5 ms·
Important to note that the fake page is "frozen", so there is no direct phishing risk. The user can click around but nothing happens. Scrolling works. Resizing
by FiloSottile 11y ago
Important to note that the fake page is "frozen", so there is no direct phishing risk. The user can click around but nothing happens. Scrolling works. Resizing curiously turns it into a blank page. Reloading leaves the fake page up.
It's a race, so it might not work at the first try over the network.
Original report: http://seclists.org/fulldisclosure/2015/Jun/108 http://seclists.org/fulldisclosure/2015/Jun/108
- amelius 11y agoWhat do you mean by "frozen"? Can't the page contain javascript that makes it appear not-frozen?
- rsoto 11y agoIt rendered the phishing HTML, but you can't interact with it. I guess it's because the script is stopping the render of facebook after the request has been made (hence the www.facebook.com site), providing another security layer, as you can't be phished with an unresponsive website. And I don't think javascript would make a difference.
- mohaps 11y agobut valid phishing can occur with "Please call this number" type of scam! :( I know my dad would fall for that.