Switched has a new home! Huffpost Tech.

Click here to visit the new home of Switched!

Hot on HuffPost Tech:

See More Stories
AOL Tech

New Phishing Attack Using Pop-Up Windows From Bank Sites

by Terrence O'Brien on January 16, 2009 at 12:28 PM


Online scammers and phishers are constantly improving their skills and developing even more sophisticated methods of attack. One of our jobs here at Switched is to stay on top of these Internet criminals and warning you, the reader, about when they'll strike, how they'll strike, and how to avoid falling victim to these online con-jobs.

The latest threat to your security comes in the form of so-called "in-session phishing" attacks, that present themselves as pop-up windows from legitimate Web sites (much like the screenshot above). Often, these pop-ups will occur while you're on a banking Web site and will tell you that your session has expired and prompt you to re-enter your username and password.

What makes these attacks particularly worrisome is that they don't require the installation of traditional malware. The pop-ups can be triggered by embedding a small piece of code in a legitimate Web site, but the code never actually gets loaded on a victim's computer, making it difficult if not impossible for traditional anti-malware defenses to detect the flaw.

Currently every major browser is susceptible to this hole, and since no code is required to be loaded on the victim's PC, no operating system is safe -- OS X and Linux are just as vulnerable as Windows to this attack. The best defense, as usual, is a little common sense. Don't trust any pop-ups that ask you to enter credentials, unless you know for sure that it is a legitimate window. Even better, don't trust any pop-up at all. Most legitimate Web sites ditched pop-ups long ago. [From: DarkReading]

Related Links:

Tags: phishing, scam, security

Comments

3

Add your comments

Please keep your comments relevant to this blog entry. Email addresses are never displayed, but they are required to confirm your comments.

When you enter your name and email address, you'll be sent a link to confirm your comment, and a password. To leave another comment, just use that password.

To create a live link, simply type the URL (including http://) or email address and we will make it a live link for you. You can put up to 3 URLs in your comments. Line breaks and paragraphs are automatically converted — no need to use <p> or <br /> tags.

HuffPost AOL Social News Most Popular