4 ms·

I don't think this is a huge step up over a standard phishing attack. A savvy user would notice that the redirected URL doesn't have an EV cert (it might not ev

I don't think this is a huge step up over a standard phishing attack. A savvy user would notice that the redirected URL doesn't have an EV cert (it might not even have SSL at all). They would probably check the email address the link came from as well. A non-savvy user would not check the email and would click any link they're sent, redirect, ssl or not. So you might as well send them a standard phishing link. This means you're targeting users inbetween these two classes, so maybe it's effective for a very specific attack. And if someone is that determined they'll get in no matter what. Plus 2fa is there on HMRC, if they request a fresh code before any major changes are made it would make it very difficult to do any serious damage.

IshKebab 9y ago
Read the actual blog: https://medium.com/@Zemnmez/how-to-hack-the-uk-tax-system-i-guess-3e84b70f8b https://medium.com/@Zemnmez/how-to-hack-the-uk-tax-system-i-... This is a perfect phishing attack (only short of being able to send a valid email from @gov.uk). The user is always on .gov.uk and it always has a valid EV certificate.
stordoff 9y ago
The redirected URL in this case is another vulnerability on www.tax.service.gov.uk, so there'd be no tells from the domain or SSL configuration. If the email was well-crafted (spoofed hmrc.gov.uk, plausible contents etc.), it'd be very difficult to notice anything was amiss (unless you spot the obfuscated javascript in the URL AND recognise that it shouldn't be there).