New style of phishing attack discovered
Scammers target website frames to attempt fraud.
By John Dunn | Techworld | Published: 16:30, 18 March 2005
The rate of innovation in phishing has been underlined with the discovery of an attempt to hijack a website frame on a legitimate banking site.
The hack was revealed this week by UK security company
Netcraft, which tracks such new forms of incursion using reports from its user community. The target in this instance was the online log-in of US-based Charter One Bank.
In contrast to established cross-scripting techniques where whole pages are hijacked by bogus sites, the new "cross-frame" scripting approach is able to inject content on to a real web page, making it extremely difficult to detect. The technique works by adding links to the frame further down in what otherwise appears to be the legitimate charterone.com website, without this being deemed invalid.
Anybody visiting the website while prey to the attack - after, say, following a phishing e-mail link - would have been presented with what looked like the real website, in which had been planted a fake "account update" form.
While there is no evidence that anyone fell for the ruse, entering log-in details on this form would have given the phishers enough information to attempt fraud. An attack such as this would have to be directed at a specific bank website and wouldn’t necessarily be possible on all banking websites.
Nevertheless, the ability to carry out such an audacious attack gives some insight into the level of creativity now being employed by phishers.
According to the security blog of Dow Jones columnist Jeremy Wagstaff, the website hole is believed to have been fixed by the bank in recent days.
