Hackers are using browser-in-the-browser trick to steal Facebook logins
Image: Facebook
Summary created by Smart Answers AI
In summary:
- PCWorld reports that hackers are increasingly using browser-in-the-browser (BITB) attacks to steal Facebook login credentials through sophisticated fake browser windows.
- Facebook’s large and diverse user base makes it a prime target, with attackers using spam emails and texts to lure victims to convincing fake login pages.
- Users can detect these attacks by attempting to drag the fake browser’s title bar, and should verify legitimacy by logging in separately to avoid credential theft.
If you’re still using Facebook, then I assume you’re old enough to remember watching John Wayne movies in the theater. Nevertheless, it remains a pretty juicy target for hackers and digital thieves. They’re using a technique that you should be aware of, even if your only interaction with the slop-ridden hellscape of Facebook is through your relatives: browser-in-the-browser attacks.
A browser-in-the-browser attack (often shortened to BITB) is an old idea, but given a new twist. You get a fake page that impersonates a real page — nothing new, right? As long as you can see that you’re at the correct URL in the browser (checking carefully for look-alikes, such as “faceloook.com”), you’re safe. A BITB attack creates both the fake page and fake browser elements around the page, including a legit-looking address in the URL bar. It’s simple, it’s sneaky, it’s effective.
Security vendor Trellix released a new report that indicates these browser-in-the-browser attacks are on the rise, specifically targeting Facebook users. The hook comes from the usual places, spam email or texts that claim something is wrong with the account or there’s another security issue, but following the fake (but legit-seeming) URL leads you to a custom page with the BITB rendering trick. Adding in a Captcha step can throw users off their guard, and then a fake login page is all that’s needed to nab a username and password.
Facebook is such a tempting target because of its massive amount of users, over two billion active daily according to some metrics. And many of them are, ahem, somewhat less than tech-savvy. So not only are they more likely to follow a link in a phishing email and be bamboozled by a browser-in-the-browser trick, they’re probably more likely to reuse login passwords as well. That would make a successful phishing attack, targeting identity theft material even more dangerous.
As Bleeping Computer notes, you can spot a browser-in-the-browser attack by trying to interact with the internal fake browser. If you can’t click and drag the title bar, that’s an easy giveaway. And as always, logging in via a separate window, browser, or device instead of following a link is a great way to quickly test the veracity of an alarming email.
Author: Michael Crider, Staff Writer, PCWorld
Michael is a 10-year veteran of technology journalism, covering everything from Apple to ZTE. On PCWorld he’s the resident keyboard nut, always using a new one for a review and building a new mechanical board or expanding his desktop “battlestation” in his off hours. Michael’s previous bylines include Android Police, Digital Trends, Wired, Lifehacker, and How-To Geek, and he’s covered events like CES and Mobile World Congress live. Michael lives in Pennsylvania where he’s always looking forward to his next kayaking trip.
