Slashdot Mirror
Tabnapping Scams Around the Corner?
scamdetect pointed us to an interesting bit of news about a new security risk called tabnapping that was recently outlined by Aza Raskin. The short story is that background tabs are updated with login forms impersonating the sites they originally contained, but hosted by helpful third parties primarily interested in your password. (CT:Original writeup removed at request of submitter)
...so are people really dumb enough to go "oh right, my bank's webpage" without realizing they didn't bring it up themselves?
Living With a Nerd
Obviously, this won't subvert SSL certs or anything; but studies consistently demonstrate that users oscillate between "don't know" and "don't care" about those, so that isn't much comfort.
And, since pages reloading themselves, or even forwarding to a different domain and URL entirely, after a delay is fairly common(if generally annoying) in a wide variety of legitimate applications, you can't really just break the ability to do that. Sure, you could add it as an advanced option somewhere, or get it largely for free with the right NoScript settings; but there is no way you can break it by default.
You pretty much just fall back on the phishing filter, which is a lame, AV-esque "solution". This would seem to apply to all tabbed browsers, as well.
You see this, and think "Why didn't someone think about this before?"
Emotions! In your brain!
How do we identify them?
Maybe it is time for the browsers to take matters more seriously and block any scripts from running in tabs that are not currently in focus.
But this can be done in separate windows too, not just in tabs. In terms of whether this is a new concept, let's just say that I have 'seen' this done 10 years ago to gain access to some chat accounts.
You can't handle the truth.
Not exactly. From his page on this "exploit"...
So his "exploit" is to wait until you are away from HIS tab and then alter HIS tab to look like it is a different site.
This attack only works if you allow Javascript by default, instead of only whitelisting sites that you trust.
Some people keep 100s of tabs open. They could come back hours later and see a Gmail login screen and assume they opened it at some point.
First tab-nabbing and now submission-nabbing where the link in the article changes after submission!
----------------------------------- My Other Sig Is Hilarious -----------------------------------
Slashdot is about news, not driving traffic to someone's website.
And 'getting traffic' is not some kind of exchange or reward offered for submitting an article.
If a different link is editorially better, then it is expected that the editors will swap it.
New plan: steal my own identity sloppily under the guise of your identity which I stole perfectly. Now polish my boots!
Even if the scripts are completely disabled on the page, what about a delayed HTTP response, in effect a push to the browser by a server that is done sometime after the page is loaded as a delayed response to the browser request?
It's really hard to avoid all possible scenarios on how a page can be changed from something to something else.
You can't handle the truth.
Regardless of which link is in the story, I still greatly benefit from you having taken the time to write the blog post and submit it to slashdot. Thank you for that.
Oh, you meant benefit to you! What do you think slashdot is? Just a way to generate eyeballs for your personal blog? Screw you for that.
Changing it when you're not looking is done very easily:
;TIMER = setTimeout(changeItUp, 5000);
window.onblur = function(){
}
BTW, this isn't just a FireFox issue, he's only tested it in FireFox. It also works in Safari and IE 7 but didn't take in Chrome 5 (Mac).
I agree it was transparently disrespectful of CmdrTaco to approve your submission, but with someone elses link. However:
1. The linked article predates your linked blog according to the submission timestamps on each blog
2. The linked article contains further links to relevant information, including a link to the original subject's website and a proof-of-concept site.
I understand the euphoric feeling you got when your submission was accepted, and I also understand that sinking sensation you felt when you realized your blog was not linked-to even though your submission was accepted. That being said, repackaged news is repackaged news is repackaged news and I don't think you will find much sympathy around here that your (arguably, less useful) brand of news repackaging won't be netting you ad dollars like you intended.
That's a valid reason for including the link and for being disappointed that it was replaced - isn't it?
Not in my eyes it isn't, and I wish they'd do it more often -- like when the submission has ten ad-laden one-paragraph pages I wish they'd link to a single page view, whether that site or another. Of course you think your blog was better than krebsonsecurity, but personally I almost never click on any link with "blog" in the name, especially from slashdot. They've gotten a lot of (well deserved) flak in the past for linking a blog that links an original story, and I'm glad they're listening.
Be glad that they didn't rewrite the entire summary as they've done with some of my submissions.
A submission is supposed to benefit the slashdot community, not the submitter. Too often people like you make submissions just to drive traffic to their own site for the money.
Shame on you.
Free Martian Whores!
I tried it out and Protected/Froze/Locked the tab and the exploit ran.
I think it's because the full contents were loaded and it didn't actually try to navigate anywhere.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
They've gotten a lot of (well deserved) flak in the past for linking a blog that links an original story, and I'm glad they're listening
They're not listening, the blog post they substituted is still just someone bloviating about the original article and proof of concept.
In action, it's scary in a way that just listening to some blogger yak about it doesn't get the point across, and the author points out how to use the :visited detectors and various hacks to detect if you've logged into a site or not to make it even scarier.
If I have been able to see further than others, it is because I bought a pair of binoculars.
No, tab 1 is still the same site as ever, but the page you visited in tab 34 and forgot about 30 minutes ago suddenly looks like a facebook "you have timed out please log in" page. It's even used javascript to change the title of the tab and the favicon.
Pop Quiz! Were you logged into Facebook on tab 48, tab 18, or tab 42???!?!
All it takes is a bit of javascript inserted into a normal site using cross-site scripting, or an intentionally malicious site in the first place, or an adserver serving up whatever javascript anyone pays them to host. This is why I use NoScript.
The original author (not linked in the submission) points out that you can use the :visited hack to choose a login screen that the user would expect to see. And you can use various other hacks to determine if the user is currently logged into some site or not.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Because you're being a selfish prick.
Because you're being a selfish prick.
I truly value your input. Thank you.
A legitimate purpose like, say, significant development work on a well-known, large-scale open source project, such as Firefox?
All you had to read was the first sentence of the summary...
And it”d be their own damn fault for having such a mess.
Seriously? You need hundreds of tabs? Did you never hear of doing first things first, and freeing your mind from other stuff? Did they never hear of bookmarks, bookmark folders and saving sessions (e.g. with TabMix Plus)?
Sorry, but there’s a point at with you just deserve it. This is one of them. Like cockroaches in a apartment that looks like a garbage dump.
Any sufficiently advanced intelligence is indistinguishable from stupidity.