Firefox, Opera allow crooks to hide an entire phish site in a link

[LoneWolf]

A shortcoming in browsers including Firefox and Opera allows crooks to easily hide an entire malicious web page in a clickable link - ideal for fooling victims into handing over passwords and other sensitive info.
Usually, so-called "phishing attacks" rely on tricking marks into visiting websites designed by criminals to masquerade as banks and online stores, thus snaffling punters' credentials and bank account details when they try to use the bogus pages. However this requires finding somewhere to host the counterfeit sites, which are often quickly taken down by hosting companies and the authorities or blocked by filters.

Instead, the malicious web pages can be stored in data URIs - uniform resource identifiers, not to be confused with URLs - which stuff the web code into a handy string that when clicked on, instructs the browser to unpack the payload and present it as a page.

http://www.theregister.co.uk/2012/09...t_hosts_peril/

[siljaline]

This Sans handler diary explains more.

[gerardwil]

Originally Posted by siljaline

This Sans handler diary explains more.

I do not find "more"
It is still about Henning Klevjer's paper.

[Mrkvonic]

How's this any different from any other scam?
Mrk

[siljaline]

Perhaps this from Sophos, otherwise, it's all I have.

However, he says that sophisticated attackers could also sneak the phished data out using a specially-crafted DNS request that would transfer the sniffed login credentials to the log file of a remote system.

Klevjer said the URI attack method could gain adherents among sophisticated attackers who are looking for a way around traffic and reputation monitoring and filtering systems. He said it also raises important questions about who “owns” the malicious data used in a URI based attack.

If URL shorteners are used, for example, the malicious content is now located within a link. Kelvjer told Naked Security:
“This fact transfers liability to the URL shortening services hosting the redirection”

More

Originally Posted by gerardwil

I do not find "more"
It is still about Henning Klevjer's paper.