From 4d13bc210aa9ce986f195951e1db810ca06f6504 Mon Sep 17 00:00:00 2001 From: Sergey Chumak Date: Tue, 9 Jun 2020 19:20:36 +0300 Subject: [PATCH] Create url-spoof test page --- .../public/webviewtest/url-spoof-ssl.html | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 resources/public/webviewtest/url-spoof-ssl.html diff --git a/resources/public/webviewtest/url-spoof-ssl.html b/resources/public/webviewtest/url-spoof-ssl.html new file mode 100644 index 0000000..8c5637e --- /dev/null +++ b/resources/public/webviewtest/url-spoof-ssl.html @@ -0,0 +1,61 @@ + + + + + + + + +

URL Spoof via connections with SSL errors

+ +

+ Immediately after page load, this attacker page navigates to a URL with an SSL error. + This causes the URL in the address bar to update with a positive HTTPS indicator, but no navigation occurs. + Therefore the attacker page remains fully interactive. All permission prompts by the Status app also use the spoofed URL. +

+ + + + +
+ +

+ The attack works with a myriad of SSL error conditions, such as: +

+ Note that when tapping the links above, the loading indicator is shown again. + However, on page load, the loading indicator is not shown again since it's already being shown for this attacker page. + Therefore, on page load, the attack is not detectable. The attacker page can also change the page contents if the loading indicator is shown after page load to simulate a real navigation. +

+ + + + +