3 ms·
How is this “attack” any different than simply mirroring the site? The URL bar shows the malicious site either way. If you enter your password on the malicious
by meindnoch 4y ago
How is this “attack” any different than simply mirroring the site? The URL bar shows the malicious site either way. If you enter your password on the malicious site, you’re pwned. Don’t need frames for that.
- shadowgovt 4y ago> The URL bar shows the malicious site either way That's never been sufficient to keep bad actors out because end-users don't grok the URL bar. This attack is superior to a mirroring attack because it uses the target site's own UI resources, so it looks very legit (no need to pay someone to monitor the UI of the target site for changes and rework your exploit to attack them).