IDG News Service reports that a bug found in all major browsers could make it easier for criminals to steal online banking credentials using a new type of attack called 'in-session phishing', according to researchers at Trusteer.
In a usual phishing attack, criminals send out millions of bogus email messages that look like they come from legitimate sources, such as banks or online payment companies.
Those messages are often blocked by spam-filtering software, but in-session phishing, the email message is replaced by a pop-up browser window.
IDG News Service explains, "Here's how an attack would work: the bad guys hack a legitimate website and plant HTML code that looks like a pop-up security alert window. The pop-up would then ask the victim to enter password and login information, and possibly answer other security questions used by the banks to verify the identity of their customers."
The tricky bit is convincing victims that the pop-up is legitimate, but Amit Klein, Trusteer's chief technology officer, claims a flaw in JavaScript plays into the baddies' hands.
Klein is reported saying he has found a way to identify whether or not someone is logged into a website, provided they use a certain JavaScript function, which he won't name because he doesn't want to give crooks any ideas. Klein claims criminals could become more sophisticated, making the pop-ups appear when a user is actually on a certain bank's site, say, rather than at random, which is more suspicious.
Klein has alerted browser companies though, who presumably will develop patches. Also see Agencies compile list of 25 worst security threats story below.