3 ms·
The canonical use of history stealing is to find exploits in a bunch of websites (e.g. online banks), then use history stealing to find customers of that site.
by dfabulich 12y ago
The canonical use of history stealing is to find exploits in a bunch of websites (e.g. online banks), then use history stealing to find customers of that site.
A number of attacks against, e.g. banks seem implausible ("but how would the attacker know that I bank at Wells Fargo?") until you learn about history stealing.
- gizmo686 12y agoWhy do you need history stealing for that. If you have an attack against Wells Fargo, why not launch it on everyone you can. You will get at least as many Wells Fargo users as you would if you pre-filtered (probably more because of false negatives).
- grrowl 12y agoBut a phishing site such as "HTTPS-SECURE.required-bank-security-check.gmkla4lwgi.com" [hypothetical] could easily check for the most popular bank institutions in a user's history using this exploit and present them with the appropriate, familiar login dialog they'd expect. You'd easily increase the amount of victims (conversions?) several times over.
- coldpie 12y agoYou could also use it to identify high-value targets. Make a popular webpage, and make a record of all users who have visited internal.nsa.gov and the like.