Safari vulnerability in iOS 5.1 allows URL spoofing
appleinsider.com
Safari vulnerability in iOS 5.1 allows URL spoofing
1–7 of 7 posts
Re: Safari vulnerability in iOS 5.1 allows URL spoofing
#2Since you're opening a new window from another domain and writing arbitrary HTML into it, I wonder if this vulnerability could be used to bypass cross-domain restrictions...
Re: Safari vulnerability in iOS 5.1 allows URL spoofing
#3Since you're opening a new window from another domain and writing arbitrary HTML into it, I wonder if this vulnerability could be used to bypass cross-domain restrictions...
I've written an alternative iOS browser myself, and my guess is this bug is due to the Safari UI misinterpreting the network events that get fired when pages and frames are loaded.
Wrapping UIWebView makes it really hard to distinguish between page loads and iframe loads to figure out which URL is currently displayed. While Safari uses lower-level interfaces, I'd guess this is happening at a higher-level than webkit, so cross-domain restrictions should still be in place.
Re: Safari vulnerability in iOS 5.1 allows URL spoofing
#4Since you're opening a new window from another domain and writing arbitrary HTML into it, I wonder if this vulnerability could be used to bypass cross-domain restrictions...
Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.
Re: Safari vulnerability in iOS 5.1 allows URL spoofing
#5Since you're opening a new window from another domain and writing arbitrary HTML into it, I wonder if this vulnerability could be used to bypass cross-domain restrictions...
Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.
But, my-hacker-site.com could, instead of including an iframe to my-banking-site.com, simply do a server-side proxy of your bank and execute a pretty effective phishing attack.
The advice I've seen re:phishing is usually to check the URL. That doesn't help here.
Re: Safari vulnerability in iOS 5.1 allows URL spoofing
#6Since you're opening a new window from another domain and writing arbitrary HTML into it, I wonder if this vulnerability could be used to bypass cross-domain restrictions...
Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.
[deleted]
Re: Safari vulnerability in iOS 5.1 allows URL spoofing
#7Earlier quoted context omitted.
Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.
But, my-hacker-site.com could, instead of including an iframe to my-banking-site.com, simply do a server-side proxy of your bank and execute a pretty effective phishing attack. The advice I've seen re:phishing is usually to check the URL. That doesn't help here.
Check the URL is not a solid advice, there are many ways to trick you (e.g. google.com vs goog1e.com). Enter the URL yourself is a better one.