Webmail and Online Banks Targeted By Phishing Proxies 50
An anonymous reader writes "Netcraft confirms a recent increase in the number of malicious proxy auto-config (PAC) scripts being used to sneakily route webmail and online banking traffic through rogue proxy servers. The scripts are designed to only proxy traffic destined for certain websites, while all other traffic is allowed to go direct. If the proxy can force the user to keep using HTTP instead of HTTPS, the fraudsters running these attacks can steal usernames, passwords, session cookies and other sensitive information from online banking sessions."
Why HTTP? (Score:5, Insightful)
My problem with session cookies... (Score:2, Insightful)
I have an issue with the so called, "session cookies."
While they are a part of online the presence, non of their behavior would be stomached in actual day-to-day life.
So the issue is that we've got two set's of paradigms. An online one where you can be tracked by default and a real life
one where you have to be explicitly informed if one is to monitor your every activity.
Sad, indeed.
Re:Why HTTP? (Score:5, Insightful)
Path of least resistance at this point. What's easier, getting a malicious PAC script installed, or getting the same PAC script installed as well as having a user sign off on an invalid certificate?
Admittedly, getting someone to blindly click "yes" to accept the bad certificate isn't difficult, but if it doesn't pop at all - all the better for the malicious person on the other end.
Warhol Billionaires (Score:5, Insightful)
Re:Why HTTP? (Score:2, Insightful)
Why redirect the traffic at all? Why not just use a key logger and grab credentials that way? Most banks and webmail don't use two factor authentication.
Re:Why HTTP? (Score:4, Insightful)
Why bother with HTTP? Plenty of malware gets signed certs.
The attack described here does not involve malware. On WPAD requests seen on DHCP or DNS, just inject a WPAD reply with a malicious PAC script and you are done.