'Inception bar' phishing attack replaces Chrome's address bar with a fake

'Inception bar' phishing set on replaces Chrome's address bar with a fake

Chrome hides the address bar when you lot whorl, allowing the attack to supersede it with a fake

Google Chrome

Malicious actors continuously search for new methods of phishing and scamming people, and developers hunt for ways to combat these attacks. A recently discovered flaw with how Chrome works on mobile could open up the gates for plenty of phishing attempts.

Developer James Fisher discovered a potential assail coined the "inception bar" that replaces Chrome's accost bar with a simulated one.

The set on relies on Chrome'south bones functionality on mobile devices. When browsing on your telephone, scrolling downwardly hides the address bar, and scrolling up brings information technology back. This normal — and often helpful on devices with minor screens — characteristic forms the foundation of the potential attack.

Chrome inception bar proof-of-concept

According to Fisher, malicious actors can manipulate this behaviour to swap the real Chrome address bar with a faux one.

Essentially, when a user scrolls up on a page, an assail tin can implement a "scroll jail," as Fisher calls it, that locks users into an 'overflow container' with a faux folio refresh, then it appears they're scrolling up, even though they aren't. Then, the aggressor tin place a fake address bar at the top of the page to confuse users.

Fake address bars make information technology like shooting fish in a barrel for attackers to trick users

Fisher built a proof-of-concept on his website that replaces the address bar with 1 showing the URL for HSBC, the world's seventh largest bank. Fisher's concept uses a static paradigm, then users tin can't interact with the URL or elements of the address bar, but a malicious assaulter could create an interactive one to brand things more convincing.

Information technology's as well worth noting that Fisher's concept isn't perfect. Sometimes the behaviour bugs out and displays both the fake and real address bar.

Regardless, the potential for phishing scams and other attacks is quite high. Plenty of scams already endeavor to use like URLs to try and trick users into thinking they're on a website they're not on (such every bit paypai.com instead of paypal.com). Coupled with the power to evidence fake URLs in the inception bar, these sites could go much farther in fooling users.

Worse, Fisher suggests this is a Chrome security flaw with no easy fix. Google would have to significantly change how the browser hides the address bar on mobile devices to combat the issue.

Thankfully, an attack using the inception hasn't appeared in the wild withal, only that doesn't mean it won't. For now, you lot'll have to stay vigilant and hope Google develops a fix before long.

Source: James Fisher Via: Android Constabulary