Broadband Tech > Security > Security > New IE Vulnerability Allows Address Bar Spoofing

reply to ZOverLord

Re: New IE Vulnerability Allows Address Bar Spoofing

Interesting, I have same and see problems already.

Phisher's are already ALL over this exploit!
--
Black, Grey and White Hats Unite here -> »testing.OnlyTheRightAnswers.com

I'm not convinced that input boxes could load & a form submit action can happen with what I've seen from the exploit sample page.

reply to ZOverLord
I replicated my settings to a virtual machine, whose default security settings were vulnerable. It wasn't vulernable anymore. I didn't disable ActiveX... not that any ActiveX controls can install in a limited account anyway. I didn't disable Active Scripting. Going through the settings one by one, this solved it:

Disable "Navigate sub-frames across different domains"

Lol, it amazes me that is Enabled by default, Like, Sure that's a good idea.

Off if on high setting
»Microsoft Application Tips and Tweaks »Concerning Internet Options Security, what do some of the settings mean
»/r0/download/4···ions.gif

Cudni
--
Some are born to failure, others achieve it, all deserve it
Help yourself so God can help you

reply to ZOverLord

function openWin(url)
{
  window.open(url, 'window');
}

function StartTest()
{
  openWin('»www.google.com/');

  setTimeout("openWin('/19521_swf/?" + Math.random() + "');", 300);

  setTimeout("openWin('/19521_swf_result/');", 2500);
}

I'ts very clear that the 'exploit' does not use any input/submit actions. To put it another way, do you believe a phish could load a fake page with a CC# input box, have that box filled out & then submitted elsewhere all the while the page is loading?

Getting someone to land on the fake page is the phish challenge so if you mean that a phish run this exploit from it's fake page then the phish doesn't really need to utilize this exploit. I just can't seem see how it's helping a phish.

I got Google plus prompt to "Allow sub-frames to navigate across different domains". Denied action. Google sat there with www.google.com in the address bar.

Reran the test, this time allowing the action. Got Secunia page, »secunia.com/19521_swf_result/, but with URL as shown. No sign of google, just Secunia page as shown. This implies I am not vulnerable.
--
Dan

reply to ZOverLord
Z, If you've taken over a server why hang around to capture login credentials.
Getting traffic that intends to land at 'chase' but instead lands at the compromised server where you have loaded a chase phish is still the phish's #1 challenge.

reply to redxii

reply to Snowy

reply to redxii

Failure

reply to redxii

reply to redxii
Interesting. The test was failing (meaning I wasn't vulnerable) on my IE6/XP SP2 setup. My "Navigate sub-frames across different domains" setting was set to enable. So I tried setting it to Prompt. After some fiddling, I managed to accept both prompts and got the test to pass.

Then I changed my settings back to Enable. But I was still vulnerable now! Not sure exactly why. I've set "Navigate sub-frames across different domains" to disable and am once again not vulnerable.
--
-Jason Levine
My Gallery | Jason's Toolbox | PCQandA.com | URateit.com