Neue Browsersichheitslücke entdeckt: Phishing

[Magicq99]

Zitat von Elrod Cater F-K

ohh man das ist echt krass da muss man echt aupassen das man nicht in die falle geht

und wie kann man den genauen unterschied erkennen?

Du selbst kannst es nur schlecht erkennen, aber Dein Browser kann es erkennen. Apple hat z.B. in diesem Jahr ein Sicherheitsupdate für den Safari Browser veröffentlicht, welches hier beschrieben ist:
http://docs.info.apple.com/article.html?artnum=301116

Darin heißt es als Beschreibung des Problems:

Safari can display Unicode characters in URLs, allowing you to access foreign language websites using their native language. For example, you could enter the Japanese language URL "??.jp" to visit the website instead of using the Latin alphabet that represents that domain name to get there.

However, lookalike characters could be used to make users believe that they are viewing a different site than what they actually are. For example, the Cyrillic letter "a" could be used in place of the Latin letter "a," making it difficult for a user to tell if they are at "www.apple.com" or a malicious imposter website that's designed to look like the real one. These sites can be used to collect account numbers, passwords, and other personal information. This can affect any web browser with support for International Domain Names. Security Update 2005-003 addresses this issue.

und die Lösung:

Security Update 2005-003 provides a user-editable list of scripts that are allowed to be displayed natively in domain names. The default list does not include Latin lookalike scripts (Cherokee, Cyrillic, and Greek) that could be used to trick users into navigating to malicious sites.

Domain names containing scripts that are not in the allowed list will be displayed in an ASCII format called "Punycode." For example, an imposter website with the URL "http://www.apple.com/" that uses the Cyrillic letter "a" would be displayed as "http://www.xn--pple-43d.com" for your protection. This conversion prevents disabled scripts from being confused with other scripts.

In Firefox ist wohl eine ähnliche Lösung implementiert, die internationalen Domain Namen werden in Punycode angezeigt. Mehr über Punycode:
http://en.wikipedia.org/wiki/Punycode

[Elrod Cater F-K]

thx an euch beiden
mal schauen wann MS den Patch rausbringt

jetzt weiss ich worauf ich achten muss ich wollte bald beim online banking einsteigen ich fand es aber immer zu unsicher aber mit den mobilen TAN überleg ich mir das nochmal

ja ich traue ehh den wenigsten email