41–50 of 56 posts
Earlier quoted context omitted.
Yep. Open requested link in a new tab, change the previous tab to some autoplay video or fake chat interface. It's not phishing exactly, but it is certainly devious.
To be fair, not all of those chat interfaces were fake. Some are just scripts that connect to real people quickly once you interact favorably. Then they try to sell you on $50 of cam show credits.
For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open(" http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = " https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into malicio…
For anyone who wants to see this defeated: - Disable JavaScript. Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any…
but my god, how the web got better!
practically no ads. no frills. some sites don't work, but then I just move to one that does or allow js there.
Earlier quoted context omitted.
To be fair, not all of those chat interfaces were fake. Some are just scripts that connect to real people quickly once you interact favorably. Then they try to sell you on $50 of cam show credits.
Wait, how do you know that? :P "Market research" eh?
Is there a canonical safe way to pop up a link in a new tab/window? This seems like a major bug and hopefully browser vendors will fix it quickly.
> The newly opened tab can then change the window.opener.location to some phishing page. This is true, and is a vulnerability I have been looking at for a while now, though I've not actually seen it exploited yet in the real world. For anyone interested, there are some pretty interesting exploits involving pages where an auth token is in the querystring and thus sent in the referer field by the browser. Also, conside…
What happens if they change `window.opener.location` to a javascript: URI? I'm assuming (well, hoping) it fails to work, but it would be nice to have that confirmed.
Earlier quoted context omitted.
Re: http://lcamtuf.coredump.cx/switch/ , couldn't browsers simply do a better job of showing the address when window.location.href is 'data:text/html;-peak.us/banking_interface/' or any other data URL? Re: malicious sites linking back to a parent that opened the, could browsers not also disable cross-origin .opener?
Sure...but that is another thing that needs to be added to all browsers; it begins to feel like a game of whack-a-mole. In the end, browsers rely on an admittedly fragile premise...the only thing that guarantees your current location is a persistent awareness of what domain you are on. Most of the time that works for savvy users (normal users have no fighting chance/nor should they be expected to have to do this). Bu…
Agreed CSP would be a good place to fix.
But then I read this - https://www.chromium.org/developers/design-documents/site-is...
"Most renderer-initiated navigations (including link clicks, form submissions, and scripted navigations) are kept within the current process even if they cross a site boundary. This is because other windows in the same process may attempt to use postMessage or similar calls to interact with them."
Earlier quoted context omitted.
Sure...but that is another thing that needs to be added to all browsers; it begins to feel like a game of whack-a-mole. In the end, browsers rely on an admittedly fragile premise...the only thing that guarantees your current location is a persistent awareness of what domain you are on. Most of the time that works for savvy users (normal users have no fighting chance/nor should they be expected to have to do this). Bu…
Of course it's whack a mole. Moat things in infosec are, that doesn't mean browsers shouldn't ship with secure defaults or present trustworthy info in the address bar. Agreed CSP would be a good place to fix.
For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open(" http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = " https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into malicio…
For anyone who wants to see this defeated: - Disable JavaScript. Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any…