Phishing hole found in IE and OE

[Jay Calvert]

Another major vulnerability has been found in Microsoft's Internet Explorer and Outlook Express. The flaw is in the way that these applications can be manipulated in simple HTML code to display an URL other than the one specified in a link, to be displaye
d in the status bar.

The status bar is the first place users look, or at least should look when following any link in an email or on a website to ensure that the link is taking them to where it says it is. HTML that utilizes this vulnerability can change what is displayed in
the status bar of these applications, thus leading to a possible major phishing hole that can be used in very serious ways.

Proof of concept code has been released and a description of how the flaw is utilized has been published. Below is an example of the flaw, and if you are using Internet Explorer to view this page, then in the status bar, you will see eBay.com, however if
you are using Firefox, then you will see spreadfirefox.com. If you click on the link in Internet Explorer you will be directed to spreadfirefox.com, however in Firefox, you will go to eBay.com.

Here is the code:

<p><a id="SPOOF" href="http://spreadfirefox.com"></a></p>
<div>
<a href="http://ebay.com" target="_blank">
<table>
<caption>
<a href="http://ebay.com" target="_blank">
<label for="SPOOF">
<u style="cursor: pointer; color: blue">
ebay.com
</u>
</label>
</a>
</caption>
</table>
</a>
</div>

An example and this article can be seen at: http://habaneronetworks.com/viewArticle.php?ID=140

If you did use Internet Explorer to open the link, then maybe you should read about Firefox here, and consider switching. Mozilla also has a beautiful product to replace Outlook Express too.

[Greg Merideth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In the last trunk build I did of Firefox (win32 build roughly 2-3 nights
ago) I see "http://ebay.com/" in the lower status bar on the test page.
~ Clicking the link takes me to ebay. I do not see
"http://spreadfirefox.com".

Jay Calvert wrote:
|
| Another major vulnerability has been found in Microsoft's Internet
Explorer and Outlook Express. The flaw is in the way that these
applications can be manipulated in simple HTML code to display an URL
other than the one specified in a link, to be displayed in the status bar.
|
| The status bar is the first place users look, or at least should look
when following any link in an email or on a website to ensure that the
link is taking them to where it says it is. HTML that utilizes this
vulnerability can change what is displayed in the status bar of these
applications, thus leading to a possible major phishing hole that can be
used in very serious ways.
|
| An example and this article can be seen at:
http://habaneronetworks.com/viewArticle.php?ID=140
|

- --
~ '''''
~ ( o.o )
====oOOO==(_)==OOOo==============================
~ Greg Merideth
~ Forward Technology, LLC.
~ 866.366.5585 x 103
~ gmerideth@forwardtechnology.net
===========================================PGPKEY
~ 5912CED0BF361EC23C67F509C6EB5AB49AEAC107
=================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (MingW32)

iD8DBQFCFYMexutatJrqwQcRAnzRAJ0e8cWAmyg8b9P4Poizpf Ddqu0DggCg1+D5
ZxuwoDkRWTK+vI+jm2+9A6c=
=Buec
-----END PGP SIGNATURE-----

[David Nichols]

Jay Calvert wrote:

>Below is an example of the flaw, and if you are using Internet Explorer to view this page, then in the status bar, you will see eBay.com, however if you are using Firefox, then you will see spreadfirefox.com. If you click on the link in Internet Explorer
you will be directed to spreadfirefox.com, however in Firefox, you will go to eBay.com.
>
>If you did use Internet Explorer to open the link, then maybe you should read about Firefox here, and consider switching. Mozilla also has a beautiful product to replace Outlook Express too.
>
Not trying to defend M$, (I'm sending this from Mozilla Thunderbird
after all), but isn't this also indicative of a problem with Firefox?
You are going somewhere other than where the status bar is telling you.

David Nichols

--
"The problem is that, when we begin to realize the potential goodness in ourselves, we often take our discovery much too seriously. We might kill for goodness or die for goodness; we want it so badly. What is lacking is a sense of humor. Humor here does
not mean telling jokes or being comical or criticizing others and laughing at them. A genuine sense of humor is having a light touch: not beating reality into the ground but appreciating reality with a light touch. The basis of Shambhala vision is redisc
overing that perfect and real sense of humor, that light touch of appreciation."
Shambhala - The Sacred Path of the Warrior

[cyberpixl]

I think he misspelled it, look at
http://habaneronetworks.com/viewArticle.php?ID=140 and you'll see what
i mean:
"...then you will see spreadfirefox.com"
should be:
"...then you will see ebay.com"