Sneaky browser 'tabnapping' phishing tactic surfaces
Mozilla outlines how hackers can trick users by silently changing open browser tabs
Computerworld - A Mozilla employee yesterday outlined a sly new attack tactic dubbed "tabnapping" that can dupe users into giving up passwords by secretly changing already-open browser tabs.
All of the major browsers on Windows and Mac OS X are vulnerable to the attack.
Aza Raskin, Firefox's creative lead, spelled out the scenario, which is striking in its assumption: Most people keep multiple tabs open, often for long periods.
"As the user scans their many open tabs, the favicon and title act as a strong visual cue -- memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open," said Raskin, referring to his example of a spoofed Google Gmail log-in. "When they click back to the fake Gmail tab, they'll see the standard Gmail log-in page, assume they've been logged out, and provide their credentials to log in."
There's no need for the attacker to change the actual URL that shows in the browser's address bar, since the tactic banks on the trust that tabs can't suddenly mutate. "The attack preys on the perceived immutability of tabs," Raskin said.
Raskin also laid out several ways hackers could boost tabnapping's sneakiness, ranging from sniffing out sites that the victim actually visits -- put up a fake Facebook log-in, say, rather than simply betting that the user opens Gmail -- to changing the text on the bogus page. "You can mention that the session has timed out and the user needs to re-authenticate," Raskin said. "This happens often on bank Web sites, which makes them even more susceptible to this kind of attack."
Computerworld ran Raskin's proof-of-concept -- his blog post explaining the attack includes the necessary code -- and found that Chrome, Firefox, Opera and Safari in Mac OS X 10.6 all showed the fake Gmail tab and contents. In Windows XP, Chrome, Firefox, Internet Explorer and Opera did the same.
But some browsers were more susceptible than others. In both Windows and Mac OS X, for instance, Raskin's code changed only Firefox's "favicon," the small icon that typically shows a miniature site logo. In other browsers, the favicon for Raskin's blog remained, though the label and content was that of Gmail.
Google's Chrome seemed especially resilient to the tactic. On the Mac, Raskin's trick sometimes changed the tab, often did not. Computerworld was not able to nail down the specific situations when Chrome fell victim, however.
Raskin did not reply to questions about what steps Firefox and other browser makers might take to stymie such attacks. In his blog, Raskin touted ongoing work on a new username/password tool called "Account Manager" that is tentatively slated to show up in Firefox 4, the ambitious upgrade Mozilla plans to release this November.
Andrew Storms, director of security operations at nCircle Security, doubted whether there is an easy fix. "I can't think of anything off hand that could be done," Storms said via instant message. "That's the part of the new dynamic nature of Web browsing. You can alter the look/feel of the experience for both good and bad."
Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), said his team is looking into Raskin's claims, but hinted that Microsoft wouldn't be patching IE anytime soon. "I wouldn't classify this as a 'vulnerability' though," Bryant said in an e-mail answer to questions.
When Microsoft declines to name an issue a security vulnerability, it generally means that if a fix does come, it won't appear until a service pack or next major upgrade is released. In the case of Internet Explorer, that would be IE9, which remains in the early development stage.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Google reverses field, promises to restore Chrome's scrollbar arrows
- Update: Google ships Chrome 33, patches 28 bugs
- Mozilla's top exec defends in-Firefox ads, revenue search
- Mozilla taps in-Firefox ads as it searches for more revenue
- Mozilla ships Metro Firefox beta for Windows 8
- Mozilla defers Firefox's new 'Australis' UI to April
- Mozilla resets Metro Firefox ship date to mid-March
- Mozilla ships Firefox 26 with opening click-to-play move
- Mozilla banked $274M in '12 from Google-Firefox search deal
- Google trumpets Chrome's SPDY gains
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts