12 ms·

Browser in the Browser (BITB) Attack

259 points by jcynix 5y ago

musicale 5y ago
Every time Safari pops up a "passwords are locked" box in the browser window asking for my login password in order to access saved web site passwords, I think it's a fake popup.
- donmcronald 5y ago
  I’m constantly being asked to re-enter my password by Microsoft and Google. They’re training users to type their password into anything. The OneDrive prompts on Win10 might as well be a phishing simulator. You could trick so many users just by randomly popping up one of these that pretends to be an MS365 login. Users are accustomed to the prompts and will blindly enter their credentials. Then the box will disappear and nothing will happen, just like OneDrive.
  - saltminer 5y ago
    Having worked at a place where the AWS console session only lasted an hour, I could've easily been fooled if a fake SSO prompt was placed in front of me. "Oh joy, time to login for the sixth time today."
EvanAnderson 5y ago
Browsers need the equivalent of a secure attention sequence[0]. [0] https://en.wikipedia.org/wiki/Secure_attention_key https://en.wikipedia.org/wiki/Secure_attention_key
- segfaultbuserr 5y ago
  Everything old is new again.
- rzzzt 5y ago
  The section on the key combo for Linux and its linked documentation page in the footnote says the sequence is not C2 compliant. Is it because of the location of the keys involved, or rather what they do or don't do?
  - yencabulator 5y ago
    C2 likely (it's been two decades, I can't remember!) requires more specific protections, than just "kill anything on the current tty". For example, C2 was pretty keen on only allowing a single admin connection at a time. We actually had to build a mechanism on top of SSH to guarantee that! It wouldn't surprise me if they required SAK to kick out remote users. "Bring this system fully into my control" kind of thinking.
jcynix 5y ago
Browsers, which seem to replace certain parts of current operating systems, aren't very safe. Here's one more example: "This article explores a phishing technique that simulates a browser window within the browser to spoof a legitimate domain."
- pvg 5y ago
  They are reasonably safe, given their size and complexity. They are certainly a lot safer than current widely used operating systems - those aren't designed for running unknown adversarial code at all - something a browser does all the time in typical use.
- mooreds 5y ago
  The strength of browsers (universally, near instant code deployment via URL) is also a weakness, unfortunately.
- woah 5y ago
  What alternative do you suggest?
  - jer0me 5y ago
    Opening the auth window in a tab instead of a window would help. Including an avatar and extensions in the popup window and opening it on top of the chrome on the main browser window would help to differentiate it.
    - zarq 5y ago
      Even if browsers did this, you can still execute this attack. As long as not all of your users know what the expected behavior is, you can trick them with a fake UI as long as it looks believable.
      - shakna 5y ago
        The goal is not to protect 100% of your users, it is to reduce the number of users who are currently vulnerable. One is possible, one is not. If you can significantly reduce the number of users who will fall for an attack, then it is a success, even if not everyone is protected.
bityard 5y ago
Someone at Google is going to use this as proof that the URL bar in Chrome should be hidden from the user by default, for security reasons of course.
- TobTobXX 5y ago
  Wouldn't help, would it? The Attacker would just change the template to not have a url bar (or a url bar with just the domain).
- deleted 5y ago
  [deleted]
Wojakmeme 5y ago
Reminds me of https://web.archive.org/web/20130708023749/http://jack-shepherd.co.uk/labs/fake_chrome_browser https://web.archive.org/web/20130708023749/http://jack-sheph...
pzmarzly 5y ago
I fell for that attack 2 years ago, when I had a separate Windows installation just for gaming. It was rarely used, so I didn't have a reason to customize it, and I only needed 2 or 3 password there, so I was too lazy to install my password manager (plus I feared it can get compromised in case of malicious mods, RCE bugs in games etc.). I also wasn't surprised that I was logged out, as I didn't remember where I was logged in and where I did not. I'm glad that Steam has working forms to lock an account, and that the attacker wasn't fast enough in changing email address. I wish the browsers would just open everything in new tabs.
- ShowalkKama 5y ago
  Fear not, among the millions of flags firefox exposes in about:config there is browser.link.open_newwindow.restriction that does exactly what you are looking for! Make sure to set it to 0.
  - Starmina 5y ago
    Oh, thanks a lot for this command, I finally found why LibreWolf opened everything in new tab.
a257 5y ago
These sorts of 'exploits' take advantage of the site-agnostic nature of passwords. Using a password manager may be able to mitigate this. For this particular attack, a fun 'solution' may be to incorporate some sort of AI-based detection system to warn the user if anything resembling a browser is shown on the site.
- pcthrowaway 5y ago
  A password manager would detect that the site doesn't match, so unless you copy it out of the vault directly it's likely to keep you secure.
  - Nextgrid 5y ago
    A lot of popular password managers share them across subdomains by default, so if you manage to get this on a subdomain of the target domain it'll work fine.
    - lxgr 5y ago
      If an attacker can get arbitrary content on a subdomain of your site, isn't that pretty much game over for credentials on the apex domain?
  - darepublic 5y ago
    there are various times where I copy out the password manager password because it just doesnt play well with the site. this includes big sites like aws console btw
    - saltminer 5y ago
      At least with BitWarden, when I click on the extension icon, the site in question should still show up. If I have to search for it, either the domain has changed or something smells phishy.
- miohtama 5y ago
  No, the solution is to get rid of passwords. WebAuthn is already being deployed. There will be a decade of consumer education ahead. https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn
chagaif 5y ago
This is genius I would totally fall for this. I think there's literally no difference between the phishing and real pictures. Things that would make me notice this: My auto password is not popping up (yes I use that). I could drag the window to top or make it full screen and that won't work. I could check if another window is actually open in the taskbar
- djrogers 5y ago
  >Things that would make me notice this: My auto password is not popping up On macOS with 1password, there are numerous occasions where this is the case, from SSBs and electron apps, to random other things that 1P just doesn't see. I have to copy/paste my password just often enough that I'd probably fall for this in-browser if I weren't paying much attention.
  - chagaif 5y ago
    Yep but I mean the built in chrome auto password suggestions
- godot 5y ago
  I miss the old Windows 95 days of every open window having a visible tab on the panel next to the Start menu. But of course, nowadays everyone has dozens of open applications at all times, so it's a less feasible design.
  - djbusby 5y ago
    Win95 (and newer) let apps create windows that are not visible and don't appear in taskbar.
  - ReactiveJelly 5y ago
    Well, everyone but me is dumb, then. On my Windows 10 work systems, I turn off the default "hide and collapse" behavior so I can read the window titles. I know normal users cannot read, but the titles are useful for me.
djrogers 5y ago
Wow - after 20 years of phishing variants, I've finally seen one that I'd 100% fall for. The rise of pop-up auth dialogs is something I've kinda just taken for granted as more and more platform-native apps make use of them - I wouldn't even blink if it happened to me in a browser window (until now).
- ec109685 5y ago
  Password manager is best defense given it won’t auto fill in that bogus window.
  - can16358p 5y ago
    It would need an extremely sophisticated password manager to actually fill that bogus "window".
    - ComodoHacker 5y ago
      Or extremely dumb one.
- killerontheroad 5y ago
  The only defense I have against this attack is that pop-ups annoy me and I always copy and paste the URL into my main browser window to login every time just out of spite.
- asddubs 5y ago
  it's because of the death of third party cookies. so now pop-ups are needed
- bentcorner 5y ago
  I think the only defense you could possibly have is to drag popups "outside" the main browser window. I run into this problem dealing with remote desktop windows and WU update dialogs (ok, so which machine is requesting a reboot now?). (I should theme my machines slightly differently to solve this problem). The sad thing is that even with a real popup the only defense you have is the URI, and most of the time its incomprehensible tech-speak so realistically speaking normal everyday users don't stand a chance.
philo23 5y ago
This is a super common phishing attack on Steam, people send you links that eventually lead to a "Sign in with Steam" button, which opens up one of these fake popups with a perfectly styled login page. Almost got me the first time...
olliej 5y ago
This is a benefit of password autofill systems: they aren’t looking at the visual content of the page, just the origin information. If they don’t match you don’t get autofill which is a pretty good indicator of something being off. Then the hassle of actually getting the real password and typing it in may provide yet more time to realize.
- netheril96 5y ago
  I’ve encountered many legitimate cases where the password popup doesn’t show and I have to manually copy paste.
megous 5y ago
Fringe desktop environment, with fringe setup (like non-default window name styling, use of bitmap fonts, etc.) certainly helps here. The attack would have to be very well targeted, to fool the user. I only ever fool myself with my own desktop screenshots. :D
randrews 5y ago
This attack would completely fall flat if you were using something that was posted here a couple days ago: https://hotdoglinux.com/ https://hotdoglinux.com/ The fake popup would be the only window that doesn't look like an Atari ST. :D
- metadat 5y ago
  Yes, as long as HotDogL doesn't leak the OS variant via the User-Agent string, JavaScript fingerprinting, or TCP fingerprinting. I believe CloudFlare has already developed and explored all of these paths, obviously to great effect. This means replication of what CF has done is only a matter of pouring resources into it, surely many others have also completed bits and pieces or maybe even superior top-secret proprietary technology. What's that Ultra-privacy oriented Linux distro which is TOR-centric, with a locked-down-by-default browser config? That beast might be your best bet.
  - smaudet 5y ago
    It's actually not about the browser config, its all about the graphics - this reminds me in firefox you could customize the UI easily with an overlay image. That would defeat this attack, assuming it was random/undetectable. Maybe time to go the other way and never lock down the config... Or just disable anything resembling a box in the browser, make html strictly hyper text media again, no programming or js.
    - metadat 5y ago
      I love this idea, wish this was a standard feature implemented in many of my applications and operating systems. Also.. setting a custom UI background image sounds like browser configuration to me :p Seriously though, the difference with and genius in your idea is essentially applying the "Send my bank a custom secret they then present to me so I know if I'm really speaking with them", except with new twists in: 1. Know if a window belongs to my FF client / OS / whatever needs securing. 2. The absence of further concerns about what OS details get inevitably leaked, at least for protecting against this one class of threat.
hgomersall 5y ago
I was expecting a wasm browser inside the browser. I'm sure you could do something really rather sophisticated with that. No idea what though.
- Capira 5y ago
  maybe fix dns?
- EvanAnderson 5y ago
  That's coming. It will be used to deliver un-blockable ads, though.
  - semitones 5y ago
    Sad, but likely.
- rzzzt 5y ago
  There's a project which adds a second location bar in the viewport for older browsers (going back to IE 5-ish days, I think), then lets you browse modern websites with it by rendering them headless and only sending over image maps. It was also featured on HN back in the day. I was thinking that with a WASM port of a browser engine you could do the rendering on the client side as well, but you'd have to use a host modern enough to run WASM in the first place so... not a great idea on my part
ElectronShak 5y ago
Very interesting, and certainly hard to catch, even for technical users. Maybe it is things like this where google is justified for "forcing" 2FA on us. Lowers, although minimally, the effectiveness of auth credential attacks.
- jcynix 5y ago
  You cannot move the fake window out of its parent, but you can do this with a proper popup window. So it can be "catched" but this is (at least) inconvenient and easy to forget. As is 2FA, e.g. when I'm using a tablet in bed and the smartphone for the 2nd factor is on the table in the living room ... I'd like to see 2FA devices which could be easily duplicated, just as physical keys can.
  - djrogers 5y ago
    > I'd like to see 2FA devices which could be easily duplicated, just as physical keys can. Many can - what phone based 2fa are you using that can’t sync to your iPad?
    - jcynix 5y ago
      OK. I was in bed already when writing this, so didn't properly describe the features of physical keys I value. And, btw, most of the time it's a lightweight laptop, not a tablet. "Tablet" was a "placeholder" for just any other mobile reading device. While I could duplicate 2FA credentials onto another device, even onto my wife's device (if needed, e.g. for online banking), the attractive feature of a _physical_ key is that I can control the number of copies and "revoke" one after handing it over for a short time and then recollect the device again. That's not as easy with virtual "keys" like authentication apps. At work, we use smartcards to store credentials (i.e. X.509 certificates). And you are allowed to get a second and even third card, if needed. So I can have one in the office, and one at home. All are protected by their respective PINs. And we do have bluetooth based card readers for smartphones. That (possibly miniaturized like a yubikey) is my preferred model of a "physical" device to use as a key.
deleted 5y ago
[deleted]
kybernetikos 5y ago
Maybe windows containing password entry boxes should be forced to overlap the browser chrome of their opener.
mikotodomo 5y ago
This appears to be unfixable.
- ramesh31 5y ago
  It reveals the fundamental security flaw that is the username/password system in general.
pcthrowaway 5y ago
Another potential mitigation for this would be for browsers to include a unique, user-specific, favicon-sized image in the address bar next to the lock. If the image doesn't match the one you see everywhere else, you know it's a phishing attack.
- bandie91 5y ago
  or it'd be nice if people weren't have to play hide-and-seek, schwarzer-peter, and spot-the-difference games when just want to browse the damn internet.
  - semitones 5y ago
    An incredibly large amount of the complexity that exists in today's internet infrastructure could be eliminated if we didn't have to worry about security/trust. No need for HTTPS, encryption, or even passwords for that matter (in a perfect world where everyone is who they say they are). No need for certificates, no need for public/private keys, no need for ASLR, etc. Of course, these protect against more than just malicious behavior, they also provide safeguards against human error. However, in a world where malicious behavior didn't exist, many of their designs could have probably been far simplified..
    - smaudet 5y ago
      Hmm, for web forms this has been overcomplicated for the past decade...without needing to worry about security even. In a trusted world, you still need to worry about order of operations, resource exhaustion, and redundant resiliency...as these are forms of addl complexity perhaps we should get rid of the internet itself... Distributed systems localize all complexity and don't suffer the same sorts of security issues... The answer to "who is this" is still a problem if only we could program based upon how they behave versus who they are... In a world where components themselves acted independently of their masters intentions, you might be able to make this work. Computers would have to act very differently, almost self computing systems. Perhaps what I'm describing is a world run by robots, and so in the absence of proof they would treat us better than we do ourselves, perhaps a bit of consistent pain is worthwhile.
deleted 5y ago
[deleted]
recroad 5y ago
How is he making the URL in the popup look legit?
- r3trohack3r 5y ago
  AFAICT it’s not a popup. The “window” is actually a DOM element designed to look like a window floating over the web page. The entire “window”, url bar and all, is just a cleverly disguised part of the phishing website.
  - recroad 5y ago
    Aah, I see. Thank you.
wanderingmind 5y ago
I use bitwarden, but on rare occasions when i need type passwd, I always type the wrong password first time just to be safe. I have always had this fear of spoofing which now looks very real.
- LadyCailin 5y ago
  Pretty easy to just proxy the password through to the real service, and see if it fails or not before adding it to your pwn DB.
- Thorrez 5y ago
  If you're worried about this attack in particular, then drag the window above the line of death. https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/ Now, if you got put into fullscreen mode without realizing it, that's another problem.
rq1 5y ago
What would it look like on i3? :)
userbinator 5y ago
Very few people would notice the slight differences between the two. My browser always shows the URL scheme, and my UI looks nothing like that, so I guess this is another point in favour of people customising their UI and a point against browsers letting websites modify the appearance of things like scrollbars and form controls, or --- and I really don't understand why no one thought this was a really bad idea to even implement at all --- allowing popups with no browser controls. I don't think this is such a novel idea either --- remember the fake "your computer is infected click here" popups that tried to look like the OS's? I've always used something other than the defaults for UI appearance, so besides the more obvious clues like having browser controls, they really looked off with things like their different titlebar colour and font.
- bastawhiz 5y ago
  It's not a pop-up, it's a browser simulated with DOM elements inside the page. The attack bets that you don't notice that it's not actually a new operating system window and instead is just a part of the page you're on. The author includes default "skins" for both windows and macOS.
- Thorrez 5y ago
  You might notice it, but according to this, most people wouldn't: >“It’s a picture of an IE7 browser running on Windows Vista in the transparent Aero Glass theme with a page containing a JPEG of an IE7 browser running on Windows XP in the Luna aka Fisher Price theme?” I pointed out. >“Oh. Huh.” they noted. https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/
  - userbinator 5y ago
    Most people probably also have no adblocker, so are being subjected to visual overload all the time they're browsing. I could definitely see that causing them to stop noticing things, if they're already spending a lot of (possibly unconscious) effort filtering out all the ads and other distractions on a page.
- meibo 5y ago
teaearlgraycold 5y ago
BITB will work much better once we can compile and run popular browsers via WASM. Just look up the user agent, find the matching browser and render it to a draggable canvas. Obviously you'll find something off if you're not using Windows/MacOS. But that still leaves 99% of desktop users vulnerable.
- zamadatix 5y ago
  Browsers via WASM doesn't gain you anything unless you're also shipping the matching OS via WASM which, even if that happens to be Windows 2000, isn't going to be fast enough to be believable. Without shipping the OS all you've got is a really weird looking browser window that still takes forever to load and run.
- can16358p 5y ago
  With some clever animations it can even phish a majority of the mobile too, like some Safari new tab sliding into view. They probably can't exactly replicate it as they can't actually move the address bar and title views etc. but they'd pull something good enough to get most of the non tech-savvy mobile users.
- mhh__ 5y ago
  Latency might be a tell. Shipping chrome as WASM can't be cheap
ReactiveJelly 5y ago
The red death zones strike again https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/ Seems like web browsers aren't really secure enough for anything that needs a password anymore.
- deleted 5y ago
  [deleted]
underwater 5y ago
I find it weird to publish this as a repo. The idea is fairly obvious, and has been used in the wild for decades. All this does is lower the effort an attacker needs to invest to replicate it. It's pointing out bike locks are callable and then handing out free bolt cutters to whoever walks by.
- zamadatix 5y ago
  I think you'd be surprised how many laugh about people who click fake static windows in ad areas compared to how many have thought "this popup login window could be fake" when using 3rd party authentication on a site. The latter isn't new but it's certainly less commonly known/talked about. And if it's been in the wild for decades then people are already going around with bolt cutters, it's probably good people without bolt cutters understand that.
Thorrez 5y ago
I thought this was called "Picture-in-Picture attack" http://www.usablesecurity.org/papers/jackson.pdf http://www.usablesecurity.org/papers/jackson.pdf
charcircuit 5y ago
This has been around for years. I usually see it with fake steam logins. It's obvious when you see W10 decorations when you are on Linux.
bxclltkfz 5y ago
mrdevops 5y ago
I have came across this attack once. What happened was when I opened a webpage (torrent listing page),I don’t remember which one it opened a popup and they made it fullscreen, and it was saying that I had visited some bad webpage and govt has found it and I should pay some amount (~300 USD) to get my computer unlocked, I checked the domain and it was the gov domain. And it was asking me my credit card details. I felt something is wrong and pressed the esc button and chrome minimised the screen. Then I saw 2 title bars, I have inspected the webpage and found that they are drawing custom title bars. A lot of people would have fallen for this.
tbt 5y ago
The browser could give the user a unique popup style (colored borders, etc.). As long as that info is hidden, this attack would have only a tiny chance of succeeding.
can16358p 5y ago
Another important reason to use a password manager.
benatkin 5y ago
In the near future we could be saying "this is why we can't have nice things" or this could be used as a justification for further reduction of privacy. A remote AI could view every page in a cloud browser and alert us when the page looked like a browser. Come to think of it I heard of a newfangled cloud browser a few months ago. On the "this is why we can't have nice things" area we could have something like the orange dot that shows when an app is using the mic on os x, and makes experiences that involve a mic a bit less immersive. https://www.reddit.com/r/MacOS/comments/qhbt4n/how_to_disable_orange_dot/ https://www.reddit.com/r/MacOS/comments/qhbt4n/how_to_disabl...
DeathArrow 5y ago
The attack is quite good, it'll probably work in many cases. I wonder why I would land on a dubious website, and why I would want to log in on it. While the attack might work, I doubt the most of accounts collected would be very valuable for the attacker. It would be mostly people looking for free porn or broke people trying to pirate some movie.
- vladvasiliu 5y ago
  > I wonder why I would land on a dubious website, and why I would want to log in on it. Random phishing attacks via e-mail? Someone posing as a colleague or whatever, telling people to use this new thing for whatever reason, like a dubious OneDrive link. Bonus credibility points: it uses login with MS, so it must be legit, since we're all using Office365! Plus, random-non-tech-literate person won't be tipped off by MS requiring another login, especially since they've been trained by IT to log in very often thanks to ridiculously short session durations.
pimterry 5y ago
Finally, an attack that redefines my tiling window manager addiction as a security measure.
mschuster91 5y ago
Thought experiment: what about an actual BITB attack? With the browser being painted on a Canvas element and rendered by either the client itself with WASM or on a remote server and an X client running in the user's browser?
raghava 5y ago
Possible mitigation measure: 1. If identity providers start offering a dynamic, trusted element within the critical pages (login, password prompt, 2FA/OTP verification etc) 2. if such dynamic element is from a known range/set of customer/trusted-party supplied identity elements. Ex. During my account creation, say I am prompted to select some "secret identity themes", and I choose { batman, bike, carrots } At the login/password/OTP prompt, I am shown a 3x3 grid of pics / words / hints, which have at least 3 (or whatever configurable number, in my account preferences) that are somehow connected to my "secret identity theme". This way, I know I can trust this page. The grid also has many unrelated ones acting as decoys elements, so that any malicious spoofing party cannot really figure them out. I believe you get the general idea. Do y'all feel this can possibly help, in mitigating this very serious & very harmful threat? I intend to write a short post on this soon.
- noodlesUK 5y ago
  I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content. https://github.com/drk1wi/Modlishka https://github.com/drk1wi/Modlishka
  - raghava 5y ago
    Yes. That's why a cluster of elements for a "secret identity theme", instead of just one image. (After all, infosec/security is finally just a game of making reward-to-effort ratio too impractical for most threat-actors & thus achieve reasonable 'sense of security', in a world where exploits exist for almost every ring in the stack - including ring 0) I feel BITB mostly gets used by those who may not really be having access to lob a proxy attack at the intended target as well, which filters a good set, among potential victims.
    - hapidjus 5y ago
      Maybe I’m misunderstanding but what’s preventing you from passing on the cluster?
ChiptuneIsCool 5y ago
I don't think this attack can be used on a large scale because if the browser has a custom theme you will quickly notice that the popup is not from the browser. If it is used on one person, customizing the popup for his specific browser is almost impossible to notice it
- pyhtel 5y ago
  Vast majority of people tend to stick to the default theme. And of course, those also tend to be the most vulnerable to phishing attacks
jethack 5y ago
Worth noting these have been in the wild for years. It's often used to phish for Steam accounts. BTW, if you're using TOPT 2FA, that typically gets phished too.
DrBoring 5y ago
I foresaw this attack years ago. It makes me feel a bit smug to see it implemented. My idea used the same modus operandi: sniff the victim's OS and browser, and present to them a UI custom tailored to fool them. I always thought the ability to open a browser window without a navigation bar was a terrible idea. Not just because of this attack: I always want to see the URL I'm visiting. Tangent: I was using the Minecraft Launcher GDLauncher, and it pops a nav-bar-less browser window for the purpose of logging into my Microsoft account [1]. It felt so suspicious, not being able to confirm I wasn't being phished. To make matters worse, if you click the "I can't use my Authentication app right now" button on the nav-bar-less browser window, it triggers a password reset email, not an I-can-indeed-access-this-email-account confirmation email. [1] You need to present a Microsoft token to play Minecraft online.
throwaway581294 5y ago
New security tip, drag every login pop-up windows outside of your browser.. if the window can move out of the browser.. it's (more likely) legit (or at least you know the address bar is real to check), if it doesn't then you're being phished.
seltzered_ 5y ago
I miss the days of well-known companies criticizing oauth: https://web.archive.org/web/20160213213455/http://blog.mailchimp.com/social-login-buttons-arent-worth-it/ https://web.archive.org/web/20160213213455/http://blog.mailc... - MailChimp, "social login buttons aren't worth it", 2012

259 points by jcynix 5y ago

Every time Safari pops up a "passwords are locked" box in the browser window asking for my login password in order to access saved web site passwords, I think it's a fake popup.

donmcronald 5y ago
I’m constantly being asked to re-enter my password by Microsoft and Google. They’re training users to type their password into anything. The OneDrive prompts on Win10 might as well be a phishing simulator. You could trick so many users just by randomly popping up one of these that pretends to be an MS365 login. Users are accustomed to the prompts and will blindly enter their credentials. Then the box will disappear and nothing will happen, just like OneDrive.
- saltminer 5y ago
  Having worked at a place where the AWS console session only lasted an hour, I could've easily been fooled if a fake SSO prompt was placed in front of me. "Oh joy, time to login for the sixth time today."

EvanAnderson 5y ago

Browsers need the equivalent of a secure attention sequence[0]. [0] https://en.wikipedia.org/wiki/Secure_attention_key https://en.wikipedia.org/wiki/Secure_attention_key

segfaultbuserr 5y ago
Everything old is new again.
rzzzt 5y ago
The section on the key combo for Linux and its linked documentation page in the footnote says the sequence is not C2 compliant. Is it because of the location of the keys involved, or rather what they do or don't do?
- yencabulator 5y ago
  C2 likely (it's been two decades, I can't remember!) requires more specific protections, than just "kill anything on the current tty". For example, C2 was pretty keen on only allowing a single admin connection at a time. We actually had to build a mechanism on top of SSH to guarantee that! It wouldn't surprise me if they required SAK to kick out remote users. "Bring this system fully into my control" kind of thinking.

jcynix 5y ago

Browsers, which seem to replace certain parts of current operating systems, aren't very safe. Here's one more example: "This article explores a phishing technique that simulates a browser window within the browser to spoof a legitimate domain."

pvg 5y ago
They are reasonably safe, given their size and complexity. They are certainly a lot safer than current widely used operating systems - those aren't designed for running unknown adversarial code at all - something a browser does all the time in typical use.
mooreds 5y ago
The strength of browsers (universally, near instant code deployment via URL) is also a weakness, unfortunately.
woah 5y ago
What alternative do you suggest?
- jer0me 5y ago
  Opening the auth window in a tab instead of a window would help. Including an avatar and extensions in the popup window and opening it on top of the chrome on the main browser window would help to differentiate it.
  - zarq 5y ago
    Even if browsers did this, you can still execute this attack. As long as not all of your users know what the expected behavior is, you can trick them with a fake UI as long as it looks believable.
    - shakna 5y ago
      The goal is not to protect 100% of your users, it is to reduce the number of users who are currently vulnerable. One is possible, one is not. If you can significantly reduce the number of users who will fall for an attack, then it is a success, even if not everyone is protected.

bityard 5y ago

Someone at Google is going to use this as proof that the URL bar in Chrome should be hidden from the user by default, for security reasons of course.

TobTobXX 5y ago
Wouldn't help, would it? The Attacker would just change the template to not have a url bar (or a url bar with just the domain).
deleted 5y ago
[deleted]

Wojakmeme 5y ago

Reminds me of https://web.archive.org/web/20130708023749/http://jack-shepherd.co.uk/labs/fake_chrome_browser https://web.archive.org/web/20130708023749/http://jack-sheph...

pzmarzly 5y ago

I fell for that attack 2 years ago, when I had a separate Windows installation just for gaming. It was rarely used, so I didn't have a reason to customize it, and I only needed 2 or 3 password there, so I was too lazy to install my password manager (plus I feared it can get compromised in case of malicious mods, RCE bugs in games etc.). I also wasn't surprised that I was logged out, as I didn't remember where I was logged in and where I did not. I'm glad that Steam has working forms to lock an account, and that the attacker wasn't fast enough in changing email address. I wish the browsers would just open everything in new tabs.

ShowalkKama 5y ago
Fear not, among the millions of flags firefox exposes in about:config there is browser.link.open_newwindow.restriction that does exactly what you are looking for! Make sure to set it to 0.
- Starmina 5y ago
  Oh, thanks a lot for this command, I finally found why LibreWolf opened everything in new tab.

a257 5y ago

These sorts of 'exploits' take advantage of the site-agnostic nature of passwords. Using a password manager may be able to mitigate this. For this particular attack, a fun 'solution' may be to incorporate some sort of AI-based detection system to warn the user if anything resembling a browser is shown on the site.

pcthrowaway 5y ago
A password manager would detect that the site doesn't match, so unless you copy it out of the vault directly it's likely to keep you secure.
- Nextgrid 5y ago
  A lot of popular password managers share them across subdomains by default, so if you manage to get this on a subdomain of the target domain it'll work fine.
  - lxgr 5y ago
    If an attacker can get arbitrary content on a subdomain of your site, isn't that pretty much game over for credentials on the apex domain?
- darepublic 5y ago
  there are various times where I copy out the password manager password because it just doesnt play well with the site. this includes big sites like aws console btw
  - saltminer 5y ago
    At least with BitWarden, when I click on the extension icon, the site in question should still show up. If I have to search for it, either the domain has changed or something smells phishy.
miohtama 5y ago
No, the solution is to get rid of passwords. WebAuthn is already being deployed. There will be a decade of consumer education ahead. https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn

chagaif 5y ago

This is genius I would totally fall for this. I think there's literally no difference between the phishing and real pictures. Things that would make me notice this: My auto password is not popping up (yes I use that). I could drag the window to top or make it full screen and that won't work. I could check if another window is actually open in the taskbar

djrogers 5y ago
>Things that would make me notice this: My auto password is not popping up On macOS with 1password, there are numerous occasions where this is the case, from SSBs and electron apps, to random other things that 1P just doesn't see. I have to copy/paste my password just often enough that I'd probably fall for this in-browser if I weren't paying much attention.
- chagaif 5y ago
  Yep but I mean the built in chrome auto password suggestions
godot 5y ago
I miss the old Windows 95 days of every open window having a visible tab on the panel next to the Start menu. But of course, nowadays everyone has dozens of open applications at all times, so it's a less feasible design.
- djbusby 5y ago
  Win95 (and newer) let apps create windows that are not visible and don't appear in taskbar.
- ReactiveJelly 5y ago
  Well, everyone but me is dumb, then. On my Windows 10 work systems, I turn off the default "hide and collapse" behavior so I can read the window titles. I know normal users cannot read, but the titles are useful for me.

djrogers 5y ago

Wow - after 20 years of phishing variants, I've finally seen one that I'd 100% fall for. The rise of pop-up auth dialogs is something I've kinda just taken for granted as more and more platform-native apps make use of them - I wouldn't even blink if it happened to me in a browser window (until now).

ec109685 5y ago
Password manager is best defense given it won’t auto fill in that bogus window.
- can16358p 5y ago
  It would need an extremely sophisticated password manager to actually fill that bogus "window".
  - ComodoHacker 5y ago
    Or extremely dumb one.
killerontheroad 5y ago
The only defense I have against this attack is that pop-ups annoy me and I always copy and paste the URL into my main browser window to login every time just out of spite.
asddubs 5y ago
it's because of the death of third party cookies. so now pop-ups are needed
bentcorner 5y ago
I think the only defense you could possibly have is to drag popups "outside" the main browser window. I run into this problem dealing with remote desktop windows and WU update dialogs (ok, so which machine is requesting a reboot now?). (I should theme my machines slightly differently to solve this problem). The sad thing is that even with a real popup the only defense you have is the URI, and most of the time its incomprehensible tech-speak so realistically speaking normal everyday users don't stand a chance.

philo23 5y ago

This is a super common phishing attack on Steam, people send you links that eventually lead to a "Sign in with Steam" button, which opens up one of these fake popups with a perfectly styled login page. Almost got me the first time...

olliej 5y ago

This is a benefit of password autofill systems: they aren’t looking at the visual content of the page, just the origin information. If they don’t match you don’t get autofill which is a pretty good indicator of something being off. Then the hassle of actually getting the real password and typing it in may provide yet more time to realize.

netheril96 5y ago
I’ve encountered many legitimate cases where the password popup doesn’t show and I have to manually copy paste.

megous 5y ago

Fringe desktop environment, with fringe setup (like non-default window name styling, use of bitmap fonts, etc.) certainly helps here. The attack would have to be very well targeted, to fool the user. I only ever fool myself with my own desktop screenshots. :D

randrews 5y ago

This attack would completely fall flat if you were using something that was posted here a couple days ago: https://hotdoglinux.com/ https://hotdoglinux.com/ The fake popup would be the only window that doesn't look like an Atari ST. :D

metadat 5y ago
Yes, as long as HotDogL doesn't leak the OS variant via the User-Agent string, JavaScript fingerprinting, or TCP fingerprinting. I believe CloudFlare has already developed and explored all of these paths, obviously to great effect. This means replication of what CF has done is only a matter of pouring resources into it, surely many others have also completed bits and pieces or maybe even superior top-secret proprietary technology. What's that Ultra-privacy oriented Linux distro which is TOR-centric, with a locked-down-by-default browser config? That beast might be your best bet.
- smaudet 5y ago
  It's actually not about the browser config, its all about the graphics - this reminds me in firefox you could customize the UI easily with an overlay image. That would defeat this attack, assuming it was random/undetectable. Maybe time to go the other way and never lock down the config... Or just disable anything resembling a box in the browser, make html strictly hyper text media again, no programming or js.
  - metadat 5y ago
    I love this idea, wish this was a standard feature implemented in many of my applications and operating systems. Also.. setting a custom UI background image sounds like browser configuration to me :p Seriously though, the difference with and genius in your idea is essentially applying the "Send my bank a custom secret they then present to me so I know if I'm really speaking with them", except with new twists in: 1. Know if a window belongs to my FF client / OS / whatever needs securing. 2. The absence of further concerns about what OS details get inevitably leaked, at least for protecting against this one class of threat.

hgomersall 5y ago

I was expecting a wasm browser inside the browser. I'm sure you could do something really rather sophisticated with that. No idea what though.

Capira 5y ago
maybe fix dns?
EvanAnderson 5y ago
That's coming. It will be used to deliver un-blockable ads, though.
- semitones 5y ago
  Sad, but likely.
rzzzt 5y ago
There's a project which adds a second location bar in the viewport for older browsers (going back to IE 5-ish days, I think), then lets you browse modern websites with it by rendering them headless and only sending over image maps. It was also featured on HN back in the day. I was thinking that with a WASM port of a browser engine you could do the rendering on the client side as well, but you'd have to use a host modern enough to run WASM in the first place so... not a great idea on my part

ElectronShak 5y ago

Very interesting, and certainly hard to catch, even for technical users. Maybe it is things like this where google is justified for "forcing" 2FA on us. Lowers, although minimally, the effectiveness of auth credential attacks.

jcynix 5y ago
You cannot move the fake window out of its parent, but you can do this with a proper popup window. So it can be "catched" but this is (at least) inconvenient and easy to forget. As is 2FA, e.g. when I'm using a tablet in bed and the smartphone for the 2nd factor is on the table in the living room ... I'd like to see 2FA devices which could be easily duplicated, just as physical keys can.
- djrogers 5y ago
  > I'd like to see 2FA devices which could be easily duplicated, just as physical keys can. Many can - what phone based 2fa are you using that can’t sync to your iPad?
  - jcynix 5y ago
    OK. I was in bed already when writing this, so didn't properly describe the features of physical keys I value. And, btw, most of the time it's a lightweight laptop, not a tablet. "Tablet" was a "placeholder" for just any other mobile reading device. While I could duplicate 2FA credentials onto another device, even onto my wife's device (if needed, e.g. for online banking), the attractive feature of a _physical_ key is that I can control the number of copies and "revoke" one after handing it over for a short time and then recollect the device again. That's not as easy with virtual "keys" like authentication apps. At work, we use smartcards to store credentials (i.e. X.509 certificates). And you are allowed to get a second and even third card, if needed. So I can have one in the office, and one at home. All are protected by their respective PINs. And we do have bluetooth based card readers for smartphones. That (possibly miniaturized like a yubikey) is my preferred model of a "physical" device to use as a key.

deleted 5y ago

[deleted]

kybernetikos 5y ago

Maybe windows containing password entry boxes should be forced to overlap the browser chrome of their opener.

mikotodomo 5y ago

This appears to be unfixable.

ramesh31 5y ago
It reveals the fundamental security flaw that is the username/password system in general.

pcthrowaway 5y ago

Another potential mitigation for this would be for browsers to include a unique, user-specific, favicon-sized image in the address bar next to the lock. If the image doesn't match the one you see everywhere else, you know it's a phishing attack.

bandie91 5y ago
or it'd be nice if people weren't have to play hide-and-seek, schwarzer-peter, and spot-the-difference games when just want to browse the damn internet.
- semitones 5y ago
  An incredibly large amount of the complexity that exists in today's internet infrastructure could be eliminated if we didn't have to worry about security/trust. No need for HTTPS, encryption, or even passwords for that matter (in a perfect world where everyone is who they say they are). No need for certificates, no need for public/private keys, no need for ASLR, etc. Of course, these protect against more than just malicious behavior, they also provide safeguards against human error. However, in a world where malicious behavior didn't exist, many of their designs could have probably been far simplified..
  - smaudet 5y ago
    Hmm, for web forms this has been overcomplicated for the past decade...without needing to worry about security even. In a trusted world, you still need to worry about order of operations, resource exhaustion, and redundant resiliency...as these are forms of addl complexity perhaps we should get rid of the internet itself... Distributed systems localize all complexity and don't suffer the same sorts of security issues... The answer to "who is this" is still a problem if only we could program based upon how they behave versus who they are... In a world where components themselves acted independently of their masters intentions, you might be able to make this work. Computers would have to act very differently, almost self computing systems. Perhaps what I'm describing is a world run by robots, and so in the absence of proof they would treat us better than we do ourselves, perhaps a bit of consistent pain is worthwhile.

deleted 5y ago

[deleted]

recroad 5y ago

How is he making the URL in the popup look legit?

r3trohack3r 5y ago
AFAICT it’s not a popup. The “window” is actually a DOM element designed to look like a window floating over the web page. The entire “window”, url bar and all, is just a cleverly disguised part of the phishing website.
- recroad 5y ago
  Aah, I see. Thank you.

wanderingmind 5y ago

I use bitwarden, but on rare occasions when i need type passwd, I always type the wrong password first time just to be safe. I have always had this fear of spoofing which now looks very real.

LadyCailin 5y ago
Pretty easy to just proxy the password through to the real service, and see if it fails or not before adding it to your pwn DB.
Thorrez 5y ago
If you're worried about this attack in particular, then drag the window above the line of death. https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/ Now, if you got put into fullscreen mode without realizing it, that's another problem.

rq1 5y ago

What would it look like on i3? :)

userbinator 5y ago

Very few people would notice the slight differences between the two. My browser always shows the URL scheme, and my UI looks nothing like that, so I guess this is another point in favour of people customising their UI and a point against browsers letting websites modify the appearance of things like scrollbars and form controls, or --- and I really don't understand why no one thought this was a really bad idea to even implement at all --- allowing popups with no browser controls. I don't think this is such a novel idea either --- remember the fake "your computer is infected click here" popups that tried to look like the OS's? I've always used something other than the defaults for UI appearance, so besides the more obvious clues like having browser controls, they really looked off with things like their different titlebar colour and font.

bastawhiz 5y ago
It's not a pop-up, it's a browser simulated with DOM elements inside the page. The attack bets that you don't notice that it's not actually a new operating system window and instead is just a part of the page you're on. The author includes default "skins" for both windows and macOS.
Thorrez 5y ago
You might notice it, but according to this, most people wouldn't: >“It’s a picture of an IE7 browser running on Windows Vista in the transparent Aero Glass theme with a page containing a JPEG of an IE7 browser running on Windows XP in the Luna aka Fisher Price theme?” I pointed out. >“Oh. Huh.” they noted. https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/
- userbinator 5y ago
  Most people probably also have no adblocker, so are being subjected to visual overload all the time they're browsing. I could definitely see that causing them to stop noticing things, if they're already spending a lot of (possibly unconscious) effort filtering out all the ads and other distractions on a page.
meibo 5y ago

teaearlgraycold 5y ago

BITB will work much better once we can compile and run popular browsers via WASM. Just look up the user agent, find the matching browser and render it to a draggable canvas. Obviously you'll find something off if you're not using Windows/MacOS. But that still leaves 99% of desktop users vulnerable.

zamadatix 5y ago
Browsers via WASM doesn't gain you anything unless you're also shipping the matching OS via WASM which, even if that happens to be Windows 2000, isn't going to be fast enough to be believable. Without shipping the OS all you've got is a really weird looking browser window that still takes forever to load and run.
can16358p 5y ago
With some clever animations it can even phish a majority of the mobile too, like some Safari new tab sliding into view. They probably can't exactly replicate it as they can't actually move the address bar and title views etc. but they'd pull something good enough to get most of the non tech-savvy mobile users.
mhh__ 5y ago
Latency might be a tell. Shipping chrome as WASM can't be cheap

ReactiveJelly 5y ago

The red death zones strike again https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/ Seems like web browsers aren't really secure enough for anything that needs a password anymore.

deleted 5y ago
[deleted]

underwater 5y ago

I find it weird to publish this as a repo. The idea is fairly obvious, and has been used in the wild for decades. All this does is lower the effort an attacker needs to invest to replicate it. It's pointing out bike locks are callable and then handing out free bolt cutters to whoever walks by.

zamadatix 5y ago
I think you'd be surprised how many laugh about people who click fake static windows in ad areas compared to how many have thought "this popup login window could be fake" when using 3rd party authentication on a site. The latter isn't new but it's certainly less commonly known/talked about. And if it's been in the wild for decades then people are already going around with bolt cutters, it's probably good people without bolt cutters understand that.

Thorrez 5y ago

I thought this was called "Picture-in-Picture attack" http://www.usablesecurity.org/papers/jackson.pdf http://www.usablesecurity.org/papers/jackson.pdf

charcircuit 5y ago

This has been around for years. I usually see it with fake steam logins. It's obvious when you see W10 decorations when you are on Linux.

bxclltkfz 5y ago

mrdevops 5y ago

I have came across this attack once. What happened was when I opened a webpage (torrent listing page),I don’t remember which one it opened a popup and they made it fullscreen, and it was saying that I had visited some bad webpage and govt has found it and I should pay some amount (~300 USD) to get my computer unlocked, I checked the domain and it was the gov domain. And it was asking me my credit card details. I felt something is wrong and pressed the esc button and chrome minimised the screen. Then I saw 2 title bars, I have inspected the webpage and found that they are drawing custom title bars. A lot of people would have fallen for this.

tbt 5y ago

The browser could give the user a unique popup style (colored borders, etc.). As long as that info is hidden, this attack would have only a tiny chance of succeeding.

can16358p 5y ago

Another important reason to use a password manager.

benatkin 5y ago

In the near future we could be saying "this is why we can't have nice things" or this could be used as a justification for further reduction of privacy. A remote AI could view every page in a cloud browser and alert us when the page looked like a browser. Come to think of it I heard of a newfangled cloud browser a few months ago. On the "this is why we can't have nice things" area we could have something like the orange dot that shows when an app is using the mic on os x, and makes experiences that involve a mic a bit less immersive. https://www.reddit.com/r/MacOS/comments/qhbt4n/how_to_disable_orange_dot/ https://www.reddit.com/r/MacOS/comments/qhbt4n/how_to_disabl...

DeathArrow 5y ago

The attack is quite good, it'll probably work in many cases. I wonder why I would land on a dubious website, and why I would want to log in on it. While the attack might work, I doubt the most of accounts collected would be very valuable for the attacker. It would be mostly people looking for free porn or broke people trying to pirate some movie.

vladvasiliu 5y ago
> I wonder why I would land on a dubious website, and why I would want to log in on it. Random phishing attacks via e-mail? Someone posing as a colleague or whatever, telling people to use this new thing for whatever reason, like a dubious OneDrive link. Bonus credibility points: it uses login with MS, so it must be legit, since we're all using Office365! Plus, random-non-tech-literate person won't be tipped off by MS requiring another login, especially since they've been trained by IT to log in very often thanks to ridiculously short session durations.

pimterry 5y ago

Finally, an attack that redefines my tiling window manager addiction as a security measure.

mschuster91 5y ago

Thought experiment: what about an actual BITB attack? With the browser being painted on a Canvas element and rendered by either the client itself with WASM or on a remote server and an X client running in the user's browser?

raghava 5y ago

Possible mitigation measure: 1. If identity providers start offering a dynamic, trusted element within the critical pages (login, password prompt, 2FA/OTP verification etc) 2. if such dynamic element is from a known range/set of customer/trusted-party supplied identity elements. Ex. During my account creation, say I am prompted to select some "secret identity themes", and I choose { batman, bike, carrots } At the login/password/OTP prompt, I am shown a 3x3 grid of pics / words / hints, which have at least 3 (or whatever configurable number, in my account preferences) that are somehow connected to my "secret identity theme". This way, I know I can trust this page. The grid also has many unrelated ones acting as decoys elements, so that any malicious spoofing party cannot really figure them out. I believe you get the general idea. Do y'all feel this can possibly help, in mitigating this very serious & very harmful threat? I intend to write a short post on this soon.

noodlesUK 5y ago
I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content. https://github.com/drk1wi/Modlishka https://github.com/drk1wi/Modlishka
- raghava 5y ago
  Yes. That's why a cluster of elements for a "secret identity theme", instead of just one image. (After all, infosec/security is finally just a game of making reward-to-effort ratio too impractical for most threat-actors & thus achieve reasonable 'sense of security', in a world where exploits exist for almost every ring in the stack - including ring 0) I feel BITB mostly gets used by those who may not really be having access to lob a proxy attack at the intended target as well, which filters a good set, among potential victims.
  - hapidjus 5y ago
    Maybe I’m misunderstanding but what’s preventing you from passing on the cluster?

ChiptuneIsCool 5y ago

I don't think this attack can be used on a large scale because if the browser has a custom theme you will quickly notice that the popup is not from the browser. If it is used on one person, customizing the popup for his specific browser is almost impossible to notice it

pyhtel 5y ago
Vast majority of people tend to stick to the default theme. And of course, those also tend to be the most vulnerable to phishing attacks

jethack 5y ago

Worth noting these have been in the wild for years. It's often used to phish for Steam accounts. BTW, if you're using TOPT 2FA, that typically gets phished too.

DrBoring 5y ago

I foresaw this attack years ago. It makes me feel a bit smug to see it implemented. My idea used the same modus operandi: sniff the victim's OS and browser, and present to them a UI custom tailored to fool them. I always thought the ability to open a browser window without a navigation bar was a terrible idea. Not just because of this attack: I always want to see the URL I'm visiting. Tangent: I was using the Minecraft Launcher GDLauncher, and it pops a nav-bar-less browser window for the purpose of logging into my Microsoft account [1]. It felt so suspicious, not being able to confirm I wasn't being phished. To make matters worse, if you click the "I can't use my Authentication app right now" button on the nav-bar-less browser window, it triggers a password reset email, not an I-can-indeed-access-this-email-account confirmation email. [1] You need to present a Microsoft token to play Minecraft online.

throwaway581294 5y ago

New security tip, drag every login pop-up windows outside of your browser.. if the window can move out of the browser.. it's (more likely) legit (or at least you know the address bar is real to check), if it doesn't then you're being phished.

seltzered_ 5y ago

I miss the days of well-known companies criticizing oauth: https://web.archive.org/web/20160213213455/http://blog.mailchimp.com/social-login-buttons-arent-worth-it/ https://web.archive.org/web/20160213213455/http://blog.mailc... - MailChimp, "social login buttons aren't worth it", 2012