• Follow us

Technology

Mobile Chrome Hoax Could Target Android Users | Cybersecurity

By John P. Mello Jr. Apr 30, 2019 5:00 AM PT

A new method for hiding the true location of a website from users of the mobile Chrome Web browser has come to light.

Phishers can trick users into revealing their credentials for a legitimate website to operators of a malicious one, security researcher James Fisher reported in a post on his personal blog Saturday.

Scammers can exploit mobile Chrome's feature that hides the address bar when users are scrolling on a Web page by inserting an address bar that allows a fake site to pose as a legitimate one, such as that of a bank, Fisher explained.

Making matters worse, scammers can create a "scroll jail" that prevents users from seeing the true URL for the page even when they scroll to the top.

"The user thinks they're scrolling up in the page," Fisher wrote, "but in fact they're only scrolling up in the scroll jail! Like a dream in Inception, the user believes they're in their own browser, but they're actually in a browser within their browser."

Minor Issue

Although Fisher's discovery isn't good news for consumers, it seems to be a minor issue, because a Web page's true URL will appear in the address bar initially, noted Thomas Reed, director of Mac & Mobile at Malwarebytes, a cybersecurity software maker based in Santa Clara, California.

"It would require a very specific set of user behaviors to make this useful," he told TechNewsWorld. "I can see some people exhibiting those behaviors, though, so it's definitely an issue."

However, "I wouldn't consider this a serious threat, because users would just need to pay attention to the URL bar when they first visit the site," Reed said. "Honestly, I don't foresee this getting used much, if at all."

It's far easier for someone phishing for personal information to use a homograph attack, he pointed out. In that type of attack, a scammer takes a domain name and substitutes characters that at first glance look like the original characters. A zero might be substituted for the letter "O," for example, or a one for the letter "l."

The attack Fisher described is a proof-of-concept demonstration, not something found in a hacker's toolkit, said Cameron Palan, a senior threat research analyst at Webroot, an Internet security company in Broomfield, Colorado.

"This isn't an attack discovered in the wild and may never affect users if Chrome is updated quickly," he told TechNewsWorld.

Google, which owns Chrome, did not respond to our request to comment for this story.

Low ROI for Hackers

It's not likely that this phishing ploy poses a major threat to consumers, said Jonathan Tanner, a senior security researcher with Barracuda Networks, based in Campbell, California.

"The amount of technical ability and time required to successfully implement this will make it unlikely to be seen much in the wild, and Google -- and possibly other browser makers -- will undoubtedly patch this faster than the speed at which it could become a common sight for phishing pages," he told TechNewsWorld.

"I doubt the returns on implementing this method would be worth the work," he said. "It's unlikely that this technique alone would result in a significant increase in follow-through on the part of users being phished."

Unlike some browser attacks, this one isn't based on a vulnerability, observed Mounir Hahad, head of the threat lab for Juniper Networks, a network security and performance company based in Sunnyvale, California.

"This is trickery," he told TechNewsWorld.

"There is no way to force the download of malicious content, trigger a remote code execution or any malicious activity," Hahad said.

"This is just a visual trick that may make some people believe they are on a different website than the one they actually surfed to," he continued.

This type of trickery need not be limited to mobile Chrome, Hahad pointed out. "Other browsers and other operating systems have different implementations that may allow for a less sophisticated version of this trick."

Consumer Protect Thyself

While the fake address bar attack is designed to be stealthy, an alert consumer can identify it.

"Consumers can recognize this type of attack when the website in the address bar changes unexpectedly after scrolling down the Web page and doesn't seem to respond to interaction as expected," Hahad explained.

"Tap the bar to test it," Webroot's Palan added. "The fake one is nonfunctional. Also, the number of current tabs displayed on the fake bar will not likely match your own."

Once a user starts scrolling down the page, distinguishing the fake browser from the real browser can be very difficult, noted Paul Bischoff, a privacy advocate for Comparitech, a reviews, advice and information website for consumer security products based in Maidstone, Kent, UK.

"The best way to spot the fake is to take note of the real page URL before scrolling down," he told TechNewsWorld.

Consumers should be wary of links that lead to login screens, Barracuda's Tanner advised.

"Better yet, manually type in the full and correct URL for any site that a you want to login to. That should be sufficient for users to protect themselves," he recommended.

"While novel, this attack is not particularly significant and won't likely be used much in the wild so general security measures are sufficient," Tanner added.

Growing Problem

If faking an address bar the way Fisher described were to catch on in phishing circles, it would be a bit of an anomaly.

"Most phishing campaigns are platform-agnostic," Bischoff said. "It doesn't matter whether you encounter them on mobile or desktop."

Phishing attacks are very widespread on mobile devices, Malwarebytes' Reed noted.

"However, one advantage mobile device users have is the availability of apps for most sites that attackers would want to mimic," he said.

"For example, if you are a Bank of America customer, you'd be more likely to use the Bank of America app than the Bank of America website on your mobile device," Reed pointed out.

"Still, if an attacker can get a mobile user to tap a link, they can still snare plenty of victims," he said.

Phishing attacks on mobile devices likely are on the rise due to the rapid growth in the sector, explained Jonathan Olivera, a threat analyst with Centripetal Networks, a cybersecurity solutions provider in Herdon, Virginia.

"The bad actors will always follow the areas that have the most users," he told TechNewsWorld.

"The mobile platforms and application developers have an incentive to produce as many products as feasible to satisfy their user base," Olivera said, "which results in security vulnerabilities in many of them."

John P. Mello Jr. has been an ECT News Network reporter since 2003. His areas of focus include cybersecurity, IT issues, privacy, e-commerce, social media, artificial intelligence, big data and consumer electronics. He has written and edited for numerous publications, including the Boston Business Journal, the Boston Phoenix, Megapixel.Net and Government Security News. Email John.

Read More



Leave A Comment

More News

TechNewsWorld

Elive Elevates Linux With Enlightenment 2019-05-10 12:41:37The Elive distro's integration of the Debian Linux base and the Enlightenment desktop is a powerful combination. Together, they offer a unique comput

Baltimore Held Hostage in 2nd Ransomware Attack 2019-05-10 08:00:00Baltimore officials have admitted that the city government once again has been victimized by ransomware -- the second such attack in just over a year.

Microsoft Becomes Master of Its Own Linux Kernel 2019-05-09 11:56:13Microsoft has announced that its own full Linux kernel will power WSL2, the newest version of the Windows Subsystem for Linux. This marks the first ti

Review Roundup: Pixel 3a Wins Kudos for Cameras, 2019-05-09 08:00:00Google's Pixel 3a smartphone, launched at Google's 2019 I/O developer conference, has wowed reviewers with the quality of its photos and other featu

Google Showcases AI, Preaches Privacy at I/O Keynote 2019-05-08 08:00:00Google showed off its chops in AI and ML, renewed its commitment to giving users greater control over their data, and introduced a new economically pr

Get Ready for Feature Deluge at Apple's WWDC 2019-05-07 08:00:00Apple plans to introduce a boatload of new apps, features and development tools at WWDC next month, according to a report. As it does every year, Appl

Facial Recognition and the Fight for Diversity 2019-05-06 13:22:06I spent a good deal of my educational and early career as an analyst doing research at scale. In fact, the way I got into the executive resources pro

POP!_OS Makes Classic GNOME Simpler to Use 2019-05-03 12:29:55Are you Looking for a hassle-free Linux OS that is very user-friendly and extremely stable? Pop!_OS from System76 is a prime candidate to fit that ord

No Easy Decision: Choosing Between Pay-TV Services 2019-05-03 08:00:00Many consumers in recent years have opted to cut the cord -- that is, to ditch cable or satellite TV and instead rely on OTT streaming services for th

Cybersecurity Pros Join 'Right to Repair' Battle 2019-05-02 08:00:00An advocacy organization formed by cybersecurity professionals has joined the fight for "right to repair" legislation, which would allow consumers a

Red Flag Flying Over Flagship Phones 2019-05-01 08:00:00These could be the worst of times for high-end flagship smartphones. Google CEO Sundar Pichai told Alphabet shareholders that his company's flagship

Mobile Chrome Hoax Could Target Android Users 2019-04-30 08:00:00A new method for hiding the true location of a website from users of the mobile Chrome Web browser has come to light. Phishers can trick users into re

PCWorld

The powerful, feature-packed Neato Botvac D6 Connected gets 2019-05-21 11:08:00Using a robot vacuum to care for your home not only makes you look cool, but adds some hands-free convenience to your cleaning routine. Of course, the

Observation review: Old science fiction meets New Weird 2019-05-21 10:00:00The camera whirs into focus. Distorts. Whirs into focus again. Scanlines and static make the scene hard to process at first, but they slowly fade. The

How Google's Huawei license ban could change Android 2019-05-21 09:20:00A bad month has just gotten a whole lot worse for Huawei. According to a Reuters report and confirmed by the two companies, Google is preparing t

Amazon's huge one-day PC sale slashes prices on 2019-05-21 09:17:00Amazon’s current one-day sale is one you don’t want to miss if you’re on the lookout for fresh PC gear. The online retailer is dropp

Vizio 2019 product showcase: The value-oriented manufacturer has 2019-05-21 09:00:00Vizio TVs and soundbars get better every year while maintaining down-to-earth prices, which is great news for consumers.

RoomMe promises to make your smart home more 2019-05-21 09:00:00This ceiling-mounted occupancy sensor triggers smart home devices based on who enters the room.

Windows Sandbox: How to use Microsoft's simple virtual 2019-05-21 06:46:00Microsoft may be positioning its upcoming, easy-peasy Windows Sandbox within the Windows 10 May 2019 Update as a safe zone for testing untrusted appli

BrandPost: Use GPU-accelerated VideoProc to easily process 4K 2019-05-20 17:47:00More and more people are using mobile phones, 4K ultra high-definition (UHD) cameras, GoPro action cameras, drones, and other devices to shoot excitin

Need a dragon fix after Game of Thrones’ 2019-05-20 14:06:00ZeniMax Online either has an impeccable sense of timing, or it’s so lucky that all its employees should go buy lottery tickets this second. The

Save $100 on the luxurious Bowers & Wilkins 2019-05-20 11:36:00A solid set of noise-cancelling headphones can be a lifesaver in offices, commutes, homes, and all the other noisy places you spend your life. And tod

Google pulls Huawei's Android license: 5 reasons not 2019-05-20 11:07:00The future just got a little dicey for millions of Huawei fans. Following a Trump administration Executive Order last week that put Huawei in the U.S.

Logitech's couch-friendly K600 TV keyboard has never been 2019-05-20 09:59:00If you’ve been pining for a couch-friendly keyboard with an integrated trackpad for the living room, today’s your lucky day. Amazon droppe

FOX News

Google AI detected lung cancer better than radiologists, 2019-05-21 11:58:49Google unveiled an artificial intelligence system that demonstrated an amazing ability to detect lung cancer in early testing and even outperformed ra

Trolls using Instagram to 'try to show Trump 2019-05-21 10:29:17As the 2020 U.S. presidential election campaign draws nearer, an independent study has uncovered a coordinated troll campaign using Instagram in an at

YouTube cracks down on videos that promote drinking 2019-05-21 10:06:43YouTube has cracked down videos posted by crackpots and fringe figures who promote a host of “miracle cures,” including a holy elixir blea

Scammers use Facebook to trick people into thinking 2019-05-21 09:26:13Scammers are using Facebook Messenger and other apps to trick Americans into thinking they gave money to terrorist groups like ISIS and Al Qaeda.

US warns about alleged spying threat from Chinese-made 2019-05-21 08:14:34

Cybersecurity experts warn Baltimore to stop 'playing' with 2019-05-20 14:13:00Cybersecurity experts say Baltimore is playing with fire as a deadline to pay thousands of dollars in ransom to hackers holding several of the city's

Your phone is spying? The truth behind the 2019-05-20 14:10:39Almost everyone has an eerie a tale to tell. Perhaps you’ve been talking to a friend about an island vacation, when suddenly deals for the Maldi

Google's Eric Schmidt: Breaking up Big Tech would 2019-05-20 13:52:05The former chairman and chief executive of Google said that calls for breaking up the tech giant have "no basis in law" and would harm consumers by

Apple's Tim Cook takes apparent swipe at Facebook, 2019-05-20 11:49:41Apple CEO Tim Cook told graduating students at Tulane University that it was their job to remake the world and leave it better for humanity -- while a

Apple, Google, Amazon, Microsoft sued over 'massive music 2019-05-20 11:12:00Visit any of the major digital music stores and you'll find unauthorized copies of songs for sale and streaming.

New satellites could save Americans $30B on monthly 2019-05-12 08:00:09Upcoming satellite technology could lower prices for Internet services, a new report predicts.

GPS stalkers, lethal cell phones, incognito issues, and 2019-05-12 06:00:30Everything you need to know about GPS trackers, and more.

TechCrunch

Tencent CEO warns companies must keep innovating to 2019-05-22 02:54:42On Tuesday, Tencent’s usually low-profile founder and CEO Pony Ma made rare comments to weigh in on escalating tensions between the United State

In Ford’s future, two-legged robots and self-driving cars 2019-05-22 02:29:48Autonomous vehicles might someday be able to navigate bustling city streets to deliver groceries, pizzas, and other packages without a human behind th

Leak reveals Uber’s $9.99 unlimited delivery Eats Pass 2019-05-22 02:26:35What’s the cord-cutting equivalent to ditching your kitchen? Uber’s upcoming subscription to unlimited free food delivery. Uber is prepari

Valve’s Steam Chat gets its own iOS and 2019-05-22 00:32:18  A little under a year ago, Valve released a big overhaul for the chat features built into its Steam game store/launcher. Focusing on modern day

India’s Ola switches gears on its food delivery 2019-05-22 00:31:24India’s Ola, which has expanded to select international markets and set ambitious goals for its electric vehicles business, is struggling with s

TransferWise now valued at $3.5B following a new 2019-05-22 00:00:43TransferWise, the London-headquartered international money transfer service, is disclosing a new $292 million secondary round that sees investors valu

Following a report about misleading ads placed by 2019-05-21 23:27:26Starting next month, Google will enforce new policies for ads related to abortion in the United States, United Kingdom and Ireland. Google will now re

A young entrepreneur is building the Amazon of 2019-05-21 23:00:00At just 26, Waiz Rahim is supposed to be involved in the family business, having returned home in 2016 with an engineering degree from the University

Food delivery startup Dahmakan eats up $5M for 2019-05-21 22:00:29It’s harvest season for Southeast Asia’s full-stack food delivery startups. Following on from Singapore’s Grain raising $10 million,

Famed founder Daphne Koller tells it straight: “With 2019-05-21 20:11:11Daphne Koller doesn’t mind hard work. She joined Stanford University’s computer science department in 1995, spending the next 18 years the

Sofar Sounds house concerts raises $25M, but bands 2019-05-21 17:17:34Tired of noisy music venues where you can hardly see the stage? Sofar Sounds puts on concerts in people’s living rooms where fans pay $15 to $30

Google says some G Suite user passwords were 2019-05-21 17:15:37Google says a small number of its enterprise customers mistakenly had their passwords stored on its systems in plaintext. The search giant disclosed t

Electrek

BMW said to favor all-electric for next-gen i8 2019-05-21 11:43:22 BMW is leaning toward making its next-generation i8 sports car an all-electric model, according to a new report. more… Subscribe to Electrek

Apple tried to buy Tesla for more than 2019-05-21 10:39:49 Apple reportedly offered to buy Tesla at around $240 per share back in 2013. The bid from six years ago is now being reported as Tesla’s share

Honda now taking reservations for Honda e with 2019-05-21 10:05:33 Honda is now taking reservations for its upcoming all-electric Honda e urban car in four European markets. more… Subscribe to Electrek on You

Tesla cuts base price of new Model S 2019-05-21 09:50:59 Tesla significantly reduced the base price today of its newly upgraded Model S and Model X vehicles that launched just a month ago. more… Subs

EGEB: Minnesota’s Xcel Energy to close coal and 2019-05-21 09:05:54 In today’s EGEB: Xcel Energy shifting to solar — and more — as it plans to phase out coal in Minnesota by 2030. Construction has st

Tesla is finally starting to expand rollout of 2019-05-21 05:30:53 Tesla is finally starting to expand the rollout of its new more powerful Supercharger V3 stations a few months after unveiling the latest generation

Unu launches affordable 2nd gen electric scooter with 2019-05-21 00:01:13 Unu, one of Europe’s leading budget electric scooter companies, has a brand new ride. Unu just launched their second generation electric scoote

Tesla Model X ‘flies off’ guard rail, ends 2019-05-20 18:47:53 A Tesla Model X “flew off” a guard rail on the highway and ended up in doing a funny balancing act on its battery pack. more… Subs

California pushes back for EVs: proposed bill for 2019-05-20 15:14:34 As the Environmental Protection Agency prepares to introduce the final form of its proposal to freeze US fuel economy standards sometime in the near

Outfit your home with 3 energy-conscious TP-Link smart 2019-05-20 14:54:27 Newegg offers a three-pack of TP-Link smart switches for $57.98 shipped. This is combined bundle of HS200 and HS210 switches, which each individ

Tesla releases new Do It Yourself maintenance instructions 2019-05-20 14:54:21 Tesla has released new ‘Do It Yourself’ maintenance procedure instructions to help owners work on their own cars.  more… Subs

Honda, GM blockchain project to examine how EV 2019-05-20 13:04:22 Honda and GM have joined forces in a new research project that aims to examine how electric cars and smart grids can work together in the future, wit


Disclaimer and Notice:WorldProNews.com is not responsible of these news or any information published on this website.