Tabnabbing
Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating those sites and convincing the user that the site is genuine. The attack's name was coined in early 2010 by Aza Raskin, a security researcher and design expert.[1][2] The attack takes advantage of user trust and inattention to detail in regard to tabs, and the ability of modern web pages to rewrite tabs and their contents a long time after the page is loaded. Tabnabbing operates in reverse of most phishing attacks in that it doesn’t ask users to click on an obfuscated link but instead loads a fake page in one of the open tabs in your browser.[3]
The exploit employs scripts to rewrite a page of average interest with an impersonation of a well-known website, when left unattended for some time. A user who returns after a while and sees the rewritten page may be induced to believe the page is legitimate and enter their login, password and other details that will be used for improper purposes. The attack can be made more likely to succeed if the script checks for well known Web sites the user has loaded in the past or in other tabs, and loads a simulation of the same sites. This attack can be done even if JavaScript is disabled, using the "meta refresh" meta element, an HTML attribute used for page redirection that causes a reload of a specified new page after a given time interval.[4]
The NoScript extension for Mozilla Firefox defends both from the JavaScript-based and from the scriptless attack, based on meta refresh, by preventing inactive tabs from changing the location of the page.[5]
Example
"It can detect that you're logged into Citibank right now and Citibank has been training you to log into your account every 15 minutes because it logs you out for better security. It's like being hit by the wrong end of the sword.", said Aza Raskin.[6]
See also
References
- ^ Claburn, Thomas (2010-05-25). "Tabnapping attack makes phishing easy". Information Week. Retrieved 2012-02-19.
- ^ "Aza Raskin's original tabnabbing disclosure". Azarask.in. 2010-05-25. Retrieved 2012-02-19.
- ^ Christina Warren 164 (2010-05-25). "New Type of Phishing Attack Goes After Your Browser Tabs". Mashable.com. Retrieved 2012-02-19.
{{cite web}}: CS1 maint: numeric names: authors list (link) - ^ Adler, Eitan (2010-05-30). "Eitan Adler's thoughts: Tabnabbing Without Javascript". Blog.eitanadler.com. Retrieved 2012-02-19.
- ^ "NoScript 1.9.9.81 changelog announcing specific tabnapping protection". Noscript.net. Retrieved 2012-02-19.
- ^ Magid, Larry (2010-06-11). "Tabnabbing: Like phishing within browser". News.cnet.com. Retrieved 2012-02-19.
External links
- "Devious New Phishing Tactic Targets Tabs". Krebson security. 2010-05.
{{cite web}}: Check date values in:|date=(help)