3 ms·
My guess would be: using CSS to place the malicious site's input files exactly where the framed site's input fields are, but "on top" (on the z axis), so the us
by moring 4y ago
My guess would be: using CSS to place the malicious site's input files exactly where the framed site's input fields are, but "on top" (on the z axis), so the user actually inputs data into the malicious site.
- meindnoch 4y agoHow is this “attack” any different than simply mirroring the site? The URL bar shows the malicious site either way. If you enter your password on the malicious site, you’re pwned. Don’t need frames for that.
- shadowgovt 4y ago> The URL bar shows the malicious site either way That's never been sufficient to keep bad actors out because end-users don't grok the URL bar. This attack is superior to a mirroring attack because it uses the target site's own UI resources, so it looks very legit (no need to pay someone to monitor the UI of the target site for changes and rework your exploit to attack them).