In-session phishing
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)
|
In-session phishing is a form of potential phishing attack which relies on one web browsing session being able to detect the presence of another session (such as a visit to an online banking website) on the same web browser, and to then launch a pop-up window that pretends to have been opened from the targeted session. This pop-up window, which the user now believes to be part of the targeted session, is then used to steal user data in the same way as with other phishing attacks.[1]
The advantage of in-session phishing to the attacker is that it does not need the targeted website to be compromised in any way, relying instead on a combination of data leakage within the web browser, the capacity of web browsers to run active content, the ability of modern web browsers to support more than one session at a time, and social engineering of the user.
The technique, which exploited a vulnerability in the JavaScript handling of major browsers, was found by Amit Klein, CTO of security vendor Trusteer, Ltd.[2][3] Subsequent security updates to browsers may have made the technique impossible.
References[edit]
- ^ Hruska, Joel (2009-01-13). "New in-session phishing attack could fool experienced users". Ars Technica. Retrieved 2024-04-16.
- ^ Kaplan, Dan (14 January 2009). "New phishing ploy exploits secure sessions to hijack data". Retrieved 9 September 2018.
- ^ "Archived copy" (PDF). Archived from the original (PDF) on 2009-01-22. Retrieved 2009-01-20.
{{cite web}}: CS1 maint: archived copy as title (link)
External links[edit]
- New Phishing Attack Targets Online Banking Sessions With Phony Popups
- New in-session phishing attack could fool experienced users
 | This World Wide Web–related article is a stub. You can help Wikipedia by expanding it. |