How to secure yourself against jQuery preventDefault phishing?

Question

This is bugging me for a while now due to the potential security risk it involves.

Basicly by accident I discovered that this code is perfectly valid and works without a problem:

jQuery:

$(document).ready(function(){
    $("#phishingURL").on("click",function(e){
        e.preventDefault();

        window.location = "https://www.stackoverflow.com";
    });
});

HTML:

<a id="phishingURL" href="https://www.google.com">https://www.google.com</a>

Most normal PC users just hover a URL to check if it actually directs towards the website they're expecting. In this type of phishing, you get to see the url you expect, yet you're still redirected to a different website. Ofcourse you can always check the address bar etc. But as I work a lot with older people, I know they're going to fall for this. So is there any way to protect yourself against this besides changing your habits?

Edit: Technically it's possible to use Flash on the pshishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.

Answer 1

If this code exists on a website, it would be one of two reasons:

1. The website itself is malicious (or has been compromised by a malicious person).
2. There is an XSS flaw on a website, and an attacker has injected that script. (Or an external resource has been compromised to the same effect.)

_{Disregarding any client machine/network compromises.}

Other than that, this code cannot run on a website other than itself. The Same Origin Policy would prevent the code from altering (say) an Iframe to change destination links like so.

A legitimate website doing this on purpose would fall into category (1) IMO.

The only place this would be an issue would be inside an email message viewed via a web-based system when a user wishes to verify links. However, scripts should not be allowed to run inside HTML email messages. Most good providers prevent this from happening by stripping disallowed content and implementing a Content Security Policy.

So is there any way to protect yourself against this besides changing your habits?

Use a browser based password manager. This should only allow you to fill out credentials on a URL match. If a phisher sends you elsewhere, the password manager won't give you the option to fill out the login form so the user will realise that something is amiss.

Edit: Technically it's possible to use Flash on the phishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.

This only changes the URL's hash value, which is a client interpreted only section of the URL. This cannot change the domain or path in the address bar.

Answer 2

This is not related to jQuery. It has always (well since Netscape 2) been possible to automatically navigate the user to an arbitrary page, with or without providing something that looks like a link to somewhere else beforehand.

The link destination UI (pop-in or status bar) is a convenience feature that was never intended as any kind of security measure. Nobody should be relying on it. Even if it were reliably unspoofable, a script could easily change the destination of the link at the critical moment, or move another link in front.

So is there any way to protect yourself against this besides changing your habits?

Make a browser extension that opens a dialog before every navigation confirming that the user intended to visit the new address?

(This would be pretty horrible to use, mind.)

Technically it's possible to use Flash on the pshishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.

No. SWFAddress writes the hash part of the URL and HTML5 History can write the path part, but you can't change the origin (scheme/hostname/port).