Tabnabbing - Another Way of Phishing

Tabnabbing is a type of phishing attack. Let’s discuss how it works If you are working with multiple tabs in your browser and one of them is opening a normal looking website which is hosted or compromised by attacker and this tab goes inactive for some time then the page in inactive tab force your browser to replace favicon, page title & page to look alike login page to any of the server which you are using and then whenever you switch to this inactive tab you will get spoofed login page and as I said it’s look alike page so if you don’t check URL carefully (which is very common as if you are regular visitor of a site you use to identify that site by look and care for URL in beginning of the session but during the session you least bother about URL) and proceed with login assuming that I might opened this page but forgot to login then your credential will be submitted to attacker’s website and then he will redirect you to original website.

Example :- I am working with multiple tabs in my browser Tab_1 – Gmail, Tab_2 – Google, Tab_3 – w.x.y.z, Tab_4 – Microsoft as shown in following picture

Now suppose my Tab_3 goes inactive for few minutes because I was working on other tabs here attacker’s script for Tabnabbing works and if it will sense that you lost focus from this tab and it's inactive for a while then it force Tab_3 to replace favicon , page title and page as Gmail login page, now when I switch to Tab_3 i found Gmail login page with Gmail favicon and page title as shown in following Picture (as I highlighted with circle in picture if you notice URL is not correct but this attack is based on assumption that generally we don’t check for URL during the session and because of look and feel it pretends original login page)

Now after getting this page I may think that I opened Gmail and forgot to login and I proceed with login then my user name and password is submitted to attacker’s URL and then he will redirect me to original Gmail, as I have already active session with Gmail in Tab_1 it will load my account successfully in Tab_3 as well.

Note:- To make this attack more effective attacker use to collect information first about your browsing like what sites you use to visit (Email, Internet banking, Social networking, etc) and then they host a normal looking website with tabnabbing script. this normal looking website can be advertised or promoted by any method to influence you for visit.

I hope this article will help you to understand Tabnabbing and it's working :-)