Devious New Phishing Tactic Targets Tabs

[Corrine]

Consider the following scenario: Bob has six or seven tabs open, and one of the sites he has open (but not the tab currently being viewed) contains a script that waits for a few minutes or hours, and then the script quietly changes the both the content of the page and the icon and descriptor in the tab itself so that it appears to be the login page for Gmail.

In this attack, the phisher need not even change the Web address displayed in the browser’s navigation toolbar. Rather, this particular phishing attack takes advantage of user trust and inattention to detail, or what Raskin calls “the perceived immutability of tabs.” Then, as the user scans their many open tabs, the favicon and title act as a strong visual cue, and the user will most likely simply think they left a Gmail tab open.

“When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in. The attack prays on the perceived immutability of tabs,” Raskin explained. “After the user has enter they have entered their login information and sent it back your your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.”

See the complete article by Brian Krebs at Devious New Phishing Tactic Targets Tabs — Krebs on Security

 

[malexous]

Something that might have even tricked me. Thanks for the heads up.

 

[smsff7]

Good thing I use outlook. So I know whats up if this were to ever happen to me

 

[kucing13]

I rarely use gmail. Unless there's a fake Yahoo mail.. I'm gonna be cautious

 

[Thorsen]

I rarely use gmail. Unless there's a fake Yahoo mail.. I'm gonna be cautious

Quote from link: "It’s important to keep in mind that this attack could be used against any site, not just Gmail. "

Edit: reiteration: This could be any site...not just email....

I would be cautious.... Although the javascript is ran from the attack-site so you would need to be surfing in dangerous waters first. Just be on Gaurd or change surfing habits to close pages and re-open from bookmarks whenever logging in.


Thanks Corrine for info!

 

[kucing13]

I guess i've missed that.. Thanks for the heads up thorsen

 

[wee]

This is a classic social engineering trick, you have to be aware of this. If you had a open tab that was logged into whatever and it suddenly shows you to be logged out that should be a big red flag. using explorer is less protection as well you need a flash blocker for the best safety, and FF provides some of the best addons for overall safety, if set up correctly.