* Issue #600 (!) and phishing with Internet Explorer
Welcome to the 600th issue of Network World’s Web Application Newsletter! Yep, it has been 300 weeks, 69.230769230769230769230769230769 months or 5.7692307692307692307692307692308 years since this newsletter first hit the virtual streets.
Welcome to the 600th issue of Network World’s Web Application Newsletter! Yep, it has been 300 weeks, 69.230769230769230769230769230769 months or 5.7692307692307692307692307692308 years since this newsletter first hit the virtual streets.
As usual when we reach a milestone, I’m asking for your input: What do you like? Dislike? What would you like more of? Less of? What don’t I cover that you would like me to?
The more input I get from you the more accurately I can provide the news and information you want. So let me know at webapps@gibbs.com, I really want to know what you think.
Anyway, today I want to talk about something some bad guys do: Phishing.
I just came across one of the cleverest but thankfully unsuccessful phishing attempts I have seen so far. An e-mail message, purportedly from a bank, contained the usual “your account has been compromised and you need to…” pitch and a URL.
Where this phish attempt got clever was in what you saw when you clicked on the link: You got a copy of the bank’s Web page delivered from a completely different server. But what the hackers behind the phish did was to create a floating window using Dynamic HTML (DHTML) and locate it so that it overlapped the Internet Explorer Address Bar. This window contained the text for the real bank’s URL which would, had the coding been a little cleverer, obscured IE’s display of the currently loaded URL.
The only reason that this exploit didn’t work reliably was that in any browser with added toolbars and the main toolbar set to use small icons, the floating window was offset from its target by about 10 pixels. Unless you were browsing in your sleep, it was glaringly obvious that something was going amiss.
This is the first time I have seen or heard of this exploit and it shows yet another conceptual error in the security architecture of IE and, indeed, quite possibly other browsers. Now let me make it clear, I am not trying to beat up Microsoft for this problem; it was hardly a technique that even the wiliest designer could have predicted.
That said, something must be done to prevent this kind of exploit. Microsoft needs to look at constraining windows generated by content from appearing outside of the browser-rendering window. Indeed, the browser architecture used by Opera, for example, even constrains pop-up windows to render only inside of the current tabbed display pane.
Even then, the problem lies as much with the user as with the browser. Until users learn to be less credulous of e-mail content and the Web sites those messages send them to, while becoming more reticent about parting with their personal information when they are online, phishing and other “social engineering” scams will continue to be successful.
What we need is for e-mail sender authentication to become standard right down to the consumer level. We also need a common convention for Web sites that handle personal data; something along the lines of always using SSL and having some kind of, for example, Federal Trade Commission verification that can be provided upon access.
While I am loathe to be encouraging the government to get involved in online commerce anymore than is absolutely necessary I feel that this is an arguably critical function if we are to maintain consumer confidence in online Web-based transactions.
Here’s to the next 5.7692307692307692307692307692308 years! I hope you keep reading.
