0

This is bugging me for a while now due to the potential security risk it involves.

Basicly by accident I discovered that this code is perfectly valid and works without a problem:

jQuery:

$(document).ready(function(){
    $("#phishingURL").on("click",function(e){
        e.preventDefault();

        window.location = "https://www.stackoverflow.com";
    });
});

HTML:

<a id="phishingURL" href="https://www.google.com">https://www.google.com</a>

Most normal PC users just hover a URL to check if it actually directs towards the website they're expecting. In this type of phishing, you get to see the url you expect, yet you're still redirected to a different website. Ofcourse you can always check the address bar etc. But as I work a lot with older people, I know they're going to fall for this. So is there any way to protect yourself against this besides changing your habits?

Edit: Technically it's possible to use Flash on the pshishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.

  • 1
    What position are you taking for protecting them? As the owner of a website? I assume it's not just protecting yourself since you say that you "work a lot with older people" who will fall for this. – Anonymous May 10 '15 at 2:22
  • 1
    I'm helping a lot of elderly in their retirement homes getting used to work with a computer and internet. Mostly they just wish to stay in contact with family and friends. It's hard to teach them everthing they have to keep an eye on. So instead I try to install security messures to protect them. – icecub May 10 '15 at 20:48
4

If this code exists on a website, it would be one of two reasons:

  1. The website itself is malicious (or has been compromised by a malicious person).
  2. There is an XSS flaw on a website, and an attacker has injected that script. (Or an external resource has been compromised to the same effect.)

Disregarding any client machine/network compromises.

Other than that, this code cannot run on a website other than itself. The Same Origin Policy would prevent the code from altering (say) an Iframe to change destination links like so.

A legitimate website doing this on purpose would fall into category (1) IMO.

The only place this would be an issue would be inside an email message viewed via a web-based system when a user wishes to verify links. However, scripts should not be allowed to run inside HTML email messages. Most good providers prevent this from happening by stripping disallowed content and implementing a Content Security Policy.

So is there any way to protect yourself against this besides changing your habits?

Use a browser based password manager. This should only allow you to fill out credentials on a URL match. If a phisher sends you elsewhere, the password manager won't give you the option to fill out the login form so the user will realise that something is amiss.

Edit: Technically it's possible to use Flash on the phishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.

This only changes the URL's hash value, which is a client interpreted only section of the URL. This cannot change the domain or path in the address bar.

  • Your solution seems great to. But I'll have to find a good manager that is easy to use for elderly. Do you have any tips? – icecub May 10 '15 at 20:50
  • Lastpass is the most user friendly one I've ever used. A good balance between usability and security. – SilverlightFox May 10 '15 at 20:55
  • Alright. Thanks a lot. I guess in the end this is more reliable than writing a browser extension that asks if you're sure you wish to browse to... They still have to keep an eye on the question and might simply click Yes because they have no idea what to do. Therefor I'm accepting your answer. Thanks again! – icecub May 10 '15 at 20:59
1

This is not related to jQuery. It has always (well since Netscape 2) been possible to automatically navigate the user to an arbitrary page, with or without providing something that looks like a link to somewhere else beforehand.

The link destination UI (pop-in or status bar) is a convenience feature that was never intended as any kind of security measure. Nobody should be relying on it. Even if it were reliably unspoofable, a script could easily change the destination of the link at the critical moment, or move another link in front.

So is there any way to protect yourself against this besides changing your habits?

Make a browser extension that opens a dialog before every navigation confirming that the user intended to visit the new address?

(This would be pretty horrible to use, mind.)

Technically it's possible to use Flash on the pshishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.

No. SWFAddress writes the hash part of the URL and HTML5 History can write the path part, but you can't change the origin (scheme/hostname/port).

  • I agree it would be horrible to use. But in my specific situation (see comments on question), I think it's not even such a bad idea. Thanks! – icecub May 10 '15 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.