In-session phishing
In-session phishing is a form of potential phishing attack which relies on one web browsing session being able to detect the presence of another session (such as a visit to an online banking website) on the same web browser, and to then launch a pop-up window that pretends to have been opened from the targeted session. This pop-up window, which the user now believes to be part of the targeted session, is then used to steal user data in the same way as with other phishing attacks.
The advantage of in-session phishing to the attacker is that it does not need the targeted website to be compromised in any way, relying instead on a combination of data leakage within the web browser, the capacity of web browsers to run active content, the ability of modern web browsers to support more than one session at a time, and social engineering of the user.
The technique, which exploited a vulnerability in the Javascript handling of major browsers, was found by Amit Klein, CTO of security vendor Trusteer, Ltd.[1][2] Subsequent security updates to browsers may have made the technique impossible.
References[]
- ^ Kaplan, Dan (14 January 2009). "New phishing ploy exploits secure sessions to hijack data". Retrieved 9 September 2018.
- ^ "Archived copy" (PDF). Archived from the original (PDF) on 2009-01-22. Retrieved 2009-01-20.CS1 maint: archived copy as title (link)
External links[]
- New Phishing Attack Targets Online Banking Sessions With Phony Popups
- New in-session phishing attack could fool experienced users
 | This World Wide Web–related article is a stub. You can help Wikipedia by . |
- Computer security exploits
- Social engineering (computer security)
- World Wide Web stubs