Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: .MAC Webmail phishing attack
From: Peter John Hill <phill () andrew cmu edu>
Date: Tue, 23 Mar 2004 09:53:33 -0500

--On Tuesday, March 23, 2004 8:58 AM +0000 rabbit food <r4bb1t_f00d () yahoo co uk> wrote:

Useless
Information

It may be possible to redirect a naive .Mac webmail
user, to another site, possibly, one mocked up as
webmail (a user may ignore the fact SSL is not
present).

http://webmail.mac.com/redirect/http://your url

How is this different from <<ANY>> other redirect attack. Why is this a ".MAC Webmail phishing attack" ???

Is there anything special about .mac webmail that makes this kind of attack any easier? This is not some intuitive leap here...

Now the IE obfuscated (look up the definition in dictionary.com) redirection bug, that was good. It could even be crafted to make the little lock icon appear.

I just don't want some ignorant reporter reading your message and thinking "oh my god, Apple's email service is full of holes!!!"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault