How to foil Web browser 'tabnapping'

Patches may never come, but you can take steps to stymie tab kidnapping

A new, incredibly sneaky identity-theft tactic surfaced earlier this week when Mozilla's Aza Raskin, the creative lead of Firefox, unveiled what's become known as "tabnapping."

Stated simply, tabnapping -- from the combination of "tab" and "kidnapping" -- could be used by clever phishers to dupe users into giving up passwords by secretly changing already-open browser tabs. All of the major browsers on Windows and Mac OS X are vulnerable to the attack.

Because most people keep multiple tabs open, often for long periods, and because they trust that the contents and label of a tab are immutable, tabnapping could become the next big thing in identity theft.

That open tab labeled "Citibank" or " Facebook " may not be the real deals, Raskin argued. But you may not know that..., so you enter your username and password to, you think, log in again.

Boom! You're owned.

Tabnapping isn't in active circulation at the moment, but the ease with which another researcher was able to sidestep a noted Firefox add-on designed to prevent such trickery doesn't bode well.

What can you do if tabnapping shows its face? We have a few answers.

What should I not do? Don't log-in on a tab that you haven't opened yourself.

Since the tabnapping tactic banks on you trusting that you opened the tab -- and that the site simply timed out -- the best defense is this offensive move. In other words, if you see a tab that contains a seemingly-legit log-in form, close it, then head to the site yourself in a new tab.

Will browser makers patch this? Unlikely. Microsoft's Jerry Bryant, a general manager at the company's security response center, said the issue isn't a security vulnerability per se, and that Internet Explorer (IE) falls for the scam because that's the way browsers work.

"Working with [Raskin's] proof-of-concept, as written, is expected," he said in an e-mail Tuesday when asked whether Microsoft had a fix in mind for IE.

Can my browser protect me at all? Yes.

Every major browser has a filter of some kind designed to weed out malicious sites and/or legitimate sites that are suspected of being infected with attack code. Presumably, those filters, assuming the blacklists underlying them are current and accurate, would block tabnapping attacks.

To kidnap tabs, a hacker has to get his tab-mutating code onto your machine somehow . Raskin pointed that out by noting the likely attack vector. "Every time you include a third-party script on your page, or a Flash widget, you leave yourself wide open for an evil doer to use your site as a staging ground for this kind of attack," he wrote in his blog .

So the best defense browsers can currently manage is to warn you of potential attack sites before you reach them. That's where filtering comes in.

But will my browser block tabnapping attack code from getting on my machine? Microsoft certainly thinks that IE will.

"Behind the scenes, [IE's] SmartScreen Filter also plays a role in combating this sort of hijacking attempt," said Microsoft's Bryant, talking about the anti-malware/anti-phishing filter IE included. "SmartScreen successfully blocks millions of views of malicious pages each month and would help protect the user in this situation."

Microsoft has commissioned NSS Labs to conduct several studies of filtering efficiency, most recently earlier this year. Not surprisingly, IE regularly comes out atop the chart in NSS Labs' ensuing reports, with Apple 's Safari and Mozilla's Firefox far behind, and Google 's Chrome and Opera Software's Opera even further back.

Other browsers have tools similar to SmartScreen. In Firefox and Chrome it's called "Phishing and Malware Protection;" Opera dubs its filter "Fraud Protection;" Safari doesn't give it a name, but simply offers a setting that reads, "Warn when visiting a fraudulent website" in the Security section of its Preferences settings.

Anything else I can do while I use my browser to stymie tabnapping? Yes, there is. Look at the URL in your browser's address bar before filing in any form or giving out any personal information. Unless the attackers are particularly clever and able to exploit a vulnerability or flaw to "spoof," or fake the URL, it won't match the bogus log-in screen.

That's your cue to close the tab immediately.

IE8 has a feature dubbed "Domain Highlighting" that helps here: The actual domain -- the xxxxx.com part -- is highlighted in black, while the rest of the URL is grayed out.

Any add-ons I can try that will help? Of course. Whether they work or not is a different question.

NoScript , the premier script-blocking Firefox add-on, stops Raskin's proof-of-concept in its tracks, since his tabnapping relies on JavaScript. But it's not foolproof.

Israeli research Avi Raff has created code that circumvents NoScript's defenses in Firefox to kidnap a tab. Computerworld has confirmed that Raff's code produces a tab change even when NoScript's installed in Firefox.

What about password managers? Will they help here? They can.

Third-party browser password managers -- RoboForm on Windows, 1Password on Mac come to mind -- link saved log-in usernames and passwords to a specific URL. Assuming you saved the username and password while at the real site's log-in page, you're golden: The manager won't enter the username and password into a non-matching URL.

I've heard that Chrome isn't vulnerable. True? Nope. Although several sites initially reported that Chrome didn't fall for tabnapping -- Computerworld noted that Raskin's tactic worked some of the time on production editions -- it turns out that Google's browser had a bug that prevented kidnapping.

That bug was fixed in the Chrome developer preview build 6.0.408.1, said Raskin in a exchange of e-mails with Computerworld today. "Chrome is fully susceptible to this attack," Raskin wrote.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com .

Read more about security in Computerworld's Security Topic Center.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags web browserssecurityphishingtabnapping

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?