Browser phishing &#39;flaw&#39; could hook users
694288
com December 8, 2004, 4:50 PM PT. A function built into all major browsers could be co-opted by attackers to fool Web site visitors into surrendering sensitive information, a security firm warned on Wednesday.
149856
InfoWorld - Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
477301
Security firm Secunia has warned that most Web browsers are vulnerable to a simple &quot;phishing&quot; technique that could make fraudulent content appear genuine.
657731
Google is working to fix a bug in the Google Toolbar that could allow criminals to steal data or install malicious software on a system, a security researcher warned Tuesday.The flaw lies in the mechanism Google Toolbar uses to add new buttons on the browser. Because the toolbar does not perform adequate checks when new buttons are being installed, a hacker could make his button appear as though it was being downloaded from a legitimate site when in fact it came from somewhere else. By spoofing the origin of the toolbar button, an attacker could download malicious files or launch a phishing attack against the victim, wrote security researcher Aviv Raff in a blog post on the issue.Raff has posted proof of concept code, showing how such an attack would work with the Internet Explorer browser. A Google spokeswoman confirmed Tuesday that the company is working to fix the problem.The attack requires many steps. First, the victim would have to be tricked into clicking on a Web link that would then pop up a window asking the user if he wants to install a custom button on his toolbar. Because of the flaw, this alert could look like it was downloading the button from a legitimate site, such as Google.com, even if it were not. Once the button was installed on the toolbar, the victim would then have to click on it and, finally, agree to download and run an executable file for the malicious software to be installed.Because the user would have to go through so many steps in order to fall victim to the attack, the bug isn&#39;t a critical one, said Marc Maiffret, an independent security researcher. &quot;While it is interesting, it&#39;s probably a low threat compared to other flaws out there,&quot; he said.Still, it was sloppy work on Google&#39;s part to miss such a simple attack, he said. &quot;They should definitely assess how it slipped through the cracks,&quot; he said.This is not the first obvious Google flaw that Raff has found. Last month, he showed how a simple Web programming error on the Google.com Web site could allow attackers to launch what&#39;s known as a cross-site scripting attack.Because Google&#39;s programmers didn&#39;t properly check the HTML generated by the Google search engine, Raff was able to create a specially crafted Google link that, when clicked by the victim, would trick the browser into running unauthorized scripting code. This type of link could be used to steal the victim&#39;s Google account or conduct phishing attacks, Raff saidThis error was fixed by Google just hours after Raff notified the company of the problem, but a demo of the flaw being exploited can be seen online.
44372
A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited.
175699
A newly reported security problem in Microsoft&#39;s Internet Explorer (IE) web browser allows attackers to create a fake website that looks exactly like a genuine site.
532476
With one in every 400 emails now a suspected phishing attack, computer users are being encouraged to increase their knowledge, open their eyes, and pay attention.
148612
Attackers can trick browsers into releasing password information.
514013
MyPhish.com The latest versions of both Firefox and Internet Explorer are vulnerable to an unpatched flaw that allows hackers to snaffle users' login credentials via automated phishing attacks.â¦
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
336569
A security issue has been discovered in a common feature included in several Web browsers, including Mozilla, Firefox, Opera, Konqueror and Camino.
90811
While the victims of the latest phishing technique may not have to click on a link to be victimized by the effort to steal information, the attack is similar to traditional phishing scams because
113328
Computer scientists have discovered a potentially serious flaw in Google&#39;s desktop search utility that could allow attackers to steal information.
450989
A serious flaw in how Firefox handles log-ons could be used by identity thieves to dupe users into disclosing passwords, a noted security researcher says.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
275443
It&#39;s not just the privacy issue of multiple users on a computer and the tool indexing everyone&#39;s contents anymore. According to a Rice University computer scientist, the flaw could allow an attacker to search
630854
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.