Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

41–50 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#41

Post by damncabbage »

peterjmag wrote: post #35
damncabbage wrote: post #12

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

That's not what's happening here though. The JS in the demo doesn't change the href attribute of the link, it just adds an event handler that prevents the real link from loading using e.preventDefault() and then triggers full screen.

Sorry, I wasn't very clear; I'm just saying that both this and Google Search spoofs the status bar by obscuring what a link will do until it's clicked.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#42

Post by feross »

cfinke wrote: post #29
nikcub wrote: post #22

When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…

which Chrome and Safari have done Firefox does it too, and in a much more obvious way than either Chrome or Safari. Here are all the latest browsers on Mac compared: http://imgur.com/a/jdcI7 (Sorry Opera; I haven't re-installed you yet.) I actually didn't get any permissions dialog or warning label in Safari 6; maybe I ok'd it for another site at some point in the past, but I definitely didn't whitelist this domain.

Safari has no warning or message at all. Just a quick, half-second animation and that's it.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#43

Post by feross »

blaines wrote: post #33

I think the "Door Study" [1] was the best part! It's hilarious, and horrible that the guy didn't notice the swap. Maybe I've just lived in a big city long enough that I'm not surprised by the World Famous Bushman [2] or people's swindling. [1] http://www.youtube.com/watch?v=FWSxSQsspiQ&feature=playe... [2] http://en.wikipedia.org/wiki/World_Famous_Bushman

I saw the World Famous Bushman in SF last year -- I had no idea that he was "world famous" and had his own Wikipedia article! Neat.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#44

Post by [deleted] »

nikcub wrote: post #22

When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell). The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done. for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission bo…

[deleted]

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#45

Post by jmitcheson »

You're being a bit disingenuous by not mentioning the inbuilt protections that the HTML5 Fullscreen API offers.

"Also, any alphanumeric keyboard input while in full-screen mode causes a warning message to appear; this is done to help guard against phishing attacks. The following keys are the only ones that don't cause this warning message to appear (...)"

(https://developer.mozilla.org/en-US/docs/DOM/Using_full-scre...)

The article and demo are nice though. Good work.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#46

Post by skeletonjelly »

AngryParsley wrote: post #10

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…

By presentation mode you mean fullscreen (F11)? I had a quick search and couldn't find anything conclusive. It's an OSX specific thing?

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#47

Post by skeletonjelly »

Zancarius wrote: post #16
yati wrote: post #5

Great job! But originally, I opened that link in a new tab while I was still reading the article. It obviously did not work :P I've this habit of opening most links in a new tab!

Same here. I have an addiction to opening everything remotely interesting in a new tab, and my initial reaction was "I don't think this worked?" Otherwise, it's pretty frightening, because I can imagine that in spite of the browser warnings, there are many non-savvy users who probably wouldn't give it a second thought. As a KDE user, the blatant Gnome UI was kind of glaring but otherwise well done. ;)

I did the same (new tab) and thought "oohh it looks and reacts just like the real thing!". Had to read a bit more to see what I was meant to do.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#50

Post by SoftwareMaven »

andrewfelix wrote: post #4

The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed. This is not a rhetorical question; do you think people would ignore the warning and continue to use the site? An easier phishing technique would be to manipulate the address to appear legitimate us…

do you think people would ignore the warning and continue to use the site?

Absolutely. My eyes were opened to that when I was troubleshooting my father's webcam over the phone. It kept not working when everything looked like it should. He just failed to let me know about the alert that kept popping up that said "camera is locked by ". Instead, without reading, he just hit the "X", even though I was asking for every step he was performing. Closing a rogue alert isn't even a "step" to most people.

If you are relying on dialogs to keep your users safe, you are doing it wrong. Unfortunately, I don't know what the right answer here is.

Post reply on HN