Devious New Phishing Tactic Targets Tabs

win32sux · 05-25-2010, 09:15 AM

Quote:

Most Internet users know to watch for the telltale signs of a traditional phishing attack: An e-mail that asks you to click on a link and enter your e-mail or banking credentials at the resulting Web site. But a new phishing concept that exploits user inattention and trust in browser tabs is likely to fool even the most security-conscious Web surfers.

As Mozilla Firefox creative lead Aza Raskin describes it, the attack is as elegant as it is simple: A user has multiple tabs open, and surfs to a site that uses special javacript code to silently alter the contents of a tabbed page along with the information displayed on the tab itself, so that when the user switches back to that tab it appears to be the login page for a site the user normally visits.

Complete Article

Thanks to Slashdot for covering this.

spampig · 05-25-2010, 09:58 AM

Very neat - and so simple. Thanks for the heads up.

LouRobytes · 05-25-2010, 10:19 AM

Thanks. Another reason for my dislike of tabs.

Hangdog42 · 05-25-2010, 12:29 PM

Good grief, this is truly evil. I wonder how tied to javascript this actually is. Is there another way to do this, or is NoScript reasonable protection?

spampig · 05-25-2010, 12:59 PM

One of the Usenet regulars has posted a clearer Facebook example. This is really quite nasty, but can be mitigated with 'noscript'.

http://www.elblowfly.org.uk/tagnab/

win32sux · 05-27-2010, 08:27 PM

From the changelog for the most recent NoScript release (1.9.9.81):

Code:

+ Experimental blocking of page refreshes happening inside untrusted
  unfocused tabs, should provide protection against Aviv Raff's scriptless
  "tabnabbing" variant. Enabled by default, can be controlled through the
  noscript.forbidBGRefresh about:config integer preference:
  0 - no blocking
  1 - block refreshes on untrusted unfocused tabs
  2 - block refreshes on trusted unfocused tabs
  3 - block refreshes on both trusted and untrusted unfocused tab
  Address patterns matching pages which shouldn't be affected can be
  listed in the noscript.forbidBGRefresh.exceptions preference