A new, incredibly sneaky identity-theft tactic surfaced earlier this week when Mozilla’s Aza Raskin, the creative lead of Firefox, unveiled what’s become known as “tabnapping.”
Stated simply, tabnapping — from the combination of “tab” and “kidnapping” — could be used by clever phishers to dupe users into giving up passwords by secretly changing already-open browser tabs. All of the major browsers on Windows and Mac OS X are vulnerable to the attack.
Because most people keep multiple tabs open, often for long periods, and because they trust that the contents and label of a tab are immutable, tabnapping could become the next big thing in identity theft.
That open tab labeled “Citibank” or “Facebook” may not be the real deals, Raskin argued. But you may not know that…, so you enter your username and password to, you think, log in again.
Boom! You’re owned.
Tabnapping isn’t in active circulation at the moment, but the ease with which another researcher was able to sidestep a noted Firefox add-on designed to prevent such trickery doesn’t bode well.
What can you do if tabnapping shows its face? We have a few answers.
What should I not do? Don’t log-in on a tab that you haven’t opened yourself.
Since the tabnapping tactic banks on you trusting that you opened the tab — and that the site simply timed out — the best defense is this offensive move. In other words, if you see a tab that contains a seemingly-legit log-in form, close it, then head to the site yourself in a new tab.
Will browser makers patch this? Unlikely. Microsoft’s Jerry Bryant, a general manager at the company’s security response center, said the issue isn’t a security vulnerability per se, and that Internet Explorer (IE) falls for the scam because that’s the way browsers work.
“Working with [Raskin’s] proof-of-concept, as written, is expected,” he said in an e-mail Tuesday when asked whether Microsoft had a fix in mind for IE.
Can my browser protect me at all? Yes.
Every major browser has a filter of some kind designed to weed out malicious sites and/or legitimate sites that are suspected of being infected with attack code. Presumably, those filters, assuming the blacklists underlying them are current and accurate, would block tabnapping attacks.
To kidnap tabs, a hacker has to get his tab-mutating code onto your machine somehow. Raskin pointed that out by noting the likely attack vector. “Every time you include a third-party script on your page, or a Flash widget, you leave yourself wide open for an evil doer to use your site as a staging ground for this kind of attack,” he wrote in his blog.
So the best defense browsers can currently manage is to warn you of potential attack sites before you reach them. That’s where filtering comes in.
But will my browser block tabnapping attack code from getting on my machine? Microsoft certainly thinks that IE will.
“Behind the scenes, [IE’s] SmartScreen Filter also plays a role in combating this sort of hijacking attempt,” said Microsoft’s Bryant, talking about the anti-malware/anti-phishing filter IE included. “SmartScreen successfully blocks millions of views of malicious pages each month and would help protect the user in this situation.”
Microsoft has commissioned NSS Labs to conduct several studies of filtering efficiency, most recently earlier this year. Not surprisingly, IE regularly comes out atop the chart in NSS Labs’ ensuing reports, with Apple’s Safari and Mozilla’s Firefoxfar behind, and Google’s Chrome and Opera Software’s Opera even further back.
Other browsers have tools similar to SmartScreen. In Firefox and Chrome it’s called “Phishing and Malware Protection;” Opera dubs its filter “Fraud Protection;” Safari doesn’t give it a name, but simply offers a setting that reads, “Warn when visiting a fraudulent website” in the Security section of its Preferences settings.
Anything else I can do while I use my browser to stymie tabnapping? Yes, there is. Look at the URL in your browser’s address bar before filing in any form or giving out any personal information. Unless the attackers are particularly clever and able to exploit a vulnerability or flaw to “spoof,” or fake the URL, it won’t match the bogus log-in screen.
That’s your cue to close the tab immediately.
IE8 has a feature dubbed “Domain Highlighting” that helps here: The actual domain — the xxxxx.com part — is highlighted in black, while the rest of the URL is grayed out.
Any add-ons I can try that will help? Of course. Whether they work or not is a different question.
NoScript, the premier script-blocking Firefox add-on, stops Raskin’s proof-of-concept in its tracks, since his tabnapping relies on JavaScript. But it’s not foolproof.
Israeli research Avi Raff has created code that circumvents NoScript’s defenses in Firefox to kidnap a tab. Computerworld has confirmed that Raff’s code produces a tab change even when NoScript’s installed in Firefox.
What about password managers?
Will they help here?
They can.
Third-party browser password managers — RoboFormon Windows, 1Password on Mac come to mind — link saved log-in usernames and passwords to a specific URL. Assuming you saved the username and password while at the real site’s log-in page, you’re golden: The manager won’t enter the username and password into a non-matching URL.
I’ve heard that Chrome isn’t vulnerable. True? Nope. Although several sites initially reported that Chrome didn’t fall for tabnapping — Computerworld noted that Raskin’s tactic worked some of the time on production editions — it turns out that Google’s browser had a bug that prevented kidnapping.
That bug was fixed in the Chrome developer preview build 6.0.408.1, said Raskin in a exchange of e-mails with Computerworld today. “Chrome is fully susceptible to this attack,” Raskin wrote.
Source: Computerworld