Netcraft is reporting about latest phishing scam on an Italian banking website. Hackers has developed new methods that are almost impossible to track. The attack, targeting Banca Fideuram, reaches users via the usual route of an authentic-looking email using a pretext to ask users to log into the bank’s site. Despite the SSL certificate, the attackers have been able to inject an IFRAME into the login page, loading a login form which is hosted on a web server in Taiwan. IFRAME is a common way of inserting external content into a web page and a malicious payload could be delivered using the vulnerable GET parameter. In that case the browser would, in addition to displaying “https” at the start of the URL, also display a locked padlock icon. In this Italian bank case attackers used the URL and injected a series of numbers directly into a JavaScript function call that already exists on the bank’s legitimate LoginServlet page, making the bogus URL nearly identical to the real one. The injected form transmits users’ data to Taiwan before redirecting users to the bank’s unaltered homepage. Banca Fideuram has been contacted about the problem and phishing site is blocked in Netcraft’s anti-phishing toolbar and in PhishFeed.
