bugtraq - Phishing hole found in IE and OE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 17 Feb 2005 21:41:20 -0000
From: Jay Calvert <jcalvert@...aneronetworks.com>
To: bugtraq@...urityfocus.com
Subject: Phishing hole found in IE and OE

Another major vulnerability has been found in Microsoft's Internet Explorer and Outlook Express. The flaw is in the way that these applications can be manipulated in simple HTML code to display an URL other than the one specified in a link, to be displayed in the status bar.

The status bar is the first place users look, or at least should look when following any link in an email or on a website to ensure that the link is taking them to where it says it is. HTML that utilizes this vulnerability can change what is displayed in the status bar of these applications, thus leading to a possible major phishing hole that can be used in very serious ways.

Proof of concept code has been released and a description of how the flaw is utilized has been published. Below is an example of the flaw, and if you are using Internet Explorer to view this page, then in the status bar, you will see eBay.com, however if you are using Firefox, then you will see spreadfirefox.com. If you click on the link in Internet Explorer you will be directed to spreadfirefox.com, however in Firefox, you will go to eBay.com.

Here is the code:

<p><a id="SPOOF" href="http://spreadfirefox.com"></a></p>
<div>
<a href="http://ebay.com" target="_blank">
<table>
<caption>
<a href="http://ebay.com" target="_blank">
<label for="SPOOF">
<u style="cursor: pointer; color: blue">
ebay.com
</u>
</label>
</a>
</caption>
</table>
</a>
</div>

An example and this article can be seen at: http://habaneronetworks.com/viewArticle.php?ID=140

If you did use Internet Explorer to open the link, then maybe you should read about Firefox here, and consider switching. Mozilla also has a beautiful product to replace Outlook Express too.