Home
Latest images
Search
Register
Log inHijacking Safari 4 Top Sites with Phish Bombs
Page 1 of 1
Hijacking Safari 4 Top Sites with Phish Bombs
andry Tue Dec 07, 2010 2:35 am
Well, this one is an interesting issue I found while evaluating Safari 4 Beta (v528.16). This is not your usual XSS or CSRF bug which requires a site vulnerability, but a persistent browser backdoor that impacts all Safari 4 users using versions 4.0.2 and below. I was pretty amazed at some of the new features offered by the latest version of Apple’s browser, especially the hyped Top Sites and Cover Flow
DESCRIPTION
It is possible for a malicious website to place arbitrary sites into your Top Sites view through automated actions. The attack technique makes use of javascript windows where in a small window is used to repeatedly browse to different sites that the attacker wants to add in your Top Sites list. This window is completely hidden using the window.blur function and user won’t know that is happening in the background. Please note that this attack is not possible using invisible iframes as Safari does not use iframe urls to decide Top Sites content.
Once the attack completes execution, the small window gets closed and the next time you use Safari Top Sites, it will be have the attacker’s defined sites replace your existing legitimate sites. To make this decision of which sites to replace with, an attacker can first use the CSS History Hack found by Jeremiah Grossman[2] and then accordingly set fake sites relative to those user’s visited websites. Hence, this could easily facilitate a serious phishing attack. The situation is worsened by the Safari’s inadequate protection against URL obfuscation attacks as highlighted in [3], which makes it almost impossible for a regular user to spot the fake site and differentiate it from a legitimate one.
For more info and POC check SecureThoughts
DESCRIPTION
It is possible for a malicious website to place arbitrary sites into your Top Sites view through automated actions. The attack technique makes use of javascript windows where in a small window is used to repeatedly browse to different sites that the attacker wants to add in your Top Sites list. This window is completely hidden using the window.blur function and user won’t know that is happening in the background. Please note that this attack is not possible using invisible iframes as Safari does not use iframe urls to decide Top Sites content.
Once the attack completes execution, the small window gets closed and the next time you use Safari Top Sites, it will be have the attacker’s defined sites replace your existing legitimate sites. To make this decision of which sites to replace with, an attacker can first use the CSS History Hack found by Jeremiah Grossman[2] and then accordingly set fake sites relative to those user’s visited websites. Hence, this could easily facilitate a serious phishing attack. The situation is worsened by the Safari’s inadequate protection against URL obfuscation attacks as highlighted in [3], which makes it almost impossible for a regular user to spot the fake site and differentiate it from a legitimate one.
For more info and POC check SecureThoughts
andry- Moderator
- Posts : 467
Join date : 2010-05-07
Similar topics» Bonus Safari XXE (only affecting Safari 4 Beta)
» Hijacking Opera's Native Page using malicious RSS payloads
» Firesheep - Firefox HTTP session hijacking extension
» Cross Site URL Hijacking by using Error Object in Mozilla Firefox.
» Using sites to attack other sites
» Hijacking Opera's Native Page using malicious RSS payloads
» Firesheep - Firefox HTTP session hijacking extension
» Cross Site URL Hijacking by using Error Object in Mozilla Firefox.
» Using sites to attack other sites
Page 1 of 1
Permissions in this forum:
You cannot reply to topics in this forum|
|
|