Looks like the "never redisplay the true url bar" trick didn't work for me on my mobile Chrome.
The inception bar: a new phishing method
31–40 of 238 posts
Re: The inception bar: a new phishing method
#32The scroll jail didnt work for my firefox for android latest stable.
The article indicates it's not supposed to. It's a quick and dirty proof of concept, working in one environment (Android/Chrome), with a screenshotted fake header. Just enough to prove the point.
Re: The inception bar: a new phishing method
#33I guess this risk could be mitigated if the browser had recognition code running in the background for if the top of the screen was mimicking the search bar. I'm not fond of the idea that we put restrictions of fullscreen mode where it requires user approval when scrolling down or something of that sort.
Re: The inception bar: a new phishing method
#34Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear. Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...
[deleted]
Re: The inception bar: a new phishing method
#35I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.
In principle, it's not a mitigation - I was just too lazy to forge an interactive URL bar! You could make one which acts just like the Chrome URL bar, but e.g. acts as a MITM.
At first I though you wouldn't be able to stay "in the middle" because you'd have to redirect to the typed address. You can't AJAX it in, because of CORS.
But you could go to your own host and have your server sit in the middle. The user wouldn't be logged in, since cookies wouldn't be sent. But maybe they would login through your proxy.
Re: The inception bar: a new phishing method
#36Doesn’t scale well to small mobile devices (eg iPhone SE)
Re: The inception bar: a new phishing method
#37"Make sure you’ve done a hard refresh of the page"
An inception bar could include a fake refresh button, no?
Re: The inception bar: a new phishing method
#38I happened to have 26 tabs while loading this, and spent a minute trying to figure out how the fake bar "knew" my open tab count
Re: The inception bar: a new phishing method
#39Re: The inception bar: a new phishing method
#40Earlier quoted context omitted.
Just to be clear, you're referring to real Firefox address bar (pointing to TFA), not the fake Chrome address bar (pointing to hsbc.com). So yes, in this case Firefox has (accidentally?) somewhat thwarted this attack vector.
It certainly looks accidental. It hides on scroll on other pages but this one causes it to half hide and then it pops back up again.
I noticed this as well. I'm wondering if FF is smart enough to always show it's own title bar if a CSS element is pinned to the top of the viewport? Gotta do more testing ...