Firefox, Opera allow crooks to hide an entire phish site in a link

LoneWolf · Sep 3, 2012

A shortcoming in browsers including Firefox and Opera allows crooks to easily hide an entire malicious web page in a clickable link - ideal for fooling victims into handing over passwords and other sensitive info.
Usually, so-called "phishing attacks" rely on tricking marks into visiting websites designed by criminals to masquerade as banks and online stores, thus snaffling punters' credentials and bank account details when they try to use the bogus pages. However this requires finding somewhere to host the counterfeit sites, which are often quickly taken down by hosting companies and the authorities or blocked by filters.

Instead, the malicious web pages can be stored in data URIs - uniform resource identifiers, not to be confused with URLs - which stuff the web code into a handy string that when clicked on, instructs the browser to unpack the payload and present it as a page.
Click to expand...

http://www.theregister.co.uk/2012/09/03/phishing_without_hosts_peril/

siljaline · Sep 3, 2012

This Sans handler diary explains more.

gerardwil · Sep 4, 2012

siljaline said:

This Sans handler diary explains more.
Click to expand...

I do not find "more"
It is still about Henning Klevjer's paper.

Mrkvonic · Sep 4, 2012

How's this any different from any other scam?
Mrk

siljaline · Sep 4, 2012

Perhaps this from Sophos, otherwise, it's all I have.

However, he says that sophisticated attackers could also sneak the phished data out using a specially-crafted DNS request that would transfer the sniffed login credentials to the log file of a remote system.

Klevjer said the URI attack method could gain adherents among sophisticated attackers who are looking for a way around traffic and reputation monitoring and filtering systems. He said it also raises important questions about who “owns” the malicious data used in a URI based attack.

If URL shorteners are used, for example, the malicious content is now located within a link. Kelvjer told Naked Security:
“This fact transfers liability to the URL shortening services hosting the redirection”
Click to expand...

More

gerardwil said:

I do not find "more"
It is still about Henning Klevjer's paper.
Click to expand...

Log in or Sign up

Firefox, Opera allow crooks to hide an entire phish site in a link

LoneWolf Registered Member

siljaline Registered Member

gerardwil Registered Member

Mrkvonic Linux Systems Expert

siljaline Registered Member

Log in or Sign up

Firefox, Opera allow crooks to hide an entire phish site in a link

LoneWolf Registered Member

siljaline Registered Member

gerardwil Registered Member

Mrkvonic Linux Systems Expert

siljaline Registered Member

Useful Searches