Reader Comments (rss)

(Flattened / Threaded)

1.  

   Give it a little thought and you'll figure it out

   

   Bob Jase, Mar 28th, 2003 @ 7:13am

   
   

   Its easy enough to make an intermediate page that the form submits to, that page could then record the pin in a database along with the rest of the customers data and forward the customer directly to the bank. That way, the customer feels safe and isnt worrying about being defrauded because clearly, they got to the banks site so nothing must have gone wrong. You made the name lame mistake he was counting on the dupe customers to make. Bravo.

   [ reply to this | link to this | view in thread ]

2.  

   Re: Give it a little thought and you'll figure it

   

   Mike (profile), Mar 28th, 2003 @ 8:30am

   
   

   Right. That's what I was wondering if it was possible to do. I didn't make the mistake... I wasn't sure, which is why I was asking.

   [ reply to this | link to this | view in thread ]

3.  

   Re: Give it a little thought and you'll figure it

   

   Nuwanda, Mar 28th, 2003 @ 6:04pm

   
   

   You also made a mistake - the user was not given a form to fill out and then redirected. They were just given an URL that contained the banks web site within a frame. Frames are loaded by the browser, not by the remote site so any pin subsequently would not have been sent to the phantom web site.
   
   What I suspect this person was doing was researching how susceptable people are to this kind of social engineering. The question is whether they were researching for legitimate reasons or illegitimate reasons - like a subsequent exploit that did capture a PIN.
   

   [ reply to this | link to this | view in thread ]

4.  

   Re: Give it a little thought and you'll figure it

   

   wonko, Mar 30th, 2003 @ 1:04am

   
   

   It's possible, with a bit of clever JavaScript, to load another site in a frame and automatically intercept or redirect any form data. This way, the site looks perfectly legitimate to the user, and might even still work like it should, but in the meantime your account information has been stolen secretly.
   
   A pretty clever tactic, if you ask me. It'd be even better if you could find a way to rewrite the displayed URL in such a way that it looks the same as the official site's URL. This is a much harder prospect; barring security holes, I don't think any browsers will let you do this.

   [ reply to this | link to this | view in thread ]

Add Your Comment