IE URL obfuscation

From: Ben Reardon (ben.reardon_at_BIGPOND.COM.AU)
Date: 12/10/03

  • Next message: Bailey, Matthew: "SUS Activity Last night" 
    Date:         Wed, 10 Dec 2003 20:01:42 +1000
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    The latest clever twist in the URL obfuscation techniques is shown in the
    POC below.

    This is bad news, obviously whatever trust anyone had in the IE address bar
    (assuming you could trust your DNS in the first place) is now out the
    window.

    It is now even more important to impress (and educate) users on the
    importance of validating certificates.

     <http://www.zapthedingbat.com/security/ex01/vun1.htm>
    http://www.zapthedingbat.com/security/ex01/vun1.htm

     <http://www.securityfocus.com/archive/1/346948>
    http://www.securityfocus.com/archive/1/346948

    Regards

    Ben Reardon

    -----
    Marcus Ranum's new book "The Myth of Homeland Security" is now out and
    is available from http://www.amazon.com/ranum In this hard-hitting
    review of the homeland security business, Ranum shows us how the problem
    is vastly harder than it's being made to sound, and how special
    interests, *** covering, and bureaucracy are threatening to derail any
    chance of making progress.
    -----

  • Next message: Bailey, Matthew: "SUS Activity Last night"
    • Quantcast