How to foil Web browser 'tabnapping'

Patches may never come, but you can take steps to stymie tab kidnapping

A new, incredibly sneaky identity-theft tactic surfaced earlier this week when Mozilla's Aza Raskin, the creative lead of Firefox, unveiled what's become known as "tabnapping."

Stated simply, tabnapping -- from the combination of "tab" and "kidnapping" -- could be used by clever phishers to dupe users into giving up passwords by secretly changing already-open browser tabs. All of the major browsers on Windows and Mac OS X are vulnerable to the attack.

Because most people keep multiple tabs open, often for long periods, and because they trust that the contents and label of a tab are immutable, tabnapping could become the next big thing in identity theft.

That open tab labeled "Citibank" or " Facebook " may not be the real deals, Raskin argued. But you may not know that..., so you enter your username and password to, you think, log in again.

Boom! You're owned.

Tabnapping isn't in active circulation at the moment, but the ease with which another researcher was able to sidestep a noted Firefox add-on designed to prevent such trickery doesn't bode well.

What can you do if tabnapping shows its face? We have a few answers.

What should I not do? Don't log-in on a tab that you haven't opened yourself.

Since the tabnapping tactic banks on you trusting that you opened the tab -- and that the site simply timed out -- the best defense is this offensive move. In other words, if you see a tab that contains a seemingly-legit log-in form, close it, then head to the site yourself in a new tab.

Will browser makers patch this? Unlikely. Microsoft's Jerry Bryant, a general manager at the company's security response center, said the issue isn't a security vulnerability per se, and that Internet Explorer (IE) falls for the scam because that's the way browsers work.

"Working with [Raskin's] proof-of-concept, as written, is expected," he said in an e-mail Tuesday when asked whether Microsoft had a fix in mind for IE.

Can my browser protect me at all? Yes.

Every major browser has a filter of some kind designed to weed out malicious sites and/or legitimate sites that are suspected of being infected with attack code. Presumably, those filters, assuming the blacklists underlying them are current and accurate, would block tabnapping attacks.

To kidnap tabs, a hacker has to get his tab-mutating code onto your machine somehow . Raskin pointed that out by noting the likely attack vector. "Every time you include a third-party script on your page, or a Flash widget, you leave yourself wide open for an evil doer to use your site as a staging ground for this kind of attack," he wrote in his blog .

So the best defense browsers can currently manage is to warn you of potential attack sites before you reach them. That's where filtering comes in.

But will my browser block tabnapping attack code from getting on my machine? Microsoft certainly thinks that IE will.

"Behind the scenes, [IE's] SmartScreen Filter also plays a role in combating this sort of hijacking attempt," said Microsoft's Bryant, talking about the anti-malware/anti-phishing filter IE included. "SmartScreen successfully blocks millions of views of malicious pages each month and would help protect the user in this situation."

Microsoft has commissioned NSS Labs to conduct several studies of filtering efficiency, most recently earlier this year. Not surprisingly, IE regularly comes out atop the chart in NSS Labs' ensuing reports, with Apple 's Safari and Mozilla's Firefox far behind, and Google 's Chrome and Opera Software's Opera even further back.

Other browsers have tools similar to SmartScreen. In Firefox and Chrome it's called "Phishing and Malware Protection;" Opera dubs its filter "Fraud Protection;" Safari doesn't give it a name, but simply offers a setting that reads, "Warn when visiting a fraudulent website" in the Security section of its Preferences settings.

Anything else I can do while I use my browser to stymie tabnapping? Yes, there is. Look at the URL in your browser's address bar before filing in any form or giving out any personal information. Unless the attackers are particularly clever and able to exploit a vulnerability or flaw to "spoof," or fake the URL, it won't match the bogus log-in screen.

That's your cue to close the tab immediately.

IE8 has a feature dubbed "Domain Highlighting" that helps here: The actual domain -- the part -- is highlighted in black, while the rest of the URL is grayed out.

Any add-ons I can try that will help? Of course. Whether they work or not is a different question.

NoScript , the premier script-blocking Firefox add-on, stops Raskin's proof-of-concept in its tracks, since his tabnapping relies on JavaScript. But it's not foolproof.

Israeli research Avi Raff has created code that circumvents NoScript's defenses in Firefox to kidnap a tab. Computerworld has confirmed that Raff's code produces a tab change even when NoScript's installed in Firefox.

What about password managers? Will they help here? They can.

Third-party browser password managers -- RoboForm on Windows, 1Password on Mac come to mind -- link saved log-in usernames and passwords to a specific URL. Assuming you saved the username and password while at the real site's log-in page, you're golden: The manager won't enter the username and password into a non-matching URL.

I've heard that Chrome isn't vulnerable. True? Nope. Although several sites initially reported that Chrome didn't fall for tabnapping -- Computerworld noted that Raskin's tactic worked some of the time on production editions -- it turns out that Google's browser had a bug that prevented kidnapping.

That bug was fixed in the Chrome developer preview build 6.0.408.1, said Raskin in a exchange of e-mails with Computerworld today. "Chrome is fully susceptible to this attack," Raskin wrote.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is .

Read more about security in Computerworld's Security Topic Center.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityphishingweb browserstabnapping

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?