Re: "New Universal Man-in-the-Middle Phishing Kit" ?

In article <1169106344.216078@xxxxxxxxxxxxxxxxxxxxxxx>,
mak <mak@xxxxxxxxxx> wrote:

Barry Margolin wrote:

...snip...
how does an URL communicate with anything?

They mean "the server accessed via the URL".
that's what i thought,

and why wouldn't my browser complain about an invalid certificate for my
banks site?

You're not going to your bank's site, your going to the phisher's site
because you clicked on the fraudulent URL he sent you. The phisher has
a valid certificate for his own site, of course, so there's nothing for
your browser to complain about (it has no way of knowing where you
*think* you're going).


ok,
but then I will see the bogus URL
as in:

http://www.mybank.com.onlineid3979954057.rwrth.ws/customer.htm

in my browser, right?

Maybe. But that's true of traditional phishing sites, it's nothing new
in this case. The MitM attack simply adds the ability of the site to
display things on the page that supposedly only the real site can
display (such as your last ATM transaction).

--
Barry Margolin, barmar@xxxxxxxxxxxx
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
.

Relevant Pages