Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Have been playing around with the whole DNS spoofing thing. How can a rogue/phishing URL be masked with a legitimate URL in the address bar (without using images)? I was under the impression that this was doable, but so far the only way to pull this off is with superimposed JavaScript images.

I managed to trick my own browser by modifying the hosts file on my Mac and pointing twitter.com to a localhost site. Is it therefore safe to assume that modifying a hosts file on a rogue access point would yield legitimate-looking pages that are actually rogue?

share|improve this question
1  
On the more general topic of address bar spoofing, see Are address bars unphishable? –  Gilles Jun 22 '13 at 18:35
add comment

2 Answers

Actually, this can't be done with images. Images in browsers are confined to the main frame of the browser, and can't just escape that. Java Applets can, however, though these will ask for permission first.

In general the only way to mask a phishing URL by a legitimate one is to spoof DNS (or just go ahead and ARP spoof the whole connection and add a filter).

Is it therefore safe to assume that modifying a hosts file on a rogue access point would yield legitimate-looking pages that are actually rogue?

Well, APs usually don't have hosts files, but this is possible. In fact, if someone is on the same subnetwork as you, they can use ettercap with some filters (ARP spoofing) to mask phishing URLs.


In general, the only thing you can trust are SSL URLs (https://). These will display a green something on the address bar if the are legitimate, and will raise an error if they aren't (though this error can be caused by non-malicious situations too)

share|improve this answer
    
I think it's fair to assume most end users are unable to distinguish between a legitimate ssl indicator and a spoofed one. Certain MITM attacks are extremely convincingly deceptive. –  user1128948 Jun 22 '13 at 15:47
    
@user1128948 You mean that they'll miss the big red warning page with the obscured "proceed anyway" button? That's prepos--actually quite close to the truth, unfortunately. There's ample warning, and Firefox makes you jump through hoops, but people do miss it anyway. –  Manishearth Jun 22 '13 at 15:50
    
Where could I find more information on the DNS/ARP spoof combo? I'm more interested in successfully initiating a rogue session in my lab that's convincing enough to fool some of the more clever people. Guarding against it is more of a secondary priority. Thanks for the input, though. –  user1128948 Jun 22 '13 at 15:50
    
@user1128948 It's not a combo, not exactly. I can either pretend to be a DNS server (Google "DNS spoofing") by configuring the router or an upstream node that way, or I can just sit on the subnet and pretend to be the router (Google "ARP spoofing", "ettercap", "Wireshark", "ettercap filters"). I'm afraid I don't have any links I can point you to, sorry :/ –  Manishearth Jun 22 '13 at 15:53
    
I agree images are confined to the page. However, the favicon ( e.g., SE uses the shield icon here: cdn.sstatic.net/security/img/favicon.ico ) can spoof a padlock image similar to what some browsers display and convince naive users they are secure (using HTTPS) while the protocol is ordinary HTTP. –  dr jimbob Jun 22 '13 at 17:59
show 3 more comments

If the website has an XSS vulnerability, you can show your own code on that page and the URL remains. For example if there's an XSS vulnerability on Paypal, you could place a link bit.ly/abc in a spam mail resulting in an URL with paypal.com, but showing your phishing site instead.

That's why XSS vulnerabilities are so dangerous for you. And 90% of commercial sites have XSS vulnerabilities according to some study I just read a few days ago.

Regarding the images thing: There were some bugs in old browsers where you could place a floating image over the URL bar, but all these bugs have been patched. That's not possible in any current browser anymore. Of course you could still draw an URL bar within the page content and still trick some users.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.