Silent Banker Trojan

[dravid]

Has you heard about this trojan which targeted 400+ banks?

InternetNews Realtime IT News - Beating Online Fraud With a Phone

[Freezer John]

Yes i know that Silentbanker trojan apparently is able to circumvent two-factor authorization and inject itself into the middle of ongoing banking transactions, duping bank customers into sending money to attackers while the customer proceeds with what looks like a valid transaction.

[wige]

I have heard a bit about the Silent Banker Trojan, but I have to admit I am somewhat confused how this phone out of band authentication would solve the problem in any way.

From my understanding, the Trojan works by waiting for the user to begin an authenticated session with the bank, then during that session alters the transaction data before sending it to be encrypted and transmitted to the bank. The phone system appears to try to correct for this by taking the authentication away from the computer. However, the actual attack occurs after the user is authenticated.