How script kiddies can hijack your browser to steal your password

http://arstechnica.com/security/2012/12/how-script-kiddies-can-hijack-your-browser-to-steal-your-password/

by freditup • 14 years ago

36 25 14 years ago

arstechnica.com

hayksaakian3• 14 years ago

Why would you ever need to enter your browser into the search mechanism? I just don't get it.

If you're having this problem, I hear Common Sense 2013 is a great browser security package.

jonnykramer• 14 years ago

I'm not sure I understand you correctly, but the browser you are using can be ascertained with JavaScript or a server side script.

hayksaakian3• 14 years ago

sorry, it was autocorrect, meant to type 'password' became 'browser'

gojomo• 14 years ago

Your OS/browser already identifies itself, so they know which look to fake.

The trick is to convince someone to try finding something sensitive on the page. This might be done by showing a long list of 'leaked' passwords or social-security-numbers.

Even without explicit prompting, some people might Ctrl-F search for their own, with a false confidence that a local search isn't shared with the page.

InclinedPlane3• 14 years ago

It's just social engineering, but done in a rather slick fashion. Normally one wouldn't expect that a password or credit card number or social security number would ever be typed into a search box for a web page.

Except, what if you posted a page of compromised passwords or other data? Then someone might go to that page and search for their own secret information, to see if it had been leaked. They wouldn't even think twice about this because normally the information in a search box is secure, and known only to the browser. But if a site creates an html based search box that is hooked into ctrl-F then the user might divulge their secret information without even knowing.

hayksaakian3• 14 years ago

That's my problem with the whole situation. The headline paints it as a technical flaw, where in reality it's human error.

digital_surfer• 14 years ago

I must not be understanding this correctly. The script is triggered when the user attempts to search for text on the page. When would a user search for their pw's?

baddox• 14 years ago

I'm confused as well, but the only time I can imagine doing that is when there's a big leak of passwords (like LinkedIn a while back) and I want to check if my password is among those leaked.

damncabbage• 14 years ago

There are two linked examples of this in the article:

* http://h43z.koding.com/blog/leaked.html

* http://boomer.neohapsis.com/searchbox/index.html

freditup2• 14 years ago

I've actually seen links on hackernews that go to these big data dumps of information. Presumably, you'd check to see if your info was leaked using the browser's find mechanism. A clever enhancement is that as you type, JS on the page actually inserts whatever you're typing into the content of the page. So you won't ever just type the first few characters of your password and see it's not there, you'll always find your info or similar info on the page.

I agree that it does seem a touch unlikely to work in the real world. However, I think a scammer with a touch of ingenuity, creativity, and programming knowledge could probably construct a realistic enough scenario to fool many people.

InclinedPlane3• 14 years ago

Look at the example pages.

Because the exploit pages are lists of leaked passwords, or cc#s. So to check if their password has been leaked they would naturally search for their password.

This is just a very slick implementation of the old "enter your credit card number to see if it's been stolen" technique, except the end-users don't realize that they've given anything away.

Here's an analogy: you get a phone call from someone telling you that your bank account has been hijacked and you need to visit your local branch right away to fix it. So you drive to your bank, enter, and you go talk to a bank employee. As he sits at a computer he asks you for your bank account number, home address, and social security number. After typing them in and hitting a few buttons he tells you that your account has actually not been hijacked and you're safe, so you head home and go watch tv. Meanwhile, what actually happened is that you didn't realize that it was a bank holiday and con-men had broken into the bank and dressed up as bank employees to trick you into giving out your personal information.

bcoates• 14 years ago

Do any major browsers have a setting to disable overriding default keyboard shortcuts? It's one of those anti-features like popup windows or page transitions or custom scroll bar colors that nobody would miss if it was never invented.

There is a special place in hell for people who override PgUp/PgDown or the arrow keys in their webpages.

paulgb• 14 years ago

> There is a special place in hell for people who override [...] the arrow keys in their webpages.

Except for game developers, maps developers, in-browser document editors, presentation viewers, etc. The web isn't just hypertext any more, and part of making the browser a powerful platform is having features that could be misused.

artursapek• 14 years ago

Exactly. I'm working on something right now that wouldn't be possible without preventDefault(). Don't blame the tool, blame the people who misuse it.

pygorex• 14 years ago

    Do any major browsers have a setting to disable overriding default keyboard shortcuts

I don't know about that. When I'm using a web-based word processor or spreadsheet I want CMD+s to save the document I'm working on instead of bringing up the "Save Web Page As" dialog....

stephengillie• 14 years ago

Exactly. Try using product studio team foundation server web client with Chrome.

SoftwareMaven• 14 years ago

This is interesting because it is probably more likely to affect power users. Computer illiterates wouldn't know to search. Novices would use the search menu. It's not until you hit intermediate level and higher that you are likely to see the shortcut keys being used.

modarts2• 14 years ago

Which would also be the same class of user more likely to change their password after being notified of a mass password leak.

jonchang• 14 years ago

Very interesting idea and it seems like a reasonably plausible issue. However, If you skin your Firefox browser [1], your skin also shows up in the search bar. It'd definitely be a very subtle sign of something being wrong though.

[1] https://www.getpersonas.com/

4ydx• 14 years ago

Another reason to disable javascript by default.

modarts2• 14 years ago

I don't think i'll ever fully understand this approach. Most of the web is simply broken without javascript.

How script kiddies can hijack your browser to steal your password

Related Stories