Menu
URL-spoofing bug in Safari could enable phishing attacks

URL-spoofing bug in Safari could enable phishing attacks

A researcher developed code that can trick Safari into showing a different URL in its address bar than the one currently loaded

Bug allows attackers to spoof the URL shown by Safari

Bug allows attackers to spoof the URL shown by Safari

The latest versions of Safari for Mac OS X and iOS are vulnerable to a URL-spoofing exploit that could allow hackers to launch credible phishing attacks.

The issue was discovered by security researcher David Leo, who published a proof-of-concept exploit for it. Leo's demonstration consists of a Web page hosted on his domain that, when opened in Safari, causes the browser to display dailymail.co.uk in the address bar.

The ability to control the URL shown by the browser can, for example, be used to easily convince users that they are on a bank's website when they are actually on a phishing page designed to steal their financial information.

Leo's proof-of-concept is not perfect and its behavior is somewhat inconsistent. When opened in Safari on iOS, the spoofed URL flickers and sometimes the user can briefly see the real URL.

That's because the attack code is designed to redirect the browser to the spoofed URL, but before the content is loaded, the code reloads the current page. This happens very fast -- every 10 milliseconds -- hence the flicker effect.

On Safari on Mac OS X the flickering is much less apparent, so it's harder to tell that something is amiss.

"While this proof of concept is not perfect, it could definitely be fixed to be used by phishing attacks very easily," said Manuel Humberto Santander Peláez, a handler with the SANS Internet Storm Center, in a blog post.

The exploit was tested successfully on an up-to-date MacBook Pro running OS X 10.10.3 and Safari 8.0.6, as well as on an iPhone 5S with iOS 8.3.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags Appleonline safetysecurityscamsExploits / vulnerabilities

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments