Re: Safari Address Spoofing (How We Got It)

[Jeffrey Walton <noloader () gmail com>]

On Fri, May 29, 2015 at 1:47 AM, David Leo <david.leo () deusen co uk> wrote:
> Proof of concept:
> http://www.deusen.co.uk/items/iwhere.9500182225526788/
> It works on fully patched versions of iOS and OS X.
> How it works:
> Just keep trying to load the web page of target domain.
>
> How We Got It:
> Safari changes address bar to new URL,
> BEFORE new content is loaded.
>
> BestSec
> http://www.deusen.co.uk/items/bestsec/
> We like it. We read it.
Another simple one is:

    <a href="http://www.evil.com"; target="_blank" title="http://good.com";
        style="color: rgb(0, 102, 204);">Login <strong>HERE</strong></a>

The browsers will hide "evil.com", and display "good.com" as a tool
tip when you hover the mouse.

The browser makers will tell you the user is not supposed to make
security decisions based on tool tips (no shit). Phishing is the
number one attacker, and the browsers' answer is user education on
tool tips!

Jeff

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/