WARNING: tabbed browser phishing 'tabnagging'

Mr_Oink

Friends, a new and scary phishing attack on tabbed browsers that works on inattentiveness and visual cues (the small favicon). Make yourself familiar with 'tagnabbing'.

It works like this. You open a tab to an infected site and leave this open to switch to another tab. In the background the old tab replaces itself with a spoof phishing site. When you scan your tab bar you pick it thinking it's genuine. Here is a harmless example showing the trick with Facebook.

http://www.elblowfly.org.uk/tagnab/

There are lots of variations on the theme and I urge you all to be careful with tabbed browsers checking the actual address matches what your eyes are seeing.

The_Grandmaster

Didn't turn into facebook for me but I will trust you!

bat999

Yes, it has turned into a lookalike facebook page for me.
:mad:

System

Itis not aimed at tabbed browsers specifically. If the window loses focus the timer in the javascript kicks in and 5 secs later changes it to the facebook info.

Simple way to defeat it is to disable javascript.

Full info here on the author's site

mr_fishbulb

That is quite cool. Reminds me of another favicon trick used by SSLstrip - replace the icon with a padlock so users will be tricked into thinking they are on a secure site.

For example, you see martin's face up in the address bar to the left of http://forums.... ?

Look at this example: It's a non-secure site (not SSL - you can tell by it being http instead of https) and yet it has a padlock: