For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no any subsequent operations on the phishing website.
2
-
Can you give us a theoretical example of what you would consider to be a "single-click phishing attack"? – xorist Oct 5 '18 at 17:31
3
This would be a "Drive-by" attack, where the simple act of visiting a website from an initial click allows for a successful hack of the client.
Usually escaping the sandbox, getting code execution and privilege escalation is the result of combining multiple flaws to result in the desired goal.
This year, 2018, the pwn2own event held in March - awarded prizes for popping Edge, Safari and Firefox on desktop platforms.
So, in theory in 2018 it was possible… also if you look at CVE Details website for Chrome, Edge, Firefox and Safari you'll see the stats for 2018's CVE in those browsers. Given that these are just the known vulnerabilities it seems likely that drive-by are still possible.
-
Thanks for your answer. I have a follow-up question: security.stackexchange.com/questions/195144/…. – an0 Oct 5 '18 at 15:09
2
A single click on a malicious link could indeed be dangerous:
- Drive by downloads, as Craig mentions, could install malware by exploitng bugs in your browser.
- Reflected XSS attacks could be used to steal or modify data or hijack your login on a vulnerable site. (Note that the link would not even have to be to the site that is attacked.)
- CSRF attacks could be used in similar ways to perform actions on remote websites that you did not intend to preform.
Not sure I would call this "phishing" though, but that's just semantics.
