Posted on 05/25/2010 12:19:17 PM PDT by Gomez
Traditional phishing attacks are reasonably easy to avoid, just don’t click links in suspicious e-mails (or, for the really paranoid, any e-mail). But Firefox Creative Lead Aza Raskin has found a far more devious way to launch an attack — by hijacking your unattended browser tabs.
The attack works by first detecting that the tab the page is in does not have focus. Then the attacking script can change the tab favicon and title before loading a new site, say a fake version of Gmail, in the background.
Even scarier, the attack can parse through your history to find sites you actually visit and impersonate them.
For example, using Raskin’s method an attacker can hijack your page, detect that you frequently login to Citibank’s website and impersonate that site, complete with a message about automatically ending your session and asking you to login again.
Because most of us trust our tabs to remain on the page we left them on, this is a particularly difficult attack to detect. As Raskin writes, “as the user scans their many open tabs, the favicon and title act as a strong visual cue — memory is mailable and moldable and the user will most likely simply think they left [the] tab open.”
The only clue that you’re being tricked is that the URL will be wrong.
Raskin has set up a demonstration on his blog post. Visit the page, switch to another tab and then notice that Raskin’s site will reload to look like the Gmail interface (Raskin uses an image for the demo, obviously easy to detect, but a real attack would offer a login page just like Gmail).
In my testing the attack worked in Firefox 3.6, 3.7a, Opera 10 and Safari 4. It did not work in Google Chrome on OS X when the tab was in the background, though it did work when I switched from Chrome to another application. Also, some browsers don’t change the favicon, though it’s possible that they could with a little tinkering to Raskin’s script.
So how do you stop this attack? Well, Raskin points out that Firefox’s coming Account Manager — which delegates tasks like logging in to the browser — is one possible fix, since it always looks at the URL, even if you don’t. Similar tools like 1Password would also work, provided you use them every time you login to a website.
The other fix is on the developer side, just make sure your site doesn’t load any remote scripts. Even if you trust the site your script is loading from, it’s possible that site could be compromised.
In the mean time, up your paranoia level and start paying attention to the URL bar.
ping
Yikes. I am very heavy in the security world these days. This is pretty interesting.
This is definitely not cool. I know Firefox for version 4 is slated to have a way to hide the history, but its not been said how they will address it.
From what I’ve heard, browsers are designed for allowing access to this history. There’s even a website that can show you a number of places you’ve visited just by displaying their page. It is either through the history or through deciphering the cookies.
As I’ve said many times, “It will be amusing with the hacker scum discover that Firefox and other ‘Not Microsoft’ browsers are as fun to hack since they are as or more open than IE now.” This is a case where by trying to kill IE, they might be making it into the most secure as it has to defend the most.
Seeing more browser hijack threats and more indications that Firefox is just as vulnerable as IE.
My understanding is this: a page will display visited links in different colors. The javascript can then query the color of any given text element. Hence, you can create a hidden page (iframe) that can check to see if you've visited specific web addresses.
This is something that should be of great concern to all FReepers - it is very easy for, say, a government website to check if you've been to http://www.freerepublic.com! (If that link is discolored - which it certainly should be for this crew - then javascript can detect you've been visiting it....)
But isn’t it the browser that is the only thing determining the color? In this case, I believe it is only the browser doing it. There’s no reason for a browser to SEND all of our history to others to simply change a color on only our screen.
I think other history-related issues are at play with this thread and not the hyperlink color thing you mention. Sorry.
That differing javascript code execution is how the data gets sent back to the server - for example, by trying to load a graphic with a coded file name. Apache will both return the graphic image, but also note that the coded filename was accessed, and by a certain IP address - and, if that spying webpage had a login, by what login account.
Wow! That’s pretty wicked!
Thanks for the heads up!
Frack! I’m about ready to go back to Netscape 1.0, text-only ;-)
Can you post the name of that site?
Odd error found; “ memory is mailable and moldable “; probably should be ‘malleable,’ but since this doesn’t affect the story and outcome, who cares.
All in all, Firefox today, with a good set of extensions, is the most privacy-protecting browser on the market. Extensions that you must have are: NoScript, Adblock Plus, Ghostery, OptimizeGoogle. Keep your IE or Chrome for script-heavy trusted sites, but do most of your casual browsing in FF. You'd be amazed to see how many spy and ad sites it blocks.
I keep history for one day and keep cookies turned off with a few exceptions. See any problem with that?
This article references that and other sites:
http://www.theregister.co.uk/2010/05/20/browser_history_attack/
Your solutions don't block scripts, and those scripts can do whatever they want to in your browser (such as execute the attack that the article describes.) Web bugs are also not affected, and they report your page visit to whoever planted the bug.
I tested the exploit in my FF, and the exploit doesn't work at all. This is because NoScript blocked the Javascript on his site by default, and that's how it should be. Most sites don't need Javascript, and if it's there it's only to spy on you and to show you the ads. Some sites use Javascript for menus, and most shopping carts use Javascript to validate your input. Those should be allowed. Or I use IE for purchases.
Thanks,,, java script is now off... lets see if it adversely affects my surfing..
A lot easier to just use konqueror.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.