In-session phishing
From Wikipedia the free encyclopedia
This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)
|
In-session phishing is a form of potential phishing attack which relies on one web browsing session being able to detect the presence of another session (such as a visit to an online banking website) on the same web browser, and to then launch a pop-up window that pretends to have been opened from the targeted session. This pop-up window, which the user now believes to be part of the targeted session, is then used to steal user data in the same way as with other phishing attacks.[1]
The advantage of in-session phishing to the attacker is that it does not need the targeted website to be compromised in any way, relying instead on a combination of data leakage within the web browser, the capacity of web browsers to run active content, the ability of modern web browsers to support more than one session at a time, and social engineering of the user.
The technique, which exploited a vulnerability in the JavaScript handling of major browsers, was found by Amit Klein, CTO of security vendor Trusteer, Ltd.[2][3] Subsequent security updates to browsers may have made the technique impossible.
References[edit]
- ^ Hruska, Joel (2009-01-13). "New in-session phishing attack could fool experienced users". Ars Technica. Retrieved 2024-04-16.
- ^ Kaplan, Dan (14 January 2009). "New phishing ploy exploits secure sessions to hijack data". Retrieved 9 September 2018.
- ^ "Archived copy" (PDF). Archived from the original (PDF) on 2009-01-22. Retrieved 2009-01-20.
{{cite web}}
: CS1 maint: archived copy as title (link)
External links[edit]
- New Phishing Attack Targets Online Banking Sessions With Phony Popups
- New in-session phishing attack could fool experienced users