What makes this PWA specific rather than just “installable software”?
Progressive Web Apps (PWAs) Phishing
21–30 of 44 posts
Re: Progressive Web Apps (PWAs) Phishing
#22That's indeed a tricky one. Even tho I work with PWAs I could see myself being misled by this with a github credential. Good remind to only connect third party services with access tokens.
Many applications will obtain such a token through an OAuth flow of some kind.
Using a browser-integrated password manager or passkey will usually prevent this attack, though.
Re: Progressive Web Apps (PWAs) Phishing
#23What makes this PWA specific rather than just “installable software”?
Ah, I’m thinking Windows maybe requires less permission to install a PWA?
Re: Progressive Web Apps (PWAs) Phishing
#24Earlier quoted context omitted.
Nope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with…
> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of s…
> What... does that mean?
microsoft.com is legitimate website. The owner of microsoft.com however get your browsing history, reboot your PC during weekends when your rendering is almost complete, put random adware on your PC without asking you, injects adware into various websites, i'm too lazy to list all the rest but you get the picture. Legitimate website with a malicious owner.
Re: Progressive Web Apps (PWAs) Phishing
#25This reminds me OAuth screens where you are not sure why your password manager doesn’t work…
Re: Progressive Web Apps (PWAs) Phishing
#26What makes this PWA specific rather than just “installable software”?
Ah, I’m thinking Windows maybe requires less permission to install a PWA?
It's "installed" through the browser, and it runs in the browser. So a PWA is just a browser app that maybe runs in a window with no browser chrome so it feels more native.
Re: Progressive Web Apps (PWAs) Phishing
#27Earlier quoted context omitted.
Nope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with…
> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of s…
>legitimate website with a malicious owner.
The situation is this: You go to some web store. You click "Sign In With Microsoft" (or Google, or Facebook, etc.). You expect the site to be able to know your Microsoft/Google/Facebook email address. You don't expect the site to be able to take over your entire Microsoft/Google/Facebook account.
So it's a site you trust enough to use, but you don't trust it enough to give it control over your other accounts. This phishing attack gives it control over your other accounts.
Re: Progressive Web Apps (PWAs) Phishing
#28That's indeed a tricky one. Even tho I work with PWAs I could see myself being misled by this with a github credential. Good remind to only connect third party services with access tokens.
Many applications will obtain such a token through an OAuth flow of some kind. Using a browser-integrated password manager or passkey will usually prevent this attack, though.
Nah, it won't because it happens all the time that my password manager doesn't recognize the current url because the auth signin flow had so many weird urls in it that I had to save the url manually and now it's not the right url so I copy out the password manually instead of autofilling it. This was actually the case for my Google account which I created through gmail but then my gmail password wasn't using the right url for all the other google services. Now that I think about it, this was also the case for my Microsoft account that I got a long time ago through hotmail.
I think that this is a fairly legitimate attack vector and it's sad because I really want to be able to hide the url bar in my PWAs through custom styling to make it look more like a real native app.
Re: Progressive Web Apps (PWAs) Phishing
#29Earlier quoted context omitted.
Because this one makes it look like there’s a url bar with a Microsoft domain
No it doesn't. You need to fool the user into installing an app that loads from your own domain. Now that obviously isn't impossible, but it requires getting the user to ignore or be mislead by the clearly-displayed URL in the web page and/or installer UI. As the commenter upthread conjectured, this is indeed perfectly isomorphic to fooling a user into loading and interacting with a faked web page. That's a real thre…
I'm not a security pro, but the claim about "spun clickbait" doesn't hold for me. I thought it was new to me, and an attack possibility that I hadn't considered before reading. I do think I "validate" sites pretty well before doing any serious things there (logins, transactions, etc).
Re: Progressive Web Apps (PWAs) Phishing
#30What's the difference between this and just having a button on your website that redirects to a spoof microsoft login page?
Being a PWA lets you hide the real URL bar.
How could this be stopped? Blocking images or rendering that mimics a real URL bar would be challenging.
Perhaps the PWA forces an overlay of the real apex domain at the top or in a top corner?