Language Selection

English French German Italian Portuguese Spanish

IE pop-up spoof won't get patch

Filed under
Microsoft

Microsoft does not plan to update Internet Explorer to prevent a spoofing attack that could trick users into giving out personal information to hackers.

In the attack, JavaScript is used to display a pop-up window in front of a trusted Web site. The pop-up appears to be part of the legitimate site, but actually is linked to a different, malicious site. A user might be fooled into sending personal information to the scammers.

Although the pop-ups could be used by attackers, overlaying multiple windows in a Web browser is a feature, not a vulnerability, according to an advisory posted Tuesday on Microsoft's TechNet Web site.

"This is an example of how current standard Web browser functionality could be used in phishing attempts," Microsoft said in the advisory.
Phishing is a prevalent type of online fraud that attempts to steal sensitive information such as usernames, passwords and credit card numbers. The schemes typically combine spam e-mail and fraudulent Web pages that look like legitimate sites.

Earlier this week, security monitoring company Secunia warned of the browser problem and rated it "less critical." The issue affects most major browsers, Secunia said.

The problem is that JavaScript dialog boxes do not display or include their origin. For an attack to occur, a user would have to visit a malicious Web site or click on a link before going to a trusted site, such as that of a bank. The attacker could then overlay part of the trusted site with a window asking for data such as a user name and password. Information entered would go to the attacker, instead of the bank.

Firefox developers at the Mozilla Foundation have been making moves to combat this kind of attack. In April, a patch was developed that allows people to block Java and Flash-based pop-ups unless they came from trusted sites.

Opera has said that its latest browser, 8.01, would display the pop-up's origin, letting a user inspect its URL to see if it came from a trusted site.

Source.

More in Tux Machines

Security Leftovers

10 hot Android smartphones that got price cuts recently

With numerous smartphone getting launched each month, brands always adjust prices to give slightly competitive edge to older smartphone models and also to clear inventories. Here are 10 smartphones that got price cuts recently. Read more

Debian and Ubuntu News

  • Debian Project News - July 29th, 2016
    Welcome to this year's third issue of DPN, the newsletter for the Debian community.
  • SteamOS Brewmaster 2.87 Released With NVIDIA Pascal Support
  • Snap interfaces for sandboxed applications
    Last week, we took a look at the initial release of the "portal" framework developed for Flatpak, the application-packaging format currently being developed in GNOME. For comparison, we will also explore the corresponding resource-control framework available in the Snap format developed in Ubuntu. The two packaging projects have broadly similar end goals, as many have observed, but they tend to vary quite a bit in the implementation details. Naturally, those differences are of particular importance to the intended audience: application developers. There is some common ground between the projects. Both use some combination of techniques (namespaces, control groups, seccomp filters, etc.) to restrict what a packaged application can do. Moreover, both implement a "deny by default" sandbox, then provide a supplemental means for applications to access certain useful system resources on a restricted or mediated basis. As we will see, there is also some overlap in what interfaces are offered, although the implementations differ. Snap has been available since 2014, so its sandboxing and resource-control implementations have already seen real-world usage. That said, the design of Snap originated in the Ubuntu Touch project aimed at smartphones, so some of its assumptions are undergoing revision as Snap comes to desktop systems. In the Snap framework, the interfaces that are defined to provide access to system resources are called, simply, "interfaces." As we will see, they cover similar territory to the recently unveiled "portals" for Flatpak, but there are some key distinctions. Two classes of Snap interfaces are defined: one for the standard resources expected to be of use to end-user applications, and one designed for use by system utilities. Snap packages using the standard interfaces can be installed with the snap command-line tool (which is the equivalent of apt for .deb packages). Packages using the advanced interfaces require a separate management tool.
  • Ubuntu 15.10 (Wily Werewolf) Reaches End Of Life Today (July 28)
  • Ubuntu MATE 16.10 Yakkety Yak Gets A Unity HUD-Like Searchable Menu
    MATE HUD, a Unity HUD-like tool that allows searching through an application's menu, was recently uploaded to the official Yakkety Yak repositories, and is available (but not enabled) by default in Ubuntu MATE 16.10.

Tablet review: BQ Aquaris M10 Ubuntu Edition

As employees have become more and more flexible in recent years thanks to the power and performance of mobile devices, the way we work has changed dramatically. We frequently chop and change between smartphones, tablets and laptops for different tasks, which has led to the growth of the hybrid market – devices such as Microsoft’s Surface Pro 3 and Apple’s iPad Pro – that provide the power and functionality of a laptop with the mobility and convenience of a tablet. Read more