• We've upgraded our forums. Please post any issues/requests in this thread.

Tabnabbing: A New Type of Phishing Attack

Joined
Jul 28, 2008
Messages
2,525 (0.74/day)
Likes
506
System Name Desktop | Poweredge r410
Processor i5 6500 4.5GHz@1.275V | 2 x E5620 @2.4GHz
Motherboard ASRock Fatal1ty Gaming | Intel 5500
Memory 16GB DDR4 2400MHz | 32GB ECC DDR3
Video Card(s) RX480 8GB |On-Board
Storage 250GB SSD + 512GB SSD|4x320GB
Display(s) 27" Dell + 2 x 24" LCD Setup
Case Fractal Design Define Nano S
Software Windows 10 | Server 2012 r2
#1
How The Attack Works

1. A user navigates to your normal looking site.
2. You detect when the page has lost its focus and hasn’t been interacted with for a while.
3. Replace the favicon with the Gmail favicon, the title with “Gmail: Email from Google”, and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.
4. As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.
5. After the user has entered their login information and you’ve sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.

Clever thing if you ask me.
Video of how it works
 
Joined
Jun 16, 2008
Messages
3,166 (0.91/day)
Likes
467
Location
North Chili, NY
System Name Woot!:D
Processor Intel Core i5 4690k
Motherboard AsRock z97 Extreme3
Cooling Stock
Memory 16GB 1333 DDR3
Video Card(s) EVGA GTX 780
Storage 240GB Intel SSD 2TB Seagate Barracuda
Display(s) Cintiq 21UX 1600x1200, LG 23" 1920x1080
Case Thermaltake v6
Power Supply EVGA 850 B2
Software Windows 7 Home Premium 64 bit
#2
Wow assholes.
 

cadaveca

My name is Dave
Joined
Apr 10, 2006
Messages
16,546 (3.88/day)
Likes
10,908
Location
Parkland County, Alberta
System Name Gamer
Processor Intel i7-6700K (ES)
Motherboard MSI Aegis TI
Cooling Custom Dragon Cooler
Memory 16 GB Kingston HyperX 2133 MHz C13
Video Card(s) 2x MSI GAMING GTX 980
Storage 2x Intel 600P
Display(s) Dell 3008WFP
Case MSI Aegis Ti
Mouse MSI Interceptor DS B1
Keyboard MSI DS4200 GAMING Keyboard
Software Windows 10 Home
#3
LoL. Social engineering at it's best. Google IMAP takes that whole issue out of the equation...