PSA: Spreading the word about a new phishing attack

[rhu]

"Tabnapping" is a new phishing technique. All you need to know in one sentence: If you go to a browser tab and it looks like Google or some other site has signed you out after inactivity, DON'T SIGN BACK IN ON THAT PAGE, but close that tab and open a FRESH one to sign in.

Details for the technically inclined are at http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/ along with a proof-of-concept implementation.

This is real, it's clever, and while I haven't heard of it being used for real yet, it was announced yesterday so by now I'm sure it's out there. Spread the word.

Comments

[desireearmfeldt]

Bah, I think this has been happening to me for a week or more...since I had gmail windows open, I assumed it was gmail changing its settings on when to time you out. More password changing for me.

[desireearmfeldt]

Or, perhaps gmail really has changed its system as well, since typing in the url still seems to get me the login screen.

[goldsquare.livejournal.com]

It is worth noting that his web page (that you linked to) can exhibit the behavior of tab-napping, for demonstration purposes only.

You may want to EMPHASIZE THAT A LITTLE. :-)

The normal Internet defenses I use forced his exploit to fail. :-)

[cellio]

Clever.

My usual settings prevented it from working for me with his site, but that doesn't mean someone couldn't pull it off anyway. Good to have the warning. (I watched the video rather than lowering my defenses. :-) )