Using the HTML5 Fullscreen API for Phishing Attacks

http://feross.org/html5-fullscreen-api-attack/

by feross • 14 years ago

211 127 14 years ago

jpxxx5• 14 years ago

Brilliant, terrifying, wonderfully crafted and well-communicated work. Where do we go from here?

tlrobinson• 14 years ago

I don't know about your browser, but mine (Chrome 22) showed a very obvious warning that my browser was now in fullscreen mode.

I certainly wouldn't be tricked by this, but someone less technically savvy could be.

chaud2• 14 years ago

Firefox has a big warning that asks permission and dims the background, making it difficult to use until you select allow or deny, so it won't work as well with Firefox.

Chrome 23 just makes it full screen with a small notice.

jpxxx5• 14 years ago

This is true, I saw it too. But a popup telling the user to 'Allow Fullscreen?' is semantically equivalent to "Click Yes If You Want To Log On To Your Bank" for most users.

The least savvy are UI-blind, a big portion won't realize a transition just occurred, and a great majority of them will not read the warning beyond the first line.

mistercow2• 14 years ago

Both Chrome and Firefox show warnings when a page uses the fullsrceen API. Is there a browser out there that doesn't?

feross12• 14 years ago

The latest version of Safari shows no warning on fullscreen, making users very vulnerable. The only indication is a short, half-second animation (it's much shorter than the usual OS X fullscreen animation). After that, there's no indication that you're in fullscreen mode.

othermaciej• 14 years ago

Safari also completely disallows keyboard input in fullscreen mode, which majorly mitigates the vulnerability.

andrewfelix• 14 years ago

The demo you've put together is very nice. It even accounts for the different UI styling of individual browsers. However in all cases that the link worked, I received a very large warning that has to be manually dismissed.

This is not a rhetorical question; do you think people would ignore the warning and continue to use the site?

An easier phishing technique would be to manipulate the address to appear legitimate using pushState.

feross12• 14 years ago

"do you think people would ignore the warning and continue to use the site?"

I actually made this demo back in April but just got around to posting about it now. In the meantime, Firefox and Chrome have made their warning messages more prominent. Still, I think it's a pretty major issue.

Experienced web users won't be fooled by something like this. But, even if 1% of users are fooled by this technique, that's still potentially thousands of innocent web users, which I think is unacceptable.

yati3• 14 years ago

Exactly, and the dumbness to smartness ration in this world is very high, so a serious attack is likely to affect far more than 1% of the visitors :O

SoftwareMaven• 14 years ago

do you think people would ignore the warning and continue to use the site?

Absolutely. My eyes were opened to that when I was troubleshooting my father's webcam over the phone. It kept not working when everything looked like it should. He just failed to let me know about the alert that kept popping up that said "camera is locked by <foo>". Instead, without reading, he just hit the "X", even though I was asking for every step he was performing. Closing a rogue alert isn't even a "step" to most people.

If you are relying on dialogs to keep your users safe, you are doing it wrong. Unfortunately, I don't know what the right answer here is.

jiggy20112• 14 years ago

I worked in tech support for a few years, this stuff is very common when doing things over the phone. "A box popped up saying X" , "OK click on Y" , "Oh , I just clicked on Z", "why did you click on Z?" , "I always click on Z".

ygra3• 14 years ago

Indeed. Since message boxes and confirmations are used so frequently and often unnecessary users have trained themselves to just click on the far left or far right button to get rid of it. They don't read it, they don't want to understand what happened, it just interrrupted their flow and they want it to be gone. Pushing decisions to the user in form of confirmations won't ever really work probably due to a Pavlovian urge to close such things as fast as possible.

yati3• 14 years ago

Great job! But originally, I opened that link in a new tab while I was still reading the article. It obviously did not work :P I've this habit of opening most links in a new tab!

Zancarius• 14 years ago

Same here. I have an addiction to opening everything remotely interesting in a new tab, and my initial reaction was "I don't think this worked?"

Otherwise, it's pretty frightening, because I can imagine that in spite of the browser warnings, there are many non-savvy users who probably wouldn't give it a second thought.

As a KDE user, the blatant Gnome UI was kind of glaring but otherwise well done. ;)

yati3• 14 years ago

haha, this indeed is frightening, and intelligent designers will push this to do something really neat. Let's hope it's a POC and not a real attack. Let us not forget that there are far more dumb people than smart people on our planet! ;)

esolyt2• 14 years ago

Not even Gnome. It is Ubuntu interface. I guess they were assuming most Linux users are Ubuntu users.

skeletonjelly4• 14 years ago

I did the same (new tab) and thought "oohh it looks and reacts just like the real thing!". Had to read a bit more to see what I was meant to do.

improv32• 14 years ago

Not working for me. Chrome 22.0.1229.92 on Win 8 RTM

It doesn't go full screen at all, it just stays in the window normally.

w00kie• 14 years ago

Google Chrome asks for authorization to enter fullscreen mode. I've updated my browser this morning to Version 22.0.1229.92 m, is it new?

esolyt2• 14 years ago

Updated just now. 22.0.1229.92 on Linux does not ask for authorization but it displays a permanent notification.

AngryParsley2• 14 years ago

That's clever. It was pretty obvious to me, since I run Chrome in presentation mode (no UI elements visible) and Chrome popped up a dialog box telling me about the switch to full-screen mode. Still, I can see how a lot of people could be tricked by this. I can't think of a better solution than extant phishing site blacklists.

Full-screen mode can be useful, but it and other HTML5 features can be used for phishing or to generally annoy users. I'm wondering how soon it will be before someone makes the HTML5-equivalent of ClickToFlash.

skeletonjelly4• 14 years ago

By presentation mode you mean fullscreen (F11)? I had a quick search and couldn't find anything conclusive. It's an OSX specific thing?

AngryParsley2• 14 years ago

I don't have a Windows machine or VM, but it looks like full-screen mode on Linux is the same as presentation mode on OS X: the UI is completely hidden unless you move the mouse to the top of the screen. In addition to presentation mode, Chrome for OS X has a separate full-screen mode that always shows the tabs and buttons.

FooBarWidget• 14 years ago

In OS X, "Full screen" triggers the Lion native full screen mechanism. In this mode Chrome is full-screen but you still see the toolbar. "Presentation mode" is more like what "Full screen" did before Lion, or how full screen behaves on other OSes: no toolbar.

wtallis• 14 years ago

NoScript already inherently blocks this, and even if you allow the domain that provides the script that tries to go full-screen, and allow the full-screen transition, the web page pretending to be a desktop doesn't cover the NoScript toolbar that's still prompting for permissions on the other domains. I suspect the anti-clickjacking measures would kick in if the phishing site tried to incorporate the real site as a base layer.

NoScript does not seem to have any features targeted directly at HTML5 fullscreen, though.

tymekpavel• 14 years ago

I don't think the average user knows what NoScript is.

hatu3• 14 years ago

Phishing attacks aren't targeting the HN crowd / web programmers.

romaniv2• 14 years ago

It's increasingly difficult to browse websites with NoScript and Request Policy add-ons. There are websites that download JS from more than a dozen different domains. Moreover, it seems that a lot of web developers (including some here) simply dismiss NoScript users "not our target audience". Emerging "HTML" standards don't make this situation any better, since they are pretty much aimed at developing websites in JavaScript, not HTML.

jeswin• 14 years ago

The concept is clever, and very interesting.

However, most users (even experienced users) don't look at the url when visiting information-sensitive websites and www.bankofamerica.fsh4.com would still not alarm them. They don't understand the SSL icon either.

ygra3• 14 years ago

There was an interesting research a few years ago regarding the SSL icon. Since in many users the idea is actually finely-ingrained that a padlock means security on a website they just made the favicon into a lock. A surprisingly large number of users was fooled by that.

I guess the "padlock means secure" has been superceded a little by "address bar is green somewhere" by now, but the problem remains the same.

shardling• 14 years ago

That's why Firefox no longer has the favicon in the URL bar.

damncabbage3• 14 years ago

  The user can hover their mouse over the link and their 
  status bar will show https://www.bankofamerica.com, as 
  expected.

Google search results use a similar technique to show you the "right" link when you hover.

(It's only when you click the link does it muck around with the DOM to insert the google.com/... redirect link.)

feross12• 14 years ago

Yep. Try Right Click > Copy Link Address. It copies the google.com/... redirect link, which is how I first learned that they were doing this.

damncabbage3• 14 years ago

To see how it works:

* Open a search in Chrome, and open up the Inspector (making sure not to right-click any links you want to inspect),

* Find an <a href="..."> tag for a search result.

* Right-click the tag in the Inspector, go Break On... => Attributes Modifications.

* Right-click the link like you usually would to copy it, and see what happens.

peterjmag• 14 years ago

That's not what's happening here though. The JS in the demo doesn't change the href attribute of the link, it just adds an event handler that prevents the real link from loading using e.preventDefault() and then triggers full screen.

damncabbage3• 14 years ago

Sorry, I wasn't very clear; I'm just saying that both this and Google Search spoofs the status bar by obscuring what a link will do until it's clicked.

guelo• 14 years ago

This is pissing me off. The link hover should be sacred, browsers shouldn't allow any trickery there.

finnw2• 14 years ago

I won't be surprised if both Google and MS restrict this in their browsers in the near future, but make exceptions for their own search engines.

vilgax2• 14 years ago

For Google Search use this userscript http://userscripts.org/scripts/show/121923 Work in FF & Google Chrome.

ben0x539• 14 years ago

This was really annoying for me because somehow the google redirect link took a lot longer to load than the ultimate destination would, or even regular google pages.

chii• 14 years ago

and it also stops copy/paste link via a right click (at least, that didnt work last time i tried)

vilgax2• 14 years ago

For Google Search use this userscript http://userscripts.org/scripts/show/121923 Works in FF & Google Chrome.

SwaroopH• 14 years ago

How about onscreen keyboards? They will still work, right? Funny how they are supposed to "beef up" security.

isalmon• 14 years ago

It does not work when you open the link in a new tab. The font on the screenshot is not the same that I have when I go to their website, so that would alarm me. Otherwise it's pretty clever.

nikcub3• 14 years ago

When the standard was being ratified, this came up on the mailing list (I can't find the link right now, I am on my cell).

The solution was that to recommend vendors print warning labels across the top or add a layer of permissions around the feature - which Chrome and Safari have done.

for eg. when I open it I get a message saying 'Chrome is currently in fullscreen mode'. They will likely both also add permission boxes similar to when the browser requests your location.

It is good for developers to understand this, though, but I wouldn't say that the spec is broken, or that this is a bad feature, it can be implemented securely and with warnings. Anti-phishing education for users should involve primarily talking about not trusting links anywhere and typing in the address directly.

Edit: Here it is from the Spec:

http://dvcs.w3.org/hg/fullscreen/raw-file/tip/Overview.html#...

> 7. Security and Privacy Considerations

> User agents should ensure, e.g. by means of an overlay, that the end user is aware something is displayed fullscreen. User agents should provide a means of exiting fullscreen that always works and advertise this to the user. This is to prevent a site from spoofing the end user by recreating the user agent or even operating system environment when fullscreen. See also the definition of requestFullscreen().

> To prevent embedded content from going fullscreen only embedded content specifically allowed via the allowfullscreen attribute of the HTML iframe element will be able to go fullscreen. This prevents untrusted content from going fullscreen.

I am most familiar with Safari and Chrome (have been meaning to get up-to-date with Firefox, which has had a lot of good work put into it) but all of the major browser vendors have done something around this in their own way with both desktop and mobile releases.

It is at the discretion of each vendor how they implement security warnings or settings around full screen mode. They all have slightly different implementations but the end result is that they go some way towards preventing a phishing attack using Fullscreen.

That said, it was a good idea to bring this issue to the attention of developers and users as a potential attack vector and as a demonstration of why the security dialogs are important.

Edit II: The whatwg thread where the security considerations are discussed begins here:

http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2009-Dec...

The first post rightly points out that Flash had the feature implemented in a non-secure manner for a long time.

cfinke• 14 years ago

which Chrome and Safari have done

Firefox does it too, and in a much more obvious way than either Chrome or Safari. Here are all the latest browsers on Mac compared: http://imgur.com/a/jdcI7 (Sorry Opera; I haven't re-installed you yet.)

I actually didn't get any permissions dialog or warning label in Safari 6; maybe I ok'd it for another site at some point in the past, but I definitely didn't whitelist this domain.

vstm• 14 years ago

I've just tested it in IE 9, apparently it has its own "safety mechanism" - I get the following message:

    Your browser does not support the Fullscreen API.

feross12• 14 years ago

Safari has no warning or message at all. Just a quick, half-second animation and that's it.

ivanb• 14 years ago

These messages do not show any warnings about possible malicious activity. This is enough to get a few not so computer-savvy people to get robbed.

macspoofing• 14 years ago

>The first post rightly points out that Flash had the feature implemented in a non-secure manner for a long time.

Flash disabled all "printing" keys in full-screen mode, and disabled a warning label when entered into the mode. FS could only be entered from user action. So Flash's full-screen mode was limited but fairly secure.

romaniv2• 14 years ago

Why do we need a JavaScript based API for this anyway? Wouldn't it be MUCH better to allow websites detect when user presses F11 instead? It's not just about security, it's about managing expectations and familiar UI.

est2• 14 years ago

only works if you browse in maximum window browsers.

hatu3• 14 years ago

On Chrome 22 (Win 7) it went fullscreen even from a window.

est2• 14 years ago

I mean if your browser window if NOT maximum then suddenly your browser is maximum. You get suspicious.

jkeesh• 14 years ago

Wow Feross. Another sweet demo. I still feel like there is so much to learn about security, but what I am always amazed at is that the "social engineering" attacks seem to be the problems that we can never solve. Yes, there is a technical component (HTML5 full screen api), but at its core this is a phishing attack, a "fool the user" attack, and not an actual technical security flaw.

Basically, if I wasn't paying attention, I feel like this was good enough to fool me. What can be done to save the casual, but maybe unfortunately inept internet user?

feross12• 14 years ago

Thanks Jeremy!

"What can be done to save the casual, but maybe unfortunately inept internet user?"

That's a really good question and unfortunately I don't think anyone has a good answer.

cdi• 14 years ago

On linux it tries to emulate Ubuntu with default settings, while I have Cinnamon and different theme and fonts, different user name. Didn't terrify me.

antihero• 14 years ago

But then, people with custom WMs and whatnot (I'm using herbstluft WM and Zukitwo) aren't exactly the target market are they.

blaines• 14 years ago

I think the "Door Study" [1] was the best part! It's hilarious, and horrible that the guy didn't notice the swap. Maybe I've just lived in a big city long enough that I'm not surprised by the World Famous Bushman [2] or people's swindling.

[1] http://www.youtube.com/watch?v=FWSxSQsspiQ&feature=playe...

[2] http://en.wikipedia.org/wiki/World_Famous_Bushman

feross12• 14 years ago

I saw the World Famous Bushman in SF last year -- I had no idea that he was "world famous" and had his own Wikipedia article! Neat.

geon• 14 years ago

I was thinking the door-guy-swap footage where the victim noticed the swap must be perfect material for "Just for Laughs" [1]. Inversely, the "failed" Just for Laughs-material where the victims don't react must be perfect research material.

[1] http://www.youtube.com/watch?v=662KGcqjT5Q

sesqu• 14 years ago

Derren Brown did a couple of bits on the door study that you might enjoy: https://www.youtube.com/watch?v=vBPG_OBgTWg

amadeus• 14 years ago

[firstWorldProtection]Not rMBP optimized. Was painfully obvious to spot[/firstWorldProtection]

skeletonjelly4• 14 years ago

Funnily enough Safari is the only browser that doesn't alert the user about fullscreen mode. http://imgur.com/a/jdcI7 (via cfinke)

robmcm• 14 years ago

and even Adobe managed to add warnings to the flash player... Silly Apple

feross12• 14 years ago

LOL. I took the screenshots before I had a rMBP and didn't bother to update them. I figured I'd get called out on this :)

borlak• 14 years ago

A similar issue was shown when Adobe Flash fullscreen was first introduced (I think it was just Macromedia at the time, but anyway).

When you went to fullscreen in flash, it printed a giant "you are now in fullscreen mode" in the middle of the screen, but somebody showed that simply by printing similar text all over your screen, it hid that warning very well.

hatu3• 14 years ago

Yeah but nowadays you can't use the keyboard while fullscreen in Flash do prevent this type of phishing.

jmitcheson• 14 years ago

You're being a bit disingenuous by not mentioning the inbuilt protections that the HTML5 Fullscreen API offers.

"Also, any alphanumeric keyboard input while in full-screen mode causes a warning message to appear; this is done to help guard against phishing attacks. The following keys are the only ones that don't cause this warning message to appear (...)"

(https://developer.mozilla.org/en-US/docs/DOM/Using_full-scre...)

The article and demo are nice though. Good work.

feross12• 14 years ago

That documentation is out-of-date. There were no warnings on keyboard input in Firefox or Chrome. I went fullscreen on a Facebook photo and was able to leave a comment without any issues.

Safari, on the other hand, appears to prevent keyboard input, which I just recently found out.

statictype• 14 years ago

Completely unrelated, I'm going to configure my build process to play that awesome mario death music when a build fails.

fmavituna• 14 years ago

Chromeless windows issues all over again. I don't know why people don't get their lessons from history.

In 2004 pretty much the same vulnerability exploited in IE and later on this feature removed from IE: http://www.kb.cert.org/vuls/id/490708

jiggy20112• 14 years ago

There will always be ways of exploiting things like this.

Perhaps the solution could be to handle this at the network level. In other words create what is effectively a "personal information firewall" built into the browser.

Have the browser detect when certain information is about to be send over the network, it would need to be checked prior to being passed to SSL. Things that fit formats like CC numbers or authorisation codes for banks. There could then be a prompt appear on top of all active windows saying "A CC number is about to be sent to xxx" Allow/Deny.

I suppose this would be difficult because phishers could re-encode data using JS into some other format before it is sent. So you would need some of mapping keyboard inputs to networking events.

eslaught• 14 years ago

This has been solved with information flow security (see [1]), but the problem is that performance degrades enough that no one actually uses it.

[1] http://cseweb.ucsd.edu/~lerner/papers/pldi09-sif.pdf

cryptbe• 14 years ago

Pretty nice demo. The fullscreen notification can be fake with either bankofarnerica.com or http://en.wikipedia.org/wiki/IDN_homograph_attack.

vog• 14 years ago

Unfortunately, the site is down:

Iceweasel can't establish a connection to the server at www.feross.org.

feross12• 14 years ago

Site is still up.

Are you, by chance, using HTTPS Everywhere? I think they have an erroneous rule about my site which redirects you to https:// which I no longer provide.

lucian1900• 14 years ago

Heh, at first I middle-clicked the link as usual and it took me to the real website. I was wondering what it's all about.

danboarder• 14 years ago

Listing the actual URL(s) to be loaded in an "Allow Full Screen?" warning dialogue would go a long way in addressing this issue.

chinchang• 14 years ago

I really liked the mario sfx on clicking the browser UI :P neaatt!

drfloob• 14 years ago

Thank you, Xmonad, for not supporting chrome fullscreen in your default configuration.

yen223• 14 years ago

That...is a feature?

antsam• 14 years ago

Hm. As soon as I clicked it, Firefox (or possibly one of my plugins) gave me a warning that feross.org was trying to enter into full screen mode.

boop• 14 years ago

I am not sure why this is on Github? Typically, I applaud when anything is shared on Github. But why this? What positive value is it to anyone other then script kiddies?

(Certainly, most any adequate web developer with nefarious intensions would be able to reproduce this quite easily. But why make it point-and-click easy for them?)

EGreg3• 14 years ago

I once sent a letter to Steve Jobs saying that the MacOS (and other operating systems) were susceptible to phishing by applications, which would simply present a dialog that looks very much like the System Security dialog, and thereby gain the user's root password.

The solution is to have an area where only the operating system can draw (and which cannot be screen-captured, the same way Apple currently does with DRM movies). In this area, the system would present to the user a phrase which the user selected when setting up their account. This would prevent phishing, as users would be trained to look for the phrase (and / or icon ... the reason you can't have an icon alone is because the phisher could get it right 1 out of N times).

Now, on the web there is a similar thing you can do! When someone places KEYBOARD FOCUS in your password box, and starts typing the correct password, you display the icon + phrase that you previously selected when setting up your account. If the phrase doesn't pop up or is different, you know you're being phished.

THIS is a great way to stop phishing on the web. Anyone impersonating you will not know what phrase to display. Only by starting to type the correct pass phrase will they get this information. On the other hand, they won't be able to place anything fake over the password input box and capture your input, because the phrase only appears when you type IN the password input box, which the attacker can't get to, thanks to the cross-domain security in browsers!

pbhjpbhj2• 14 years ago

Yahoo do something like this, they display a per user image on the login, presumably using cookies?

EGreg3• 14 years ago

The only thing is, if you don't wait until the user starts entering the password, the attacker can theoretically scrape the page with your username and find out the per-user image.

jrabone• 14 years ago

For login screens, this is the problem that the Secure Attention Key (http://en.wikipedia.org/wiki/Secure_attention_key) was intended to solve.

IMO this is why the constant pushing of the browser as a platform is more trouble than it's worth. Everything that your OS does now will be re-invented (badly, several times) in one or more of the different web-browsers, lost, found, queried in triplicate, standardised before finally being recycled as firelighter when the next "paradigm shift" takes over.

chayesfss• 14 years ago

Very cool proof of concept

taejo• 14 years ago

> It’s important that the fake OS and browser UI match the user’s system.

Actually, it isn't, at least for some users. More than one member of my family has fallen for the "your computer has a virus" scams, which use Windows chrome, on Ubuntu machines.

joekrill• 14 years ago

I really wish people wouldn't play random, unexpected sound effects from their websites. Now my entire office thinks I was playing Super Mario Bros.

fiatpandas• 14 years ago

High DPI users may detect something isn't right, since the technique doesn't take into account DPI setting (the fake firefox bar presented to me was much smaller than what I'm used to)

bpatrianakos• 14 years ago

Its really annoying and alarming to hear technical people rebut this with "Well I could tell the difference because I noticed my browser changed and my super customized desktop settings weren't reproduced, and plus it says "now in full screen mode", etc.". Its alarming because this type of response just goes to show that the people creating things for the web are so completely out of touch with real users. There's this weird idea among developers that users know how to use technology just like we do when in fact they don't even know which website handles their email half the time, think Google is the internet, use the browser search bar to type full URLs even though the actual address bar is 10 pixels to the left, and will blame you for giving them a virus because you changed their desktop wallpaper and not because of all those shady links to foreign lotteries they were clicking in their email which they were lucky to find in the first place.

Yeah, you can tell the difference. I could tell the difference. Yes it was very obvious even though the demo was very accurate in reproducing my browser's chrome. But the rest of the world is nothing like us. Feross says 10% will be tricked. I think that's a very conservative estimate. I wouldn't be surprised is the numbers went above 50%. If this sort of attack becomes common then I bet you anything that the majority of users will be tricked just because full screen is not very common. You'll say full screen is common but again, you're thinking of people just like you who are in the minority. Most people have never seen a website in full screen mode. Even with Facebook's full screen option it doesn't mean your parents are clicking that option or have even noticed it yet.

I'm actually building an app currently that greatly benefits from the full screen API and I really hope vendors don't start putting more restrictions on it. Instead I'm hoping there's a way to make full screen more common in legitimate ways, get users used to full screen mode so they are aware of it and know what the little "Now in full screen mode" dialog means. Sure, people will still get tricked but I'd bet it would be in far less numbers and that 10% figure Feross throws out there might become more realistic.

anonymfus2• 14 years ago

So many people there write about warnings...

Imagine you opened new fresh HTML5-based game. It requested fullscreen, you allowed. You finished game and clicked on "Exit fullscreen" button. Then, instead of canceling fullscreen mode, you got just perfect illusion of it. Site author created almost complete replacement of your browser or ever your OS UI. So when you created new tab and entered news.ycombinator.com address it was loaded via proxy.

May be it's already happened in this demo. Wake up, Neo, and press Esc to exit from Matrix, ...sorry, from Fullscreen Mode.

Eisbar• 14 years ago

Ultimately I think this can only be solved with an out of band security state indicator. Otherwise you can never quite believe what you see onscreen. Plenty of smartphones already have LEDs. Most keyboards don't use the scroll-lock led.

Using the HTML5 Fullscreen API for Phishing Attacks

Related Stories