Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Progressive Web Apps (PWAs) Phishing

mrd0x.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: Progressive Web Apps (PWAs) Phishing

#31

Post by doakes »

ajross wrote: post #17
felipc wrote: post #15

Earlier quoted context omitted.

Nope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with…

> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of s…

I don't understand the answers to your "what is a legitimate website with a malicious owner" question, but I kinda see this as the same concern as downloading a phone app that requests an OAuth login via a native webview. You can't always see the true URL of that login page. But it comes back to what I think is your main point -- you've already downloaded something malicious from the get-go. But I guess there's some damage control if you can spot a fake login page and remove the install.

Re: Progressive Web Apps (PWAs) Phishing

#32

Post by strictnein »

oneepic wrote: post #29
ajross wrote: post #12

Earlier quoted context omitted.

No it doesn't. You need to fool the user into installing an app that loads from your own domain. Now that obviously isn't impossible, but it requires getting the user to ignore or be mislead by the clearly-displayed URL in the web page and/or installer UI. As the commenter upthread conjectured, this is indeed perfectly isomorphic to fooling a user into loading and interacting with a faked web page. That's a real thre…

I'm not a security pro, but the claim about "spun clickbait" doesn't hold for me. I thought it was new to me, and an attack possibility that I hadn't considered before reading. I do think I "validate" sites pretty well before doing any serious things there (logins, transactions, etc).

You're correct that it's not clickbait. This author is a known security researcher who specializes in this type of thing. It's just another type of attack that they've writing about.

Re: Progressive Web Apps (PWAs) Phishing

#33

Post by strictnein »

ajross wrote: post #12
codetrotter wrote: post #5

Earlier quoted context omitted.

Because this one makes it look like there’s a url bar with a Microsoft domain

No it doesn't. You need to fool the user into installing an app that loads from your own domain. Now that obviously isn't impossible, but it requires getting the user to ignore or be mislead by the clearly-displayed URL in the web page and/or installer UI. As the commenter upthread conjectured, this is indeed perfectly isomorphic to fooling a user into loading and interacting with a faked web page. That's a real thre…

> But it's clearly not a new threat with PWAs and IMHO this article is mostly just spun clickbait. This isn't remotely a novel vulnerability.

This isn't "clickbait". This author is a known security researcher. The word "new" or "novel" doesn't occur in the writeup. They are simply documenting how something works.

They've been writing about this type of thing for years now.

Re: Progressive Web Apps (PWAs) Phishing

#34

Post by koolala »

ajross wrote: post #17
felipc wrote: post #15

Earlier quoted context omitted.

Nope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with…

> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of s…

i like your reasoning

Re: Progressive Web Apps (PWAs) Phishing

#35

Post by paulddraper »

kristiandupont wrote: post #3
difosfor wrote: post #2

I think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..

I guess the argument would be that a screened app store would block such a malicious app. But since the trick requires the user to go to a malicious website to install this app, it seems to me that the user might similarly be tricked into entering credentials on that website.

No, the malicious website would have a "Sign in with Facebook".

You would enter your credentials on something that (according to a url bar) is Facebook.com

Re: Progressive Web Apps (PWAs) Phishing

#36

Post by johnnypangs »

paulryanrogers wrote: post #30
josephcsible wrote: post #11

Earlier quoted context omitted.

Being a PWA lets you hide the real URL bar.

How could this be stopped? Blocking images or rendering that mimics a real URL bar would be challenging. Perhaps the PWA forces an overlay of the real apex domain at the top or in a top corner?

I think that it’s pretty hard to stop with the current state of PWA installation.

You could try the manifest data, (the data for the PWA app) tied more to the html and dns. Making it harder to impersonate other sites.

You could also go a more extreme route and have something like PWA app signing like other kinds of apps.

Re: Progressive Web Apps (PWAs) Phishing

#37

Post by arendtio »

toddmorey wrote: post #21

What makes this PWA specific rather than just “installable software”?

PWAs are generally considered safe to install because they are just a website (running in a sandbox) plus some fancy desktop integration. Normal software you install doesn't run in a sandbox and has much more capabilities.

However, as with every phishing attack, the user must ignore small (security related) hints.

Re: Progressive Web Apps (PWAs) Phishing

#38

Post by amadeuspagel »

paulryanrogers wrote: post #30
josephcsible wrote: post #11

Earlier quoted context omitted.

Being a PWA lets you hide the real URL bar.

How could this be stopped? Blocking images or rendering that mimics a real URL bar would be challenging. Perhaps the PWA forces an overlay of the real apex domain at the top or in a top corner?

When installing a PWA, check whether URL and title match and warn the the user otherwise.

For most PWAs, the title is simply the apex domain without the TLD with some kind of capitalization. There are a few slightly more complex cases, such as Google Maps (google.com/maps) and YouTube Music (music.youtube.com). Even in these cases, there is an obvious relationship between URL and title.

Re: Progressive Web Apps (PWAs) Phishing

#39

Post by RcouF1uZ4gsC »

I don’t things is much worse than OAuth itself. You just have to make a login with Google/Facebook/X button.

Also the thing about the URL won’t have much practical difference for the user. The reason is that a lot of the flows can redirect through different domains. For example, when I sign in with Google into a third party site, I often see a redirect through the YouTube domain.

So users are not expecting full fidelity to the domain.

Post reply on HN