Reverse tabnabbing: why not redirect the user in the new tab itself instead of the parent tab?

Question

I have recently been reading about reverse tabnabbing, where a child window can change the url of the parent window if it has access to window.opener (which it has by default unless you explicitly disallow it)

In this case the phishing attack is to change the parent tab url and present a similar UI as some trusted website to get user credentials and assume that user might not be able to notice that the url has changed.

I would like to understand why can't this happen in the child window itself ? Agreed that attention wise there are more chances that user would pay less attention to the parent window after the child window is opened, but after sometime, when the user has not been looking at either of the tabs, wouldn't it be similar to just change the url of the child window instead of the parent window ?

Are there any other security concerns that do not allow this?

Answer 1

Tabnabbing is when a malicious website that looks like a normal website (say, a blog), after some time, redirects itself to a phishing website that looks like some trusted website. For example, a blog article might redirect itself to a fake Facebook login page. This attack is only likely to be effective when you have lots of tabs open in your browser and you hardly know why, so you can easily be confused.

Reverse tabnabbing is more dangerous, because it can work even if you only have one tab. In reverse tabnabbing, a vulnerable website contains a link to a malicious website. The malicious website will open in a new tab, and then redirect the parent tab (the vulnerable website) to a malicious lookalike. As a result, while you are concentrating on the content of the site in the child tab (for example a blog post), the other tab (the parent) will magically become a phishing site.

So reverse tabnabbing is much more effective because it actually targets a specific website in a specific tab that is likely to be trusted by the victim. In tabnabbing instead, the attacker needs some good luck in general. You asked: why doesn't a child tab just redirect itself instead of redirecting the parent? Because, whenever you can, it's always better to choose reverse tabnabbing over plain tabnabbing.

Answer 2

Your question seems to be: why doesn't a page just redirect itself to a malicious page?

And the answer is: why would it? Instead of redirecting to a page that does malicious stuff, the page could just do the malicious stuff itself.

Sometimes this might be useful to get around a cross-origin policy or similar restrictions. It's not called tabnabbing (or reverse tabnabbing), it's just called a redirect.