The inception bar: a new phishing method

#1

Post by jamesfisher » Sat, Apr 27, 2019, 10:39 PM UTC

The inception bar: a new phishing method
jameshfisher.com

Re: The inception bar: a new phishing method

#2

Post by todipa » Sat, Apr 27, 2019, 10:50 PM UTC

Wow, didn't even think it was possible to do this.

Re: The inception bar: a new phishing method

#3

Post by doctorless » Sat, Apr 27, 2019, 11:29 PM UTC

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Re: The inception bar: a new phishing method

#4

Post by vegizombie » Sat, Apr 27, 2019, 11:31 PM UTC

doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Firefox for android keeps the bar there too.

Re: The inception bar: a new phishing method

#5

Post by clusmore » Sat, Apr 27, 2019, 11:39 PM UTC

vegizombie wrote: post #4

doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Firefox for android keeps the bar there too.

Just to be clear, you're referring to real Firefox address bar (pointing to TFA), not the fake Chrome address bar (pointing to hsbc.com). So yes, in this case Firefox has (accidentally?) somewhat thwarted this attack vector.

Re: The inception bar: a new phishing method

#6

Post by jamesfisher » Sat, Apr 27, 2019, 11:41 PM UTC

vegizombie wrote: post #4

doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Firefox for android keeps the bar there too.

Interesting! So it does. However Firefox does hide the URL bar on other pages! I'll try to figure out what the logic is in Firefox, and whether there's an equivalent trick to hide the URL bar ...

Re: The inception bar: a new phishing method

#7

Post by Nextgrid » Sat, Apr 27, 2019, 11:46 PM UTC

Re: The inception bar: a new phishing method

#8

Post by gruez » Sat, Apr 27, 2019, 11:47 PM UTC

doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Also the scrolling feels "weird". Kinda like when you're on an amp page (although I think they fixed that now).

Re: The inception bar: a new phishing method

#9

Post by carroccio » Sat, Apr 27, 2019, 11:49 PM UTC

There is previous work on the matter: A fake Firefox XUL browser if I recall correctly (UI readdressing).

This attack is for sure nice and effective!

Re: The inception bar: a new phishing method

#10

Post by tty2300 » Sat, Apr 27, 2019, 11:52 PM UTC

clusmore wrote: post #5

vegizombie wrote: post #4

Earlier quoted context omitted.

Firefox for android keeps the bar there too.

Just to be clear, you're referring to real Firefox address bar (pointing to TFA), not the fake Chrome address bar (pointing to hsbc.com). So yes, in this case Firefox has (accidentally?) somewhat thwarted this attack vector.

It certainly looks accidental. It hides on scroll on other pages but this one causes it to half hide and then it pops back up again.