Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

31–40 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#31

Post by jpxxx »

yati wrote: post #26
feross wrote: post #17

Earlier quoted context omitted.

"do you think people would ignore the warning and continue to use the site?" I actually made this demo back in April but just got around to posting about it now. In the meantime, Firefox and Chrome have made their warning messages more prominent. Still, I think it's a pretty major issue. Experienced web users won't be fooled by something like this. But, even if 1% of users are fooled by this technique, that's still p…

Exactly, and the dumbness to smartness ration in this world is very high, so a serious attack is likely to affect far more than 1% of the visitors :O

The words 'dumb' and 'smart' are inflammatory and useless in this context. A substantial portion of desktop Internet users will click anything that comes up in order to get to their destination.

This attack triggers no 'warning' that would cause the user unease. The most obnoxious case is Firefox presenting "Allow or Deny Fullscreen?" a question that doesn't imply any danger or downside. A number of victims might even see it as a new kind of convenience, since their phone and tablet already do everything in fullscreen.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#33

Post by blaines »

I think the "Door Study" [1] was the best part! It's hilarious, and horrible that the guy didn't notice the swap. Maybe I've just lived in a big city long enough that I'm not surprised by the World Famous Bushman [2] or people's swindling.

[1] http://www.youtube.com/watch?v=FWSxSQsspiQ&feature=playe...

[2] http://en.wikipedia.org/wiki/World_Famous_Bushman

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#34

Post by vstm »

cfinke wrote: post #29
nikcub wrote: post #22

When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…

which Chrome and Safari have done Firefox does it too, and in a much more obvious way than either Chrome or Safari. Here are all the latest browsers on Mac compared: http://imgur.com/a/jdcI7 (Sorry Opera; I haven't re-installed you yet.) I actually didn't get any permissions dialog or warning label in Safari 6; maybe I ok'd it for another site at some point in the past, but I definitely didn't whitelist this domain.

I've just tested it in IE 9, apparently it has its own "safety mechanism" - I get the following message:

    Your browser does not support the Fullscreen API.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#35

Post by peterjmag »

damncabbage wrote: post #12

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

That's not what's happening here though. The JS in the demo doesn't change the href attribute of the link, it just adds an event handler that prevents the real link from loading using e.preventDefault() and then triggers full screen.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#37

Post by borlak »

A similar issue was shown when Adobe Flash fullscreen was first introduced (I think it was just Macromedia at the time, but anyway).

When you went to fullscreen in flash, it printed a giant "you are now in fullscreen mode" in the middle of the screen, but somebody showed that simply by printing similar text all over your screen, it hid that warning very well.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#38

Post by jpxxx »

jpxxx wrote: post #18
chaud wrote: post #15

Earlier quoted context omitted.

If that is the case, how is it a significantly worse problem than a regular link to a fake site?

Fake and malicious URLS can be filtered against and intercepted. This trick dodges those systems... but it still requires a malicious 'source' page to serve it up. Hrm. I imagine all of the payload (save for the return trip) could be put into innocent looking client-side Javascript, but that doesn't get around the fact that someone's still got to serve the JS...

Yeah, that's all I've got. The only scenario protecting the unsophisticated here is that the malicious javascript (presumably) has to be delivered from some domain, and domain filtering is in full effect almost everywhere.

This API means that if a malicious JS can be executed, it's game over for a number of defenses that only communicate visually.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#39

Post by damncabbage »

feross wrote: post #21
damncabbage wrote: post #12

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

Yep. Try Right Click > Copy Link Address. It copies the google.com/... redirect link, which is how I first learned that they were doing this.

To see how it works:

* Open a search in Chrome, and open up the Inspector (making sure not to right-click any links you want to inspect),

* Find an tag for a search result.

* Right-click the tag in the Inspector, go Break On... => Attributes Modifications.

* Right-click the link like you usually would to copy it, and see what happens.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#40

Post by shock3naw »

jpxxx wrote: post #31
yati wrote: post #26

Earlier quoted context omitted.

Exactly, and the dumbness to smartness ration in this world is very high, so a serious attack is likely to affect far more than 1% of the visitors :O

The words 'dumb' and 'smart' are inflammatory and useless in this context. A substantial portion of desktop Internet users will click anything that comes up in order to get to their destination. This attack triggers no 'warning' that would cause the user unease. The most obnoxious case is Firefox presenting "Allow or Deny Fullscreen?" a question that doesn't imply any danger or downside. A number of victims might eve…

To corroborate your point, one of the Chromium developers spoke about this sort of problem, but in the context of invalid SSL certificates and the associated warning that Chrome displays. A ridiculous percentage of users ignored the warning that the site they were visiting wasn't verified and simply clicked 'Visit this site anyway.' Most users don't understand that there are potentially serious costs to ignoring security warnings.
Post reply on HN