Script Injection Makes Phishing Harder to Catch

ronjor · Jul 20, 2004

The main advantage of script-injection phishing attacks is that they are carried out on the trusted site itself. "If the user is vigilant and verifies the identity of the site by examining the SSL certificate, the attacker is still able to steal information," said Thomas Kristensen, chief technology officer at Denmark-based security firm Secunia. Such attacks work just as well on SSL sessions.

http://tinyurl.com/6r5xq

optigrab · Jul 20, 2004

Pretty scary, Rojor. Thanks for the post.

All a user has to do to avoid the attack is to type in the trusted URL by hand or to find it via a trusted site such as a search engine. But scammers have shown that fake bank e-mails, for example, can be made very persuasive, experts say.
Click to expand...

I guess the best practice defense for this is never click on links in emails for any site that requires a logon. Is that good enough?

Dazed_and_Confused · Jul 21, 2004

optigrab said:

I guess the best practice defense for this is never click on links in emails for any site that requires a logon. Is that good enough?
Click to expand...

Agreed. And here is an excerpt from the article Ronjor referred to.

"All a user has to do to avoid the attack is to type in the trusted URL by hand or to find it via a trusted site such as a search engine. But scammers have shown that fake bank e-mails, for example, can be made very persuasive, experts say. "

Log in or Sign up

Script Injection Makes Phishing Harder to Catch

ronjor Global Moderator

optigrab Registered Member

Dazed_and_Confused Registered Member

Log in or Sign up

Script Injection Makes Phishing Harder to Catch

ronjor Global Moderator

optigrab Registered Member

Dazed_and_Confused Registered Member

Useful Searches