This scroll jail shit is why I absolutely despise AMP pages.
The inception bar: a new phishing method
181–190 of 238 posts
Re: The inception bar: a new phishing method
#182This fake bar reminds me of a fake address bar that Google displays in an AMP viewer and efforts it takes to be able to replace URLs in an address bar instead of just letting the user visit the target site.
Re: The inception bar: a new phishing method
#183I understand why this was a problem in 1995, but honestly, in 2019, with image recognition technology as advanced as it is now – especially due to efforts by Google – why can't browsers detect this? Surely "does this rectangle look vaguely like a URL bar" is an easier problem to solve than "is this a photograph of a cat"? Sure, image recognition is CPU intensive, but even just checking once every 5 seconds or so woul…
MobileSafari has an interesting feature that your idea reminded me of: it tries to detect when a site using the Fullscreen API presents an iOS keyboard-lookalike through the location and frequency of your taps on that side of the screen. I’ve gotten the warning when doing something else and was impressed they thought of it.
Re: The inception bar: a new phishing method
#184Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear. Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...
Using Firefox 66.0.2 on Android as well. Pretty much the same behavior here, except that it does not look random at all: - at the top of the page, if I scroll, the address bar disappears; - as soon as the fake HSBC bar appears, the real address bar comes back; - both of them remain here until I reload the page. It looks like if the use of CSS position: fixed forced the Firefox address bar to be visible. Which given t…
If Firefox doesn't trust elements with position: fixed, one could use position: absolute or even position: static (the default value) instead and move element when scrolling.
Re: The inception bar: a new phishing method
#185Earlier quoted context omitted.
In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.
The company where I first worked out of university had a custom which the CEO named ‘shemaling’. The company had quite strict security standards. It was encouraged that anyone who found an unlocked screen in the office would ‘shemale’ the wallpaper. It did the job. I never forgot again after being ’shemaled’ the first time.
I gay porned an entire company's computers after they refused to crack down on employees watching people being murdered all day. They threatened to fire me so I explained exactly why I had done this and that I would happily explain this at length in any subsequent employment tribunal. I kept my job and the management finally told everyone to stop watching people getting killed on company time.
Re: The inception bar: a new phishing method
#186Earlier quoted context omitted.
Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…
Mine would log you in. Of course the OS (Oasis) had a way to exec the login program and feed it the password. I stole the teacher’s password and then changed it. He busted me by booting up the system from floppy and typed in the commend to format the hard drive and waited for me to return to the lab after school. I asked him what he was doing and he said he had no choice but to reinstall from scratch because someone…
Why would someone that could boot a system from floppy have to "format the hard drive" instead of just setting a new password?
Re: The inception bar: a new phishing method
#187Re: The inception bar: a new phishing method
#188A similar attack could be done with fake password manager UI elements.
I saw a proof of concept video of exactly this using LastPass.
Re: The inception bar: a new phishing method
#189Totally fooled me, but pulling down on the fake 'inception' bar brings back Chrome's url bar. Neat trick.
Re: The inception bar: a new phishing method
#190Earlier quoted context omitted.
Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…
Back in the day I made a near-perfect copy of the RM (UK school IT supplier) login page in Visual Basic 6, and had it run on computers with RunServices registry entry. Had a team of mates with custom floppy disks going around installing it on as many PCs as we could. It would log the supplied user/pw to disk, then display the "wrong password" error, then quit, then exposing the real login screen.
What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.