Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using the HTML5 Fullscreen API for Phishing Attacks

feross.org

Post reply on HN
Print view View original

101–110 of 133 posts

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#101

Post by ygra »

SoftwareMaven wrote: post #50
andrewfelix wrote: post #4

The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed. This is not a rhetorical question; do you think people would ignore the warning and continue to use the site? An easier phishing technique would be to manipulate the address to appear legitimate us…

do you think people would ignore the warning and continue to use the site? Absolutely. My eyes were opened to that when I was troubleshooting my father's webcam over the phone. It kept not working when everything looked like it should. He just failed to let me know about the alert that kept popping up that said "camera is locked by ". Instead, without reading, he just hit the "X", even though I was asking for every s…

Indeed. Since message boxes and confirmations are used so frequently and often unnecessary users have trained themselves to just click on the far left or far right button to get rid of it. They don't read it, they don't want to understand what happened, it just interrrupted their flow and they want it to be gone. Pushing decisions to the user in form of confirmations won't ever really work probably due to a Pavlovian urge to close such things as fast as possible.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#102

Post by jrabone »

For login screens, this is the problem that the Secure Attention Key (http://en.wikipedia.org/wiki/Secure_attention_key) was intended to solve.

IMO this is why the constant pushing of the browser as a platform is more trouble than it's worth. Everything that your OS does now will be re-invented (badly, several times) in one or more of the different web-browsers, lost, found, queried in triplicate, standardised before finally being recycled as firelighter when the next "paradigm shift" takes over.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#103

Post by ygra »

feross wrote: post #20
chaud wrote: post #15

Earlier quoted context omitted.

If that is the case, how is it a significantly worse problem than a regular link to a fake site?

Good question. The key difference is that using the Fullscreen API let's you fake the "green location bar" which, thanks to hundreds of PSAs from the tech community over the years, has become synonymous with "this site is safe and secure".

The problem is that for many years the browser's chrome/UI was in fact a place not hijackable by web sites. In contrast to things that appear within the normal client area as the often-spoofed yellowish notification bar of old Internet Explorer versions (the newer one at the bottom now sees this as well). I think Firefox opted for a very deliberate design in security-critical cases that will always appear from within the chrome and never overlay the page in a way that could be spoofed by clever CSS.

Of course, now with pages requesting to go fullscreen there isn't a browser UI anymore that could show things that cannot normally appear in the page content. Hitting F11 previously at least was something no web page could ever do by itself. On the other hand, having to wade through warnings like Firefox' SSL warnings probably scares away users from fullscreen games and developers from using the feature.

I wouldn't really have an answer to anything of that. I don't even know whether I embedded a question, I think it was just rambling :-)

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#104

Post by EGreg »

pbhjpbhj wrote: post #100
EGreg wrote: post #92

I once sent a letter to Steve Jobs saying that the MacOS (and other operating systems) were susceptible to phishing by applications, which would simply present a dialog that looks very much like the System Security dialog, and thereby gain the user's root password. The solution is to have an area where only the operating system can draw (and which cannot be screen-captured, the same way Apple currently does with DRM…

Yahoo do something like this, they display a per user image on the login, presumably using cookies?

The only thing is, if you don't wait until the user starts entering the password, the attacker can theoretically scrape the page with your username and find out the per-user image.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#105

Post by icebraining »

nikcub wrote: post #97
adrinavarro wrote: post #96

Earlier quoted context omitted.

Cookies and JS off by default? Maybe we don't live in the same world.

third-party cookies the idea is that you have a button next to the URL to install it, from where it just runs as normal (albeit still without third-party cookies, as with fb buttons) it could also do something smart with the type of javascript being executed. for eg. the concern with javascript is dyn generating forms or iframes and auto-submitting. etc. something that you can't do with extensions but you can do with…

Firefox extensions can certainly do that. For example NoScript has IFrame blocking built-in, it's just disabled by default. More importantly, its ClearClick feature prevents clickjacking even with IFrames enabled.

You're right that Chrome extensions can't do that, though.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#106

Post by hatu »

borlak wrote: post #37

A similar issue was shown when Adobe Flash fullscreen was first introduced (I think it was just Macromedia at the time, but anyway). When you went to fullscreen in flash, it printed a giant "you are now in fullscreen mode" in the middle of the screen, but somebody showed that simply by printing similar text all over your screen, it hid that warning very well.

Yeah but nowadays you can't use the keyboard while fullscreen in Flash do prevent this type of phishing.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#109

Post by hatu »

wtallis wrote: post #51
AngryParsley wrote: post #10

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists. Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or…

NoScript already inherently blocks this, and even if you allow the domain that provides the script that tries to go full-screen, and allow the full-screen transition, the web page pretending to be a desktop doesn't cover the NoScript toolbar that's still prompting for permissions on the other domains. I suspect the anti-clickjacking measures would kick in if the phishing site tried to incorporate the real site as a b…

Phishing attacks aren't targeting the HN crowd / web programmers.

Re: Using the HTML5 Fullscreen API for Phishing Attacks

#110

Post by chii »

ben0x539 wrote: post #93
damncabbage wrote: post #12

The user can hover their mouse over the link and their status bar will show https://www.bankofamerica.com, as expected. Google search results use a similar technique to show you the "right" link when you hover. (It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

This was really annoying for me because somehow the google redirect link took a lot longer to load than the ultimate destination would, or even regular google pages.

and it also stops copy/paste link via a right click (at least, that didnt work last time i tried)
Post reply on HN