The so-called "in-session phishing" attack prompts the victim to retype his username and password for the banking site because the online banking session "has expired," for instance, via a popup that purports to be from the victim's bank site, according to researchers at Trusteer, which today published an advisory (PDF) on their findings about the potential for such a phishing attack.
"This is the next generation of sophisticated phishing attack," Klein says. "It combines an online vector -- the attacker waits for user to come to a genuine site that's hacked -- and browser shortcomings to detect which site the user is logged into in a different window or tab. This provides a very powerful avenue to conduct a sophisticated attack."
The popup message could take other forms, such as a customer satisfaction survey from the bank or a special promotion, according to the researchers -- anything that could dupe the user into handing over credentials.
For in-session phishing to be successful, the attacker has to maintain a list of bank Websites it will look for, and then it can send the phony popup to the victim.
Jeremiah Grossman, CTO and founder of WhiteHat Security, says the attack would be fairly simple to pull off. "There is no shortage of hacked Websites to piggyback on. And you'd probably use this method if you really don't want to be detected since there is no traditional malware as part of the attack," Grossman says. "You are just stealing some information from the browsers session and customizing a new page based upon it."
Grossman, who, along with Robert "RSnake" Hansen, had previously researched detecting users online, says the fact that there is no malware infecting the machine itself makes the in-session phishing attack especially dangerous. It would be difficult for antimalware tools to detect, he notes.
This new attack isn't as effective as traditional spear phishing, however, notes Joshua Perrymon, CEO of PacketFocus. "This just adds more timing and complexity to the attack. It also depends on the user clicking on the first link," Perrymon says.
Trusteer offered a few tips for users to protect themselves from an in-session phishing attack: deploy browser security tools; log out of banking and other sensitive online apps and accounts before going to other Websites; and be suspicious of any popups during a Web session if you haven't clicked on a hyperlink.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message