Malware developed to steal smartcard PINs

Researchers have developed malware able to remotely steal two factor PINs generated by USB smartcards.  The malware was unique in that it applied a driver to access the USB port and ship PINs stolen applying a keylogger to a remote command and control server.

Author and penetration tester Paul Rascagneres (RootBSD) who helped develop this malware, said it can work on most USB smartcards.

“I did not test the proof of concept on all providers, but as the malware shares the USB device in raw, we do not target any specific smartcard,” Rascagneres said.

The function of a driver to swipe smartcard tokens was unique, Rascagneres said, since existing malware had applied the Windows application programming interface to steal PINs.

Rascagneres went on to say that attackers could deliver the malware through classic vectors including malicious email attachments or exploit kits.  Users could mitigate the threat and others like it by using a hardware keypad or by monitoring latency.  Rascagneres will present a proof of concept instance of the malware at the Malcon event this month.