6 ms·
Progressive Web Apps (PWAs) Phishing
- difosfor 2y agoI think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..
- kristiandupont 2y agoI guess the argument would be that a screened app store would block such a malicious app. But since the trick requires the user to go to a malicious website to install this app, it seems to me that the user might similarly be tricked into entering credentials on that website.
- ghayes 2y agoIdeally, the best defense here is a FIDO-compliant 2FA or Passkey that would properly not send a valid credential for a different domain.
- ffpip 2y agoThis looks a lot like a Oauth request, where you are redirected to sign-in. You check the URL and enter the creds, with the assumption that you are using "Sign in with Microsoft" to login to the site since this is how that login flow works
- whartung 2y agoThat’s the thing. For a desktop app, they can pop up a chromeless web view with the Oauth login page. You can’t vet the authenticity at all.
- paulddraper 2y agoNo, the malicious website would have a "Sign in with Facebook". You would enter your credentials on something that (according to a url bar) is Facebook.com
- deleted 2y ago[deleted]
- theteapot 2y agoWhat's the difference between this and just having a button on your website that redirects to a spoof microsoft login page?
- codetrotter 2y agoBecause this one makes it look like there’s a url bar with a Microsoft domain
- ajross 2y agoNo it doesn't. You need to fool the user into installing an app that loads from your own domain. Now that obviously isn't impossible, but it requires getting the user to ignore or be mislead by the clearly-displayed URL in the web page and/or installer UI. As the commenter upthread conjectured, this is indeed perfectly isomorphic to fooling a user into loading and interacting with a faked web page. That's a real threat! But it's clearly not a new threat with PWAs and IMHO this article is mostly just spun clickbait. This isn't remotely a novel vulnerability.
- felipc 2y agoNope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with several "Login with ..." buttons, and one of them triggers this.
- ajross 2y ago> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of software. I'm not seeing where you're getting anything novel here at all. If you let people run software written by other people you need some kind of protection against people being fooled by bad software. That is obviously a very hard problem with only imperfect solutions. But those solutions do exist, and that protection exists here in PWAs and needs to be evaded, in a form that is entirely analogous to the way you have to validate a web page you're looking at.
- erikerikson 2y agoDoes this fool tools like 1Password?
- phartenfeller 2y agoNo as the page's URL is still not the real login URL. The shown address bar is just a fake with styled website content if I understood it correctly. Really smart!
- peheja53 2y ago[dead]
- peheja53 2y ago[flagged]
- meiraleal 2y agoThat's indeed a tricky one. Even tho I work with PWAs I could see myself being misled by this with a github credential. Good remind to only connect third party services with access tokens.
- jeroenhd 2y agoMany applications will obtain such a token through an OAuth flow of some kind. Using a browser-integrated password manager or passkey will usually prevent this attack, though.
- Nathanba 2y agoNah, it won't because it happens all the time that my password manager doesn't recognize the current url because the auth signin flow had so many weird urls in it that I had to save the url manually and now it's not the right url so I copy out the password manually instead of autofilling it. This was actually the case for my Google account which I created through gmail but then my gmail password wasn't using the right url for all the other google services. Now that I think about it, this was also the case for my Microsoft account that I got a long time ago through hotmail. I think that this is a fairly legitimate attack vector and it's sad because I really want to be able to hide the url bar in my PWAs through custom styling to make it look more like a real native app.
- ensignavenger 2y agoYour right about simple password managers, but passkeys do prevent this flaw.
- toddmorey 2y agoWhat makes this PWA specific rather than just “installable software”?
- toddmorey 2y agoAh, I’m thinking Windows maybe requires less permission to install a PWA?
- MisterDizzy 2y agoIt's "installed" through the browser, and it runs in the browser. So a PWA is just a browser app that maybe runs in a window with no browser chrome so it feels more native.
- arendtio 2y agoPWAs are generally considered safe to install because they are just a website (running in a sandbox) plus some fancy desktop integration. Normal software you install doesn't run in a sandbox and has much more capabilities. However, as with every phishing attack, the user must ignore small (security related) hints.
- dzhiurgis 2y agoThis reminds me OAuth screens where you are not sure why your password manager doesn’t work…
- RcouF1uZ4gsC 2y agoI don’t things is much worse than OAuth itself. You just have to make a login with Google/Facebook/X button. Also the thing about the URL won’t have much practical difference for the user. The reason is that a lot of the flows can redirect through different domains. For example, when I sign in with Google into a third party site, I often see a redirect through the YouTube domain. So users are not expecting full fidelity to the domain.
- beardyw 2y agoSurely you could pull this trick just by using full screen mode couldn't you? And all that requires is any user interaction.
- deleted 2y ago[deleted]
- kmf84 2y agoYes, but I found it a little earlier. ( 4 years ago) https://github.com/0x1235/PWA_Spoofing_PoC https://github.com/0x1235/PWA_Spoofing_PoC