Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

91–100 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#91

Post by ricardobeat »

jpxxx wrote: post #38
jpxxx wrote: post #18

Earlier quoted context omitted.

Fake and malicious URLS can be filtered against and intercepted. This trick dodges those systems... but it still requires a malicious 'source' page to serve it up. Hrm. I imagine all of the payload (save for the return trip) could be put into innocent looking client-side Javascript, but that doesn't get around the fact that someone's still got to serve the JS...

Yeah, that's all I've got. The only scenario protecting the unsophisticated here is that the malicious javascript (presumably) has to be delivered from some domain, and domain filtering is in full effect almost everywhere. This API means that if a malicious JS can be executed, it's game over for a number of defenses that only communicate visually.

The domain where this is hosted would get added to the blacklist pretty quickly too.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#92

Post by EGreg »

I once sent a letter to Steve Jobs saying that the MacOS (and other operating systems) were susceptible to phishing by applications, which would simply present a dialog that looks very much like the System Security dialog, and thereby gain the user's root password.

The solution is to have an area where only the operating system can draw (and which cannot be screen-captured, the same way Apple currently does with DRM movies). In this area, the system would present to the user a phrase which the user selected when setting up their account. This would prevent phishing, as users would be trained to look for the phrase (and / or icon ... the reason you can't have an icon alone is because the phisher could get it right 1 out of N times).

Now, on the web there is a similar thing you can do! When someone places KEYBOARD FOCUS in your password box, and starts typing the correct password, you display the icon + phrase that you previously selected when setting up your account. If the phrase doesn't pop up or is different, you know you're being phished.

THIS is a great way to stop phishing on the web. Anyone impersonating you will not know what phrase to display. Only by starting to type the correct pass phrase will they get this information. On the other hand, they won't be able to place anything fake over the password input box and capture your input, because the phrase only appears when you type IN the password input box, which the attacker can't get to, thanks to the cross-domain security in browsers!

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#93

Post by ben0x539 »

damncabbage wrote: post #12

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

This was really annoying for me because somehow the google redirect link took a lot longer to load than the ultimate destination would, or even regular google pages.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#94

Post by nikcub »

tymekpavel wrote: post #76
wtallis wrote: post #51

Earlier quoted context omitted.

NoScript already inherently blocks this, and even if you allow the domain that provides the script that tries to go full-screen, and allow the full-screen transition, the web page pretending to be a desktop doesn't cover the NoScript toolbar that's still prompting for permissions on the other domains. I suspect the anti-clickjacking measures would kick in if the phishing site tried to incorporate the real site as a b…

I don't think the average user knows what NoScript is.

This is why I want to fork Chrome and create a secure and privacy-aware browser.

* Take out everything Google-related, including safebrowsing

* Rip out Flash and Java

* Integrate NoScript

* Integrate an alternate html5/canvas based video player

* Integrate third-party request blocking

* No cookies by default

* Strip out all the tracking id's in URLs (eg. Google search results pages, back to just plain old ?s=search+query)

* Automatically clear cookies such as the __ut* cookies from analytics

* Incognito by default

* Introduce a concept of 'installing' trusted sites that would be allowed to run scripts, etc. not too dissimilar to how desktop computing works

I have had this idea for over a year now, but haven't gone far in implementing it other than doing a test build of chromium with incognito by default and some default extensions.

It came about because my dad and other family members have each had spyware or rootkits installed on their machines. 99.99% of drive-by exploits can be stopped by simply not running IE and switching off Flash and Java.

It would be a browser where you don't have to explain everything, just marketed/renown as being a browser focused on privacy and security features for everyday users.

When I get a chance, I am contemplating putting a team together and forking this as an open source project. If such a project is of interest to anybody else, get in touch (via email in profile).

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#95

Post by robmcm »

skeletonjelly wrote: post #48
amadeus wrote: post #36

[firstWorldProtection]Not rMBP optimized. Was painfully obvious to spot[/firstWorldProtection]

Funnily enough Safari is the only browser that doesn't alert the user about fullscreen mode. http://imgur.com/a/jdcI7 (via cfinke)

and even Adobe managed to add warnings to the flash player... Silly Apple

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#96

Post by adrinavarro »

nikcub wrote: post #94
tymekpavel wrote: post #76

Earlier quoted context omitted.

I don't think the average user knows what NoScript is.

This is why I want to fork Chrome and create a secure and privacy-aware browser. * Take out everything Google-related, including safebrowsing * Rip out Flash and Java * Integrate NoScript * Integrate an alternate html5/canvas based video player * Integrate third-party request blocking * No cookies by default * Strip out all the tracking id's in URLs (eg. Google search results pages, back to just plain old ?s=search+q…

Cookies and JS off by default?

Maybe we don't live in the same world.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#97

Post by nikcub »

adrinavarro wrote: post #96
nikcub wrote: post #94

Earlier quoted context omitted.

This is why I want to fork Chrome and create a secure and privacy-aware browser. * Take out everything Google-related, including safebrowsing * Rip out Flash and Java * Integrate NoScript * Integrate an alternate html5/canvas based video player * Integrate third-party request blocking * No cookies by default * Strip out all the tracking id's in URLs (eg. Google search results pages, back to just plain old ?s=search+q…

Cookies and JS off by default? Maybe we don't live in the same world.

third-party cookies

the idea is that you have a button next to the URL to install it, from where it just runs as normal (albeit still without third-party cookies, as with fb buttons)

it could also do something smart with the type of javascript being executed. for eg. the concern with javascript is dyn generating forms or iframes and auto-submitting. etc. something that you can't do with extensions but you can do with a separate browser.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#98

Post by morsch »

peterhunt wrote: post #57
feross wrote: post #42

Earlier quoted context omitted.

Safari has no warning or message at all. Just a quick, half-second animation and that's it.

Safari disallows keyboard input in fullscreen mode.

Dear customer, in order to improve the security of your account we have implemented a new on-screen keyboard. Please use the mouse to enter your account number and PIN in order to access online banking.

The fact that this is a real technology being deployed right now doesn't hurt.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#99

Post by ygra »

jeswin wrote: post #11

The concept is clever, and very interesting. However, most users (even experienced users) don't look at the url when visiting information-sensitive websites and www.bankofamerica.fsh4.com would still not alarm them. They don't understand the SSL icon either.

There was an interesting research a few years ago regarding the SSL icon. Since in many users the idea is actually finely-ingrained that a padlock means security on a website they just made the favicon into a lock. A surprisingly large number of users was fooled by that.

I guess the "padlock means secure" has been superceded a little by "address bar is green somewhere" by now, but the problem remains the same.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#100

Post by pbhjpbhj »

EGreg wrote: post #92

I once sent a letter to Steve Jobs saying that the MacOS (and other operating systems) were susceptible to phishing by applications, which would simply present a dialog that looks very much like the System Security dialog, and thereby gain the user's root password. The solution is to have an area where only the operating system can draw (and which cannot be screen-captured, the same way Apple currently does with DRM…

Yahoo do something like this, they display a per user image on the login, presumably using cookies?
Post reply on HN