[deleted]
The inception bar: a new phishing method
121–130 of 238 posts
Re: The inception bar: a new phishing method
#122Whenever I’m looking at an iPhone screenshot someone posted on social media on my iPhone, I try to navigate using the buttons in the image. There ought to be a long German word for that experience.
There's a not so long one: Verarschung
Re: The inception bar: a new phishing method
#123I tried to exploit the mobile browser hiding the address bar when scrolling to hide the address bar in a web game/app to get more screen real estate on mobile but most browsers make it very hard.
Re: The inception bar: a new phishing method
#124With a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns... The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action. [0]: https://textslashplain.com/2017/01/14/the-line-of-death/
Oh and do that scammy double-redirect to yourself so back button doesn't work.
Re: The inception bar: a new phishing method
#125By override the scroll behavior, it also makes the page feel very unnatural on an ipad (I think it’s the inertia effect missing).
Re: The inception bar: a new phishing method
#126The illusion is almost perfect. However, it breaks when you scroll back to the very top. The real address bar reappears on top amd stays there even when scrolling back down. This is with Chrome 73.
Re: The inception bar: a new phishing method
#127A similar attack could be done with fake password manager UI elements.
Re: The inception bar: a new phishing method
#128I happened to have 26 tabs while loading this, and spent a minute trying to figure out how the fake bar "knew" my open tab count
... so how does it?
Edit: saw in another comment that it's hardcoded, so it was coincidence. That makes sense.
Re: The inception bar: a new phishing method
#129"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…
New? I think that was around since IE6 times.
Autohide menu bars are bad designs, and you have this on top of that.
Fullscreen API must be removed from browser for security reasons, new window hints should be removed too.
Re: The inception bar: a new phishing method
#130Earlier quoted context omitted.
ha I did a similar thing too. Except it was fake error messagebox and on Windows 3.1 (or might have even been 3.0?) It worked quite effectively on 3.x because you could just minimize progman.exe
We did similar with the dos prompt, which must have been about 1991.
That's the era as me (Windows 3.0 was released in 1990, 3.1 a couple of years later). I'm surprised your school let you have unfettered access to the DOS prompt - that would have gotten abused within minutes at our school. Even the BBC BASIC interpreter ended up getting removed from the network because people like myself would abuse the PC Speaker (which, to be honest, was the last the mischief I'd cause).
Frankly though, I preferred the actual BBC Micros and Amiga's that those IBMs were meant to replace.