Browser Attacks Continue to Evolve

While the security teams at Microsoft, Mozilla and the other browser vendors continue to work on new defenses and exploit mitigations, the state of the art in attacks is continuing to evolve.

Security researcher Robert Hansen recently pointed out a new technique that could be used for a twist on the URL hijacking attack. The tactic uses JavaScript to fool users into thinking they're downloading content from a trusted site when, in fact, they're connected to a malicious site that's pushing an exploit to their machines.

In a demo he put together, Hansen shows that an attacker could use the JavaScript to force a pop-up window to launch on a legitimate site while a user is trying to download some software, such as a browser add-on. If the user has the pop-up blocking mechanism enabled in Firefox, he'd see the drop-down notification indicating that the browser had blocked the pop-up from the malicious domain from installing software. But if the attacker selects a domain name that's somewhat similar to the legitimate site's, the user would have little indication that anything was wrong and would likely go ahead with the download.

Firefox Pop-up

All the while, the user still sees the legitimate site's URL in the address bar on the browser, as pictured above.

You will notice that it quite clearly says that it is being downloaded from ha.ckers.org, but the vast majority of users won’t understand what that means, since, of course, they are quite clearly on the EV cert protected addons.mozilla.org. Also, presumably an attacker would normally pick something like addons.mozilla.org.xyx.com instead of ha.ckers.org. Worse yet, it blocks the user from downloading the legitimate file until they take action on what my malicious website is prompting them to do.

Trying to explain the details of that kind of attack to the average user would be a fool's errand, and even security-conscious Web users might have a difficult time recognizing the attack when it happens.

Commenting on this Article is closed.