Latest in Gear

Image credit:

Chrome exploit uses a fake address bar for phishing attacks

You might not realize you're on a bogus site despite your best efforts.
Share
Tweet
Share

Sponsored Links

AP Photo/Mark Lennihan

Cyberattackers don't need to find obscure technical flaws to launch phishing attacks -- they might just need a screen capture and some clever web coding. Developer James Fisher has found a relatively simple exploit in Chrome for mobile that takes advantage of how the app displays the address bar. When you scroll down from the top of a page, the approach displays a fake address bar that won't disappear until you visit another site. The attacker can even craft the page to prevent you from seeing the real address bar when you scroll up.

Fisher's approach is focused on Chrome and is only a proof of concept for now, but it could theoretically display fake address bars for a variety of browsers and even include interactive elements. In other words, a phishing campaign could produce a convincing site beyond just the content of the page. You'd have to pay attention to the starting address to know what's happening, and not everyone will catch that irregularity.

We've asked Google for comment. It's not clear how many phishers will use techniques like this. There is a way to double-check, though. The 9to5Google team noted that you can force the real address bar to show by locking and then unlocking your phone again. It's not bullet-proof as a result, but many people won't know to try this and might be fooled as a result.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
Tweet
Share

Popular on Engadget

Roku is giving away 30 days of premium video

Roku is giving away 30 days of premium video

View
NASA warns Moon base plans might slip by a year

NASA warns Moon base plans might slip by a year

View
Google rolls out Drive shortcuts ahead of folder structure changes

Google rolls out Drive shortcuts ahead of folder structure changes

View
NASA picks SpaceX to deliver cargo to the Lunar Gateway

NASA picks SpaceX to deliver cargo to the Lunar Gateway

View
Comcast, Verizon make some on-demand viewing free

Comcast, Verizon make some on-demand viewing free

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr