in the token....... -
The token is just a pseudo random number generator...
The random number is generated using a seed and as long as the time in the token is synchronised (with a margin for skewing) with the authentication server, access is granted. Yes, the number will be recycled some point in the future but it will depend on the seed, the algorithm and the time. -
Nope. I don't think the random number generator use a timer as seeds. If it does, it's virtually impossible to crack, but in any event of failure of clock synchronization, the device will fail, or worse, all devices in singapore will fail (if the server goes wrong). Here's a simple test to prove the generator does not depend on time. Generate a number, but don't use it, wait for some time to pass, and use it. YOu can try, the unused number can still be used, meaning it will never expire until after you use it.
-
1) 6 digits will means 6 to the power of 10 -> 60466176 combinations.Originally posted by kog:DBS Internet Banking is actually secure enough after they introduced One Time Pin verification for adding new payee. Stupid MAS set new rules to make the matter more complicated. It's totally unnecessary.
IB Secure Device generates only 6 digits.
so 10^6 possibibilities
You can only log in wrongly for 4 to 5 times
There is no communication between the device and the internet banking server.
It could only mean one thing, there is a set of fixed numbers stored in the device, each time the device will show one number. This set of numbers are authentic, the others are all false numbers.
Not 10 power of 6. You need a few toilet rolls to write all the combinations once. Enjoy hor.
2) And if there is no communication with the server, why enter it?
Where is the matching done?
I suggest you read up more on security devices first. -
Eh?Originally posted by iceFatboy:1) 6 digits will means 6 to the power of 10 -> 60466176 combinations.
Not 10 power of 6. You need a few toilet rolls to write all the combinations once. Enjoy hor.
2) And if there is no communication with the server, why enter it?
Where is the matching done?
I suggest you read up more on security devices first.
6^10 means its base-6
Which means the number seq goes from 1 to 6...
I suggest you go read up more on numbering system first
And I didn't say the PRNG uses a timer as a seed
The seed will be a fixed value, known only to the token and the auth server, used to generate the random number.
The reason its pseudo is because it can be made to look like its random but it is still predictable. In fact, this method is commonly used as encryption on datacomm systems.
FYI, the number generate by the token is only valid for the minute that it was generated, a new number will be generated the next minute
A token by RSA: http://en.wikipedia.org/wiki/SecurID -
Try and tell me.Originally posted by kog:Nope. I don't think the random number generator use a timer as seeds. If it does, it's virtually impossible to crack, but in any event of failure of clock synchronization, the device will fail, or worse, all devices in singapore will fail (if the server goes wrong). Here's a simple test to prove the generator does not depend on time. Generate a number, but don't use it, wait for some time to pass, and use it. YOu can try, the unused number can still be used, meaning it will never expire until after you use it.
If it ever can be used, DBS will hire you as their security consultant.
I don't believe that time isn't involved in anyway, because this will result in a man-in-the-middle attack, aka replay attack.
This defeats the purpose of the token... -
You need to read properly...Originally posted by iceFatboy:1) 6 digits will means 6 to the power of 10 -> 60466176 combinations.
Not 10 power of 6. You need a few toilet rolls to write all the combinations once. Enjoy hor.
2) And if there is no communication with the server, why enter it?
Where is the matching done?
I suggest you read up more on security devices first.