full-disclosure - Re: Internet Explorer URL parsing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <018a01c3bf54$124f2280$a800a8c0@cryo>
From: clint at secureconsulting.com (Clint Bodungen)
Subject: Re: Internet Explorer URL parsing vulnerability

Yah I can see your point on both sides... If I were a Paypal or eBay user or
anything like that and the exploit was good enough and convincing enough I
guess we could all fall for it.  That's the "wet dream" of all digital scam
artists though.  But as you mention, that's what I was referring to was the
"click all fill all zombies".  I think this particular "exploit" is still a
ways from reeling in the masses with at least a couple brain cells to bang
together because all those services/sites also tell users not to give out
personal info, [service] will never ask for passwords or send email or
whatever yada yada yada.  Users of these services are more likely to see
those warnings (as they are directly from the service provider) before other
warnings and whitepapers talking about URLs and such.  Anyway, it's a moot
point now that can be argued forever.  The bottom line is the info is out
and we (those in the know) all need to do whatever we can to help the
"ignorant".

----- Original Message ----- 
From: "S G Masood" <sgmasood@...oo.com>
To: <full-disclosure@...ts.netsys.com>
Sent: Wednesday, December 10, 2003 12:00 PM
Subject: Re: [Full-Disclosure] Re: Internet Explorer URL parsing
vulnerability

>
> --- Clint Bodungen <clint@...ureconsulting.com> wrote:
> > Please see my original post... oh wait... I'll paste
> > it.
> >
> > I don't really think it will make that much of a
> > difference their profits
> > considering anyone dumb enough to fall for those
> > scams isn't going to know
> > the difference between an IP address in the URL box
> > and a "spoofed" domain.
>
> Since you are posting this for the second time:
>
> There are many people who have been told to check that
> the URL matches the page displayed before entering any
> sensitive information. Like, if they are seeing the
> paypal page, they are told to check the address bar to
> see if it shows http://paypal.com and not
> http://paypa1.com, for instance. Many papers on
> spoofing mention this as if it is an infallible method
> for checking the authenticity of the page. Such people
> will fall for these exploits.
>
> Hey, to be very honest, if this was 0day and the spoof
> was well constructed, even you and me would probably
> fall for it. ;D
>
> Anyways, it wont make a difference to the "click
> all-fill all" zombies you are talking about. :)
>
> --
> S.G.Masood
>
> __________________________________
> Do you Yahoo!?
> Free Pop-Up Blocker - Get it now
> http://companion.yahoo.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>