Next Phishing Attack Spreads its Net -- Microsoft Certified Professional Magazine Online

Next Phishing Attack Spreads its Net

Annoyed by popups? Just wail 'til you see this one.

By Russ Cooper
07/11/2005

Hacking/Denial of Service
There's a JavaScript origin spoofing vulnerability, in which a malicious Web page can be created that contains a link to a legitimate site. This link also contains code to open a JavaScript dialog box appearing to originate from the legitimate site. Microsoft released Security Advisory 902333. (Advisories, you may recall, are merely warnings from Microsoft about possible attacks; they're not patches, as Microsoft doesn't see it as a hole in a product.) Almost all browsers are vulnerable to this attack, which is most likely to manifest as a phishing attempt.

This type of attack can't be prevented without stopping a Web site from creating multiple popup dialogs. When the victim clicks on the legitimate link, a new browser window is opened to that site. Immediately thereafter, another JavaScript window is created directly on top of the legitimate window. The JavaScript window appears as if it's the inside of the legitimate window. From the victim's perspective, the contents of the malicious JavaScript window appears to be the content from the legitimate site.

So an attacker could place fields in the JavaScript window asking the victim to, for example, log into his banking site. The victim could look at the URL in the Address field of the Explorer Bar and see the legitimate address, or inspect the Status Bar and see, for example, a closed SSL lock. From all indications, the malicious input fields look legitimate.

This is just another example of how the World Wide Web was designed without security in mind. Popup advertising is a bane to most Internet users, leading to the hundreds of popup blockers. This latest attack combines popups with windows which don't appear to be complete browser windows. Both are highly desired by online advertisers, and the combination is, at least in this case, highly effective at fooling even astute and security-savvy users. The only way such an attempt could be detected would be for the user to select another window, or close one of the popup windows.

This one is almost definitely going to be put into widespread use on phishing sites.

Want More Security?

This column was originally published in our weekly Security Watch newsletter. To subscribe, click here.

A number of sites, including TechWeb, SANS, VNUNET and Gartner are reporting increased activity on TCP port 445, a port associated with Windows SMB protocol. They're speculating that the increased activity is due to attackers searching for ways to exploit the Microsoft Incoming SMB Packet Validation Remote Buffer Overflow vulnerability, which was patched in Microsoft's monthly security update for June with MS05-027.

Here's the problem with the conclusions, however: How can anyone base such speculation solely on port activity, without analyzing the actual attack code being presented? This port is amongst the most abused for attacking Windows systems, and is constantly under attack from thousands of hosts that have been compromised in the past.

Sigh ... I'm yawning.

Privacy
The FDIC has notified 6,000 current and former employees that their personal data may have been compromised in a security breach that occurred in early 2004. In several cases, the stolen data were used to obtain loans at a credit union. The FDIC says the case is one of "unauthorized release" of personal information, rather than an intrusion. The FBI is investigating.

Governance
The California Department of Managed Health Care (DMHC) has fined Kaiser Foundation Health Plan, a division of Kaiser Permanente, $200,000 for exposing the confidential health information of about 150 people. The DMHC said the information had been available on a publicly accessible Web site for as long as four years.

There's a move in California to modify a state Senate bill to include notification if customers' information on paper records or tape backups are hacked.

About the Author

Russ Cooper is a senior information security analyst with Verizon Business, Inc. He's also founder and editor of NTBugtraq, www.ntbugtraq.com, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most-recognized security experts, he's often quoted by major media outlets on security issues.