Paul Sturgess
Beware the tabnapper
There’s a new kind of phishing attack around that’s ready to dupe unsuspecting web users into handing over their precious login credentials.
Firefox Creative Lead Aza Raskin has identified an attack that works first by detecting the tab that the attack is in does not have focus and has been left unused for some time.
Whilst you’re browsing elsewhere the script then makes an update to the page content to imitate a login page, such as gmail, and updates the tabs’ title and favicon.
It could even look through your browser history to ensure it’s replicating a login screen you regularly visit.
The key thing at this point is the url will not have changed, however, the attack preys on the perceived immutability of tabs. It’s not inconceivable that you would come back to the fake gmail page and just assume your session timed out.
After the user has entered the login details and they’ve been captured, they can redirected to the real Gmail page. As the user wasn’t logged out in the first place they’ll be none the wiser.
Aza Raskin demonstrates how the attack could work in this video…
A New Type of Phishing Attack from Aza Raskin on Vimeo.
Tweet