Cross your fingers and click

UH!Mustaca!HTML

  30 June 2006

Description

Making what looks like a valid link to PayPal turn into a link to a phishing site using a FORM and a cleverly constructed INPUT tag.

Submitted by Sorin Mustaca.

Example

<FORM action=http://201.117.14.43:8090/xxev/cmd_run/index.php?>
<p><a href="https://www.paypal.com/cgi-bin/webscr?cmd=_login-run">
<font size="2" face="Arial, Verdana">
<INPUT style="BORDER-RIGHT: 0pt;
BORDER-TOP: 0pt; FONT-SIZE: 10pt; BORDER-LEFT: 0pt; CURSOR:
hand; COLOR: blue; BORDER-BOTTOM: 0pt; BACKGROUND-COLOR: transparent;
TEXT-DECORATION: underline" type=submit
value=https://www.paypal.com/cgi-bin/webscr?cmd=_login-run>
</font></a></p></form>

Quick Links

Poll
The Japanese government is reported to have commissioned a 'defensive virus'. Is 'defensive' malware ever a good idea?
Yes
No
I don't know
Leave a comment
View 11 comments

99 Subscription Promo

VB100 certification
VB100 This month's VB100 test saw some major changes and a radical overhaul of the VB100 test methodology - for the first time allowing products to use their 'cloud' look-up systems. John Hawes has all the details.
See full results.

Virus Bulletin currently has 224,242 registered users.