[39290] in bugtraq
Phishing - feature or flaw
daemon@ATHENA.MIT.EDU (Secure Science Corporation Bugtraq)
Sat Jun 25 15:51:57 2005
Message-ID: <42BC8B5A.3030901@securescience.net>
Date: Fri, 24 Jun 2005 15:38:18 -0700
From: Secure Science Corporation Bugtraq <bugtraq@securescience.net>
Reply-To: bugtraq@securescience.net
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Hi,
Regarding certain vulnerabilities that are being discovered such as
http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test
Are these really features, or are they flaws now because of the phishing
threat vector. Originally javascript/DHTML/DOM is pretty powerful and
can do a lot of nasty stuff if someone were inclined. But phishing has
caused us to take a look at the once dubbed features of DHTML, and
possibly put responsibility onto the browser vendors for fixing these
now dubbed "flaws".
For example, is this a flaw -
https://slam.securescience.com/threats/mixed.html (some mozilla browsers
don't like Thawte yet so you will get a warning). This is a standard
frame with the URL domain as https://slam.securescience.com, but the
body is https://www.bankone.com - take a look at the lock icon - it will
only verify the url domain - is that a browser issue, a CA issue, or a
feature?
As we all have seen, one can use DHTML to create a popup and replace a
mimicked address bar if one were so incline (dirty rendition at
http://ip.securescience.net/exploits/ (popup blockers off and it was
designed for IE). Feature, or flaw?
--
Best Regards,
Lance James
Secure Science Corporation
www.securescience.net
Author of 'Phishing Exposed'
http://www.securescience.net/amazon/
Find out how malware is affecting your company: Get a DIA account today!
https://slam.securescience.com/signup.cgi - it's free!
