Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

51–60 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#51

Post by wtallis »

AngryParsley wrote: post #10

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…

NoScript already inherently blocks this, and even if you allow the domain that provides the script that tries to go full-screen, and allow the full-screen transition, the web page pretending to be a desktop doesn't cover the NoScript toolbar that's still prompting for permissions on the other domains. I suspect the anti-clickjacking measures would kick in if the phishing site tried to incorporate the real site as a base layer.

NoScript does not seem to have any features targeted directly at HTML5 fullscreen, though.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#52

Post by graue »

shock3naw wrote: post #40
jpxxx wrote: post #31

Earlier quoted context omitted.

The words 'dumb' and 'smart' are inflammatory and useless in this context. A substantial portion of desktop Internet users will click anything that comes up in order to get to their destination. This attack triggers no 'warning' that would cause the user unease. The most obnoxious case is Firefox presenting "Allow or Deny Fullscreen?" a question that doesn't imply any danger or downside. A number of victims might eve…

To corroborate your point, one of the Chromium developers spoke about this sort of problem, but in the context of invalid SSL certificates and the associated warning that Chrome displays. A ridiculous percentage of users ignored the warning that the site they were visiting wasn't verified and simply clicked 'Visit this site anyway.' Most users don't understand that there are potentially serious costs to ignoring secu…

The Firefox "untrusted connection" screen (https://support.mozilla.org/en-US/kb/connection-untrusted-er...) is much better designed.

"Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which again warns you in bold: "Legitimate banks, stores, and other public sites will not ask you to do this." And finally "Confirm Security Exception".

Firefox steers you toward the safe choice and makes you very, very aware of the gravity of the situation before doing something dangerous. That's good UI.

Chrome on the other hand has a "Proceed anyway" button right there that within less than a second you've clicked on and now the warning is gone. Developers who would blame dumb users for this are mistaken. People are busy, they're distracted, and Chrome makes it way too easy to do the wrong thing while Firefox gets this right.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#54

Post by jiggy2011 »

There will always be ways of exploiting things like this.

Perhaps the solution could be to handle this at the network level. In other words create what is effectively a "personal information firewall" built into the browser.

Have the browser detect when certain information is about to be send over the network, it would need to be checked prior to being passed to SSL. Things that fit formats like CC numbers or authorisation codes for banks. There could then be a prompt appear on top of all active windows saying "A CC number is about to be sent to xxx" Allow/Deny.

I suppose this would be difficult because phishers could re-encode data using JS into some other format before it is sent. So you would need some of mapping keyboard inputs to networking events.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#55

Post by jiggy2011 »

SoftwareMaven wrote: post #50
andrewfelix wrote: post #4

The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed. This is not a rhetorical question; do you think people would ignore the warning and continue to use the site? An easier phishing technique would be to manipulate the address to appear legitimate us…

do you think people would ignore the warning and continue to use the site? Absolutely. My eyes were opened to that when I was troubleshooting my father's webcam over the phone. It kept not working when everything looked like it should. He just failed to let me know about the alert that kept popping up that said "camera is locked by ". Instead, without reading, he just hit the "X", even though I was asking for every s…

I worked in tech support for a few years, this stuff is very common when doing things over the phone. "A box popped up saying X" , "OK click on Y" , "Oh , I just clicked on Z", "why did you click on Z?" , "I always click on Z".

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#56

Post by eslaught »

jiggy2011 wrote: post #54

There will always be ways of exploiting things like this. Perhaps the solution could be to handle this at the network level. In other words create what is effectively a "personal information firewall" built into the browser. Have the browser detect when certain information is about to be send over the network, it would need to be checked prior to being passed to SSL. Things that fit formats like CC numbers or authori…

This has been solved with information flow security (see [1]), but the problem is that performance degrades enough that no one actually uses it.

[1]: http://cseweb.ucsd.edu/~lerner/papers/pldi09-sif.pdf

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#57

Post by peterhunt »

feross wrote: post #42
cfinke wrote: post #29

Earlier quoted context omitted.

which Chrome and Safari have done Firefox does it too, and in a much more obvious way than either Chrome or Safari. Here are all the latest browsers on Mac compared: http://imgur.com/a/jdcI7 (Sorry Opera; I haven't re-installed you yet.) I actually didn't get any permissions dialog or warning label in Safari 6; maybe I ok'd it for another site at some point in the past, but I definitely didn't whitelist this domain.

Safari has no warning or message at all. Just a quick, half-second animation and that's it.

Safari disallows keyboard input in fullscreen mode.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#58

Post by shock3naw »

graue wrote: post #52
shock3naw wrote: post #40

Earlier quoted context omitted.

To corroborate your point, one of the Chromium developers spoke about this sort of problem, but in the context of invalid SSL certificates and the associated warning that Chrome displays. A ridiculous percentage of users ignored the warning that the site they were visiting wasn't verified and simply clicked 'Visit this site anyway.' Most users don't understand that there are potentially serious costs to ignoring secu…

The Firefox "untrusted connection" screen ( https://support.mozilla.org/en-US/kb/connection-untrusted-er... ) is much better designed. "Get me out of here!" is the only visible button and the obvious action. To override the SSL check, you have to click "I Understand the Risks" to expand the page, revealing both an "Add Exception..." button and a further warning (in bold). "Add Exception..." brings up a dialog which a…

I agree that Firefox's certificate warning page is much better designed. I'm not blaming 'dumb' users for anything, I was providing supporting evidence of the fact that when browsers make warnings easy to bypass, users will simply click right through them.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#59

Post by AngryParsley »

skeletonjelly wrote: post #46
AngryParsley wrote: post #10

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…

By presentation mode you mean fullscreen (F11)? I had a quick search and couldn't find anything conclusive. It's an OSX specific thing?

I don't have a Windows machine or VM, but it looks like full-screen mode on Linux is the same as presentation mode on OS X: the UI is completely hidden unless you move the mouse to the top of the screen. In addition to presentation mode, Chrome for OS X has a separate full-screen mode that always shows the tabs and buttons.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#60

Post by skeletonjelly »

AngryParsley wrote: post #59
skeletonjelly wrote: post #46

Earlier quoted context omitted.

By presentation mode you mean fullscreen (F11)? I had a quick search and couldn't find anything conclusive. It's an OSX specific thing?

I don't have a Windows machine or VM, but it looks like full-screen mode on Linux is the same as presentation mode on OS X: the UI is completely hidden unless you move the mouse to the top of the screen. In addition to presentation mode, Chrome for OS X has a separate full-screen mode that always shows the tabs and buttons.

Thanks! Looks like Chrome doesn't do this on Windows but it's similar to how Firefox has always done fullscreen.
Post reply on HN