I’ve written about many of the threats that we face on the internet in many of my past posts. Quite frankly, it just seems to never end. Thankfully, due to the blog-o-sphere, many of us are now aware of what to look for. Phishing, spear phishing, man in the middle, etc. are all terms that, in the very recent past, may not have been familiar to many of us. Because of this fact, many are now aware of the attacks, what to look for, and how to prevent them. As a result, the hackers are forced to come up with new and more devious methods of stealing your personal information. Well they have done it again.
In the past phishing scams have required you to click on links in a malicious email from someone pretenting to be you bank and asking for your personal information in order to fix a “problem with your account”. When you click on the link, it directs you to fake site that will look very much like your bank’s web page, and once you fill in the ‘User Name’ and ‘Password’, you have given away your personal banking log in credentials. But as I said earlier, users are becoming more and more aware of these phishing scams and the use of them is becoming less and less effective.
Tab Napping, or Tab Hijacking is fast becoming the new scourge of our browsing woes according to Aza Raskin, a security expert on Mozilla’s Firefox Web Browser Team. Extra special care is going to be needed when using our browsers, especially if you are prone to using numerous tabs at one time.
This is how it works…..
A hacker can actually detect when a tab, in your browser, has been left idle for a long period of time. By replacing that tab with a fake website that looks just like a real site, such as your banking site, they will ask you to reauthorize your credentials by entering your User Name and Password. Knowing that your bank will often do this when your account has been idle for a period of time, you don’t think anything of it and re-enter your credentials. At that point, they now have your personal banking log on information. They can then actually redirect you to your actual banking site, as you never were really logged out to begin with. Plus, the damage has already been done. By doing this, you will never even realize that you have just had your banking information stolen.
How Can I Protect Myself From Tab Napping?
Even though this is a serious problem, being aware of the signs, can make this a relatively simple thing to avoid.
First off, as always, before entering your personal credentials to any website, look at the actual Uniform Resource Locator (URL) for the page that you are on, and make sure that you are, in fact, where you think you are.
Secondly, while glancing at that URL, make sure that you are on a secure page, one that begins with https:// and not just http://. Never enter any personal information on a page that begins with only http://.
Thirdly, whenever doing any banking, instead of opening a new tab (Ctrl-t) in your browser, open a new window, (Ctrl-n) for your banking log on. This way only one tab will be open in that window, confusion will be less likely, and tab inactivity will be avoided.
Next, avoid leaving tabs open that are asking for your log in credentials. Always close log in pages to your bank, ecommerce sites, or any other site that is looking for any personal identifying information. You can always re-open these pages should you need them again.
I think that making sure you are where you think you are is the most important thing in avoiding these phishing scams. Before entering any personal information on any site, look at that URL and make sure that it is actually from the company or institution in which your are logging into. If unsure of how to do this, check out my two part post on Uniform Resource Locators by clicking HERE and HERE.
Microsoft has just announced a hole in it’s Internet Explorer browser. This is a “Zero Day” exploit which means that Microsoft discovered this hole after it had already been effecting computers in the “Wild”. Microsoft deems this exploit as being “critical”. This is a Video Active X exploit which would enable a hacker to take complete control of your computer simply by having you visit a malicious website or a legitimate website that has been compromised. Microsoft has stated that “An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. When using Internet Explorer, code execution is remote and may not require any user intervention,” The weird thing about this is that this Active X control that has been left over from past versions of IE is of absolutely no use. Even Microsoft admits that it has no reason why this file is even there as there is no current application that would need it. Now to Microsoft’s credit, they have released this notice, which is out of character for them, and a leftover .dll file is something that could easily happen, due to the tremendous amount of these libraries that “litter” windows. Even though Microsoft is aware of this exploit, it is doubtful that a fix will be available anytime soon, almost certainly it will not be available on “Patch Tuesday”, July 14th. However, I would keep my eyes open for an out of sequence update to Windows to come later in the month.
I don’t know, it seems difficult to get excited about a new browser upgrade, but this one just seems to be different as I find myself waiting with baited breathe for this release. Well, the wait is over as Mozilla announced the release date for it’s new Firefox 3.5 browser (code named “Shiretoko”), and the day has finally come…..tomorrow morning Pacific Time you will be able to install this new browser upgrade. The enhancements to this browser just get me thinking about where we are going. An upgrade like Private Browsing (sometimes called “porn mode”) which does not save any browsing history, cookies, etc., and keeps your browsing private is not new as the other major browsers like IE8, and Google Chrome already have this capability. Firefox 3.5’s enhanced JavaScript rendering, using a new engine called “TraceMonkey” should majorly enhance the browser’s speed. But probably the thing that I am most interested in seeing is Firefox 3.5’s ability to use the new HTML5 audio and video tags, which will, once the HTML5 tags are incorporated into websites, enable video and audio to be placed in the body of the page, thus not having the dedicated little box on the left or right where the video is played. HTML (
My Edible Earth 