Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-Disclosure] .MAC Webmail phishing attack
From: Peter John Hill (phillandrew.cmu.edu)
Date: Tue Mar 23 2004 - 08:53:33 CST
--On Tuesday, March 23, 2004 8:58 AM +0000 rabbit food
> It may be possible to redirect a naive .Mac webmail
> user, to another site, possibly, one mocked up as
> webmail (a user may ignore the fact SSL is not
> http://webmail.mac.com/redirect/http://your url
How is this different from <<ANY>> other redirect attack. Why is this a ".MAC
Webmail phishing attack" ???
Is there anything special about .mac webmail that makes this kind of attack any
easier? This is not some intuitive leap here...
Now the IE obfuscated (look up the definition in dictionary.com) redirection
bug, that was good. It could even be crafted to make the little lock icon
I just don't want some ignorant reporter reading your message and thinking "oh
my god, Apple's email service is full of holes!!!"
Full-Disclosure - We believe in it.