New URL Spoofing Flaw Found in Internet Explorer

A new spoofing flaw in Microsoft's Internet Explorer browser allows an improperly coded web link to send users to a diffferent URL than the one displayed in the status bar.

The flaw, which was posted to the Bugtraq mailing list by Benjamin Franz, is exploited by placing two URLs and a table within a single HTML href tag, producing a link that looks like this:

http://www.microsoft.com

displaying http://www.microsoft.com in the browser, but sending the user to Google. Franz says the exploit works in fully-patched versions of Internet Explorer and Outlook Express, meaning the HTML code can be used to create spoofed URLs in webpages and HTML e-mails.

The technique, which can be executed by anyone with basic knowledge of HTML, can be used to construct convicing fake URLs for use in phishing scams. The flaw is possible because Internet Explorer has difficulty processing improperly formed HTML. The attack opens one href tag, and then leaves that tag open while enclosing a second URL within a table. The browser displays the first URL in the status bar, but sends users to the second URL.

The flaw affects versions of IE up to 6.0.2800.1106 - which includes systems that haven't yet installed Windows XP SP2, but are current on all other critical updates from Windows Update - as well as the Safari browser for Macs. Users running Windows XP SP2 (IE version 6.0.2900) and the open source Firefox and Mozilla browsers are not affected.

Phishing attacks seek to trick account holders into divulging sensitive account information through the use of e-mails which appear to come from trusted financial institutions and retailers. Several previous URL spoofing weaknesses in Internet Explorer have been widely used by phishing attacks. The ability to display a fraudulent URL in the status bar is especially useful, as security-conscious users would check the status bar before clicking through. The technique does not disguise the URL displayed in the address bar upon arrival at the destination page, meaning alert users will recognize the spoof at that point. But the tactic could be used to send e-mail recipients and web surfers to pages that attempt to download malware upon loading, a common tactic used by phishers to install trojans and keyloggers.

Netcraft has developed a service to help banks and other financial organizations identify sites which may be trying to construct frauds, identity theft and phishing attacks by pretending to be the bank, or are implying that the site has a relationship with the bank when in fact there is none.

bump, when you say be caeful, if we try it, will we be sent to a porno site or end up with a virus?

Not not at all. My example says "GeorgeWBush.com" but if you click on the link it will take you to "JohnKerry.com" instead. Try it.

The possibility exists that bad guys could use the exploit to do just as you said, or to send you to a spoof site that is intended to get personal details like credit card numbers or passwords -- which is why I advised caution. My link (and the one in the article) is perfectly safe.

Here's another example:

Free Republic.

Mozilla's Firefox will not do that. Go to the link mentioned above to download Firefox.

It is the current best competitor to IE. As the article mentioned, no version of IE is fixed yet.

IE is a major source of spyware infiltration on people's computers. Its main advantage at one time was its use of Active-X routines to allow near-complete control of your computer via web pages (thus greatly lowering bandwidth need and greatly increasing graphic possibilities). It is this same benefit that is now exploited via spyware programs. These programs are downloaded (often without permission) onto your computer and can collect all keystrokes from within your browser.

Java, rather than Active-X, is used by all other browsers. IE also uses Java, thus maintaining the greatest level of capability but at the aforementioned risk.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.