Attacks/Breaches
1/13/2009
12:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

New Phishing Attack Targets Online Banking Sessions With Phony Popups

'In-session phishing' the latest Web-based method for phishers to steal users' banking credentials

Researchers have discovered a sophisticated, new method of phishing that targets users while they are banking online -- sending phony popup messages pretending to be from their banks.

The so-called "in-session phishing" attack prompts the victim to retype his username and password for the banking site because the online banking session "has expired," for instance, via a popup that purports to be from the victim's bank site, according to researchers at Trusteer, which today published an advisory (PDF) on their findings about the potential for such a phishing attack.

Amit Klein, CTO of Trusteer, says although he and his research team have not spotted full-blown attacks like this in the wild as yet, they have witnessed precursors to it. The attack goes like this: The phisher injects legitimate Websites with malicious JavaScript so that when an online banking customer visits one of those sites while banking online, he gets targeted. The malware exploits weaknesses in the browser that lets the attacker "see" the banking site URL where the victim is logged in, and then the phisher automatically generates a popup posing as that bank. If the user falls for the popup lure and enters his banking credentials, the phisher then gets those credentials.

"This is the next generation of sophisticated phishing attack," Klein says. "It combines an online vector -- the attacker waits for user to come to a genuine site that's hacked -- and browser shortcomings to detect which site the user is logged into in a different window or tab. This provides a very powerful avenue to conduct a sophisticated attack."

The popup message could take other forms, such as a customer satisfaction survey from the bank or a special promotion, according to the researchers -- anything that could dupe the user into handing over credentials.

Klein says placing a low-profile piece of malicious JavaScript on a high-profile Website isn't difficult to do, and the malware is basically invisible to the user. "Once the JavaScript is rendered, it does the job...and sees where you are logged in," he says. And the attack is possible without the attacker accessing the actual bank site at all, he notes.

The malware on the Website doesn't get downloaded to the victim's machine, so it's tougher to detect, according to Trusteer. And Internet Explorer, Firefox, Safari, and Chrome all contain a JavaScript vulnerability that lets a Website check if a user is currently logged onto another Website, leaving a temporary "footprint" that lets the attacker trace that site, including a bank.

For in-session phishing to be successful, the attacker has to maintain a list of bank Websites it will look for, and then it can send the phony popup to the victim.

Jeremiah Grossman, CTO and founder of WhiteHat Security, says the attack would be fairly simple to pull off. "There is no shortage of hacked Websites to piggyback on. And you'd probably use this method if you really don't want to be detected since there is no traditional malware as part of the attack," Grossman says. "You are just stealing some information from the browsers session and customizing a new page based upon it."

Grossman, who, along with Robert "RSnake" Hansen, had previously researched detecting users online, says the fact that there is no malware infecting the machine itself makes the in-session phishing attack especially dangerous. It would be difficult for antimalware tools to detect, he notes.

This new attack isn't as effective as traditional spear phishing, however, notes Joshua Perrymon, CEO of PacketFocus. "This just adds more timing and complexity to the attack. It also depends on the user clicking on the first link," Perrymon says.

Trusteer offered a few tips for users to protect themselves from an in-session phishing attack: deploy browser security tools; log out of banking and other sensitive online apps and accounts before going to other Websites; and be suspicious of any popups during a Web session if you haven't clicked on a hyperlink.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.