A clickjacking vulnerability in WhatsApp that enables phishing attacks
1–10 of 84 posts
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#2Using a unicode character to reverse order of characters and create links that have “trusted” value like: ln.instagram.com//:sptth. Neat and indeed something that could be well exploited.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#3Really interesting approach to use right to left override in that way, that's very clever.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#4Interesting ideas and vulnerability! With a nice and concise summary. Thanks for sharing
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#5I remember this already existed on Windows Explorer 2 decades ago, it's funny to see it "rediscovered".
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#6It's disappointing that Meta chose not to fix this and chose not to reward this researcher with a bug bounty.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#7Nice hack. The real problem is not WhatsApp or the Unicode reverse character, though, it’s that URLs are hard.
Just this simple visa.securesite.com fools a lot of people. And I don’t see a good solution in the near future.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#8[deleted]
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#9I remember this already existed on Windows Explorer 2 decades ago, it's funny to see it "rediscovered".
The attack still works and it is less obvious than you might expect. For context, an SCR file is a regular executable, treated the same as a .EXE or .COM.
From https://attack.mitre.org/techniques/T1036/002/:
> RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named `March 25 \u202Excod.scr` will display as `March 25 rcs.docx`. A JavaScript file named `photo_high_re\u202Egnp.js` will be displayed as `photo_high_resj.png`
I think the examples are pretty scary if you ask me, but most anti-virus software do warn you when they come across those types of files.
Re: A clickjacking vulnerability in WhatsApp that enables phishing attacks
#10[deleted]