I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an attacker. How can this be accomplished, and what can end-users do to ensure a URL they are visiting is what it claims to be?

Edit: I don't remember if the attack was talking about HTTP or HTTPS, so my question applies to both.


Performing an attack on an https:// address without change of URL would require :

  • Certificate impersonation (someone has stolen private keys of the site) + DNS poisoning
  • I think it would be possible to do it also by tampering the hosts file on someone's system, but would still require a valid certificate.

To ensure not being hijacked this way, always be certain that your browser is up to date and ensure certificates are up to date too. Certificate can be rendered invalid and the CRL (Certificate Revocation List) should be checked whenever you have to use a certificate (via OCSP -Online Certificate Status Protocol - or so). I do not remember how browsers handle this type of request.

  • Thanks. I've edit my question to clarify I'm asking about either HTTP or HTTPS.
    – jrdioko
    Jul 10 '11 at 22:35

Do you mean where the attacker registers a domain that looks similar to a "real" one, but using non-English (or rather, non-Latin) characters?


  1. http://en.wikipedia.org/wiki/IDN_homograph_attack
  2. http://en.wikipedia.org/wiki/Internationalized_domain_name
  3. http://www.shmoo.com/idn/homograph.txt

If the attacker can do man-in-the-middle (e.g. wireless or if he is able to get anywhere in between you and the site you want to visit) then they can spoof DNS, use something like sslstrip (http://www.thoughtcrime.org/software/sslstrip/) to trick you, or really do any content manipulation they want.

For HTTPS, check out: Can a HTTPS connection be compromised because of a rogue DNS server

  • Yes, except that this trick will not lead to a https://www.paypal.com/ address bar (unless the user clicks through a certificate warning) -- but it could lead to a http://www.paypal.com/ address bar. In other words, the attack you posit works, but the user will see a HTTP (not HTTPS) URL in their address bar -- assuming the user does not click through a certificate warning (if the user does click through warnings, all bets are off).
    – D.W.
    Jul 11 '11 at 0:26

There is also the family of attacks where the browser correctly shows whatever the attacker wants it to show, but the traffic still goes to the malicious website, either through a simple DNS hijacking (where the browser has the correct URL but it resolves to an incorrect IP address) or low level hijacking of browser code to separate the displayed information from that in the application itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.