razorsedge
September 8th, 2010, 09:06 PM
Most of you are aware of Phishing, where a fraudulent process is initiate with the intent of acquiring sensitive information like passwords and credit card details, by presenting oneself as a legitimate entity. But what if you are on a legitimate page and the page you have been looking, changes to a fraudulant page, once you visit another tab!?
This is called Tabnapping!
How Tabnapping works:
* You navigate to a genuine website.
* You open another tab and browse the other site.
* After a while you come back to the first tab.
* You are greeted with fresh login details, maybe to your Gmail account.
* You login again not suspecting that the page, including the favicon, has actually changed behind your back!
This can all be done with just a little bit of Javascript that takes place instantly. As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in.
The attack preys on the perceived immutability of tabs. After the user has entered their login information and you’ve sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.
You can try it out on this website azarask.in http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/. Click away to another tab for at least five seconds. Then come back to this tab.
This is called Tabnapping!
How Tabnapping works:
* You navigate to a genuine website.
* You open another tab and browse the other site.
* After a while you come back to the first tab.
* You are greeted with fresh login details, maybe to your Gmail account.
* You login again not suspecting that the page, including the favicon, has actually changed behind your back!
This can all be done with just a little bit of Javascript that takes place instantly. As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in.
The attack preys on the perceived immutability of tabs. After the user has entered their login information and you’ve sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.
You can try it out on this website azarask.in http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/. Click away to another tab for at least five seconds. Then come back to this tab.