In Session Phishing

Security 1月 27, 2009
(Last Updated On: 2009年1月28日)

In Session Phishingという興味深いアドバイザリが公開されています。

具体的な記載はありませんが、現在広く利用されているInternet Explorer, Firefox, Safari, ChromeでJavaScriptを利用するとユーザが特定のサイトにログインしていたか判別できるようです。

Recently Trusteer CTO Amit Klein and his research group discovered a vulnerability in the JavaScript engine of all leading browsers – Internet Explorer, Firefox, Safari, and Chrome – which allows a website to check whether a user is currently logged onto another website. The source of the vulnerability is a specific JavaScript function. When this function is called it leaves a temporary footprint on the computer and any other website can identify this footprint. Websites that use this function in a certain way are traceable. Many websites, including financial institutions, online retailers, social networking websites, gaming, and gambling websites use this function and can be traced.





投稿者: yohgaki