In the past six months, a dangerous new threat has emerged in the world of internet phishing. Many of us have often laughed at the crude and poorly crafted phishing explorations that often invade our in-box.
Lest any of us fall asleep at the wheel thinking we are already hip to the rather primitive phishing tactics of the past, this one could easily catch you in it’s insidious hooks if you don’t read on.
Known as “tabnapping”, this ploy is designed to psych you out with a behind-the-back switcheroo that literally kidnaps open tabs and catches most savvy observers by surprise. Using an almost invisible layer of embedded JavaScript, here’s how it works.
Brian Krebs explains:
” As Mozilla Firefox creative lead Aza Raskin describes it, the attack is as elegant as it is simple: A user has multiple tabs open, and surfs to a site that uses special javacript code to silently alter the contents of a tabbed page along with the information displayed on the tab itself, so that when the user switches back to that tab it appears to be the login page for a site the user normally visits.”
In as little as five seconds, a tabbed page silently and almost invisibly changes to a seemingly familiar page (including the cute little “favicon” in the address bar) which requires you to re-enter your log-in credentials. As soon as you enter your private details, both you and your personal information have literally been “had”.
The best defense against this tricky new tactic is to take a time-out. What that means is whenever a site you visit “times-out” , you should take some time-out of your browsing frenzy to open a new tab and re-enter the desired URL yourself.
Most browsers including Safari, Chrome, Firefox and Internet Explorer claim to be on the lookout for you by blocking tabnapping attack code. Researchers and hackers have both been able to sidestep many of the current blocking protections, leaving most browsers vulnerable.
Safety dictates that you don’t log in on any tab that you have not opened yourself. Get into the habit of opening fresh tabs whenever you enter a user-name or password.
If you forget to refresh previously opened and familiar log in pages, one day soon you could literally open up a fresh can of worms.
As Americans and the world respond to the urgent needs of the Haitian people, the dark deeds of evil people surface yet again.
