Shmoo Group Finds Exploit For non-IE Browsers

shut_up_man writes "Saw this on Boing Boing: East coast hacker con Shmoocon ended today and they had a nasty browser exploit to show off... using International Domain Name (IDN) character support to display fake domain names in links and the address bar. Their examples use Paypal (with SSL too) and this looks very useful for phishing attacks. Interesting note that it works in every browser *except* IE (which makes this exploit a lot less dangerous in the end, I suppose)."v The reason IE isn't vulnerable is because it doesn't natively support IDN; with the right plug-in, it too is vulnerable.

Comments

Why?

[sammykrupa]

Are they telling every man and his dog by letting tihs get on /.? If they had just released some patches for Firefox and written up some help files for people this would not mean much.

Re:Stop obsessing over Microsoft, please.

[ScrewMaster]

You work for Billy, don't you.

Re:Your Microsoft Obsession

[AtariAmarok]

It is pretty clear that it meets your definition of "propaganda" because you did not like what they said.