full-disclosure - Re: [FD] Safari Address Spoofing (How We Got It)

Open Source and information security mailing list archives

Date: Tue, 2 Jun 2015 13:45:25 -0400
From: Jeffrey Walton <noloader@...il.com>
To: David Leo <david.leo@...sen.co.uk>
Cc: Full Disclosure List <fulldisclosure@...lists.org>,
	BugTraq <bugtraq@...urityfocus.com>
Subject: Re: [FD] Safari Address Spoofing (How We Got It)

On Fri, May 29, 2015 at 1:47 AM, David Leo <david.leo@...sen.co.uk> wrote:
> Proof of concept:
> http://www.deusen.co.uk/items/iwhere.9500182225526788/
> It works on fully patched versions of iOS and OS X.
> How it works:
> Just keep trying to load the web page of target domain.
>
> How We Got It:
> Safari changes address bar to new URL,
> BEFORE new content is loaded.
>
> BestSec
> http://www.deusen.co.uk/items/bestsec/
> We like it. We read it.
>
Another simple one is:

    <a href="http://www.evil.com" target="_blank" title="http://good.com"
        style="color: rgb(0, 102, 204);">Login <strong>HERE</strong></a>

The browsers will hide "evil.com", and display "good.com" as a tool
tip when you hover the mouse.

The browser makers will tell you the user is not supposed to make
security decisions based on tool tips (no shit). Phishing is the
number one attacker, and the browsers' answer is user education on
tool tips!

Jeff

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives