full-disclosure - .MAC Webmail phishing attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: phill at andrew.cmu.edu (Peter John Hill)
Subject: .MAC Webmail phishing attack

--On Tuesday, March 23, 2004 8:58 AM +0000 rabbit food 
<r4bb1t_f00d@...oo.co.uk> wrote:

Useless
> Information

> It may be possible to redirect a naive .Mac webmail
> user, to another site, possibly, one mocked up as
> webmail (a user may ignore the fact SSL is not
> present).
>
> http://webmail.mac.com/redirect/http://your url

How is this different from <<ANY>> other redirect attack. Why is this a ".MAC 
Webmail phishing attack" ???

Is there anything special about .mac webmail that makes this kind of attack any 
easier? This is not some intuitive leap here...

Now the IE obfuscated (look up the definition in dictionary.com) redirection 
bug, that was good. It could even be crafted to make the little lock icon 
appear.

I just don't want some ignorant reporter reading your message and thinking "oh 
my god, Apple's email service is full of holes!!!"