Mobile UI Spoofing–Another Reason For Smart Surfing

[Peaches]

Nov30

Mobile UI Spoofing–Another Reason For Smart Surfing

In August we noted how Trend Micro Smart Surfing for iPhone protected users against a potential iOS vulnerability. Today we have word of another potential problem that Smart Surfing is able to protect against.

An independent security researcher noted that in certain cases the Safari browser hides the address bar after a website has finished loading. This can be used to add an added layer of believability to phishing attacks: the legitimate URL of the phished site can be placed in a fake address bar. If the real address bar has hidden itself, the fake bar would be seen, leading the users to think they are on the legitimate page.

To demonstrate this proof-of-concept attack, the researcher created a fake Bank of America page. A keen-eyed user would note that while the page is loading, two address bars could be seen, but once loaded, the real address bar hides itself.

More details plus screenshot here: http://blog.trendmicro.com/