Full Disclosure mailing list archives
Re: Re: Internet Explorer URL parsing vulnerability
From: S G Masood <sgmasood () yahoo com>
Date: Wed, 10 Dec 2003 10:00:54 -0800 (PST)
--- Clint Bodungen <clint () secureconsulting com> wrote:
Please see my original post... oh wait... I'll paste it. I don't really think it will make that much of a difference their profits considering anyone dumb enough to fall for those scams isn't going to know the difference between an IP address in the URL box and a "spoofed" domain.
Since you are posting this for the second time: There are many people who have been told to check that the URL matches the page displayed before entering any sensitive information. Like, if they are seeing the paypal page, they are told to check the address bar to see if it shows http://paypal.com and not http://paypa1.com, for instance. Many papers on spoofing mention this as if it is an infallible method for checking the authenticity of the page. Such people will fall for these exploits. Hey, to be very honest, if this was 0day and the spoof was well constructed, even you and me would probably fall for it. ;D Anyways, it wont make a difference to the "click all-fill all" zombies you are talking about. :) -- S.G.Masood __________________________________ Do you Yahoo!? Free Pop-Up Blocker - Get it now http://companion.yahoo.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: RE: FWD: Internet Explorer URL parsing vulnerability, (continued)
- Re: RE: FWD: Internet Explorer URL parsing vulnerability VeNoMouS (Dec 11)
- Re: RE: FWD: Internet Explorer URL parsing vulnerability VeNoMouS (Dec 10)
- Re: RE: FWD: Internet Explorer URL parsing vulnerability Exibar (Dec 10)
- RES: RE: FWD: Internet Explorer URL parsing vulnerability Cleber P. de Souza (Dec 10)
- Re: RE: FWD: Internet Explorer URL parsing vulnerability VeNoMouS (Dec 09)
- Re: Internet Explorer URL parsing vulnerability Feher Tamas (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Frank de Wit (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Jedi/Sector One (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Ricardo Moura (Dec 12)
- Re: Re: Internet Explorer URL parsing vulnerability Clint Bodungen (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability S G Masood (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Clint Bodungen (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability William Warren (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Exibar (Dec 10)
- RE: Re: Internet Explorer URL parsing vulnerability Rui Pereira (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Exibar (Dec 10)
- RE: Re: Internet Explorer URL parsing vulnerability Rui Pereira (Dec 10)
- Re: Re: Internet Explorer URL parsing vulnerability Exibar (Dec 10)
- RE: Re: Internet Explorer URL parsing vulnerability Kristian Hermansen (Dec 11)