untangling_the_web

DOClD: 4046925
UNCLASSIFIEDIlIiOR OIiIiICIAL, U51i O~IL.¥
browser with a fake that is so good that it's almost undetectable . Here's how the
attack works.
~ Customer receives a forged but very legitimate-looking email from a bank or
business with whom he may have a relationship (account, credit card, etc.).
~ Email says customer must verify his email address and includes a link inside
the email to a website.
~ User clicks on the link in the email and the browser opens what appears to be
the company's webpage but is in.fact a fake website.
~ The fraudulent site automatically detects the user's browser (the attack is not
browser dependent) and runs custom JavaScript code that removes the real
address bar and replaces it with a fake address bar at the top of the browser
window. The copy is exact. It has the Address field, it displays a uri that \
appears to be a secure link to the real company website (e.g. "https:/I"), and it
has the Go button on the right-hand side. Unlike earlier, less sophisticated
phishing attacks that create static (fake) Address bar images, this is a live
piece of JavaScript code.
~ Even if the user right-clicks on the webpage to View Source, the real source
code is not shown; in order to see the real source code, the user must use the
View I (Page) Source pulldown menu at the top of the browser to see the real
HTML source code.
~ The active JavaScript address bar could permit what is known as a "man in
the middle" attack, i.e., every subsequent website the user visits after this one
could send any information the user enters (passwords, credit card numbers,
etc.) to the "phisherman" until the browser is closed.
In short, there are very few clues as to the fraudulent nature of this particularly
dastardly phishing scam, but they are important ones:
~ Even though the fake page shows the "https:/I" in the address bar, there is no
corresponding Secure Sockets Layer (SSL) padlock at the bottom of the
browser.
~ If the user types a new uri into the Address bar, the browser will continue to
display the same fake "Welcome" message.
~ The real uri appears very briefly while the user is redirected to the fake site.
Take a look at this actual example of a fraudulent webpage used in a real phishing
scam. You can see how it would be hard for the user to detect this is a fake.
UNCLASSIFIED""fi'O~ Ofi'fi'leIAL t1SE ONLY 551