{"id":779,"date":"2022-03-22T15:13:11","date_gmt":"2022-03-22T15:13:11","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/nova-tehnika-phishinga\/"},"modified":"2026-11-04T08:47:18","modified_gmt":"2026-11-04T08:47:18","slug":"nova-tehnika-phishinga","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/nova-tehnika-phishinga\/","title":{"rendered":"Nova tehnika phishinga!"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><a href=\"https:\/\/thehackernews.com\/2022\/03\/new-browser-in-browser-bitb-attack.html?m=1\"><strong>The Hacker News<\/strong><\/a> pi\u0161e o novoj tehnici <em>phishinga<\/em> koja uvelike ote\u017eava njegovo otkrivanje. Pomo\u0107u tehnike <strong>Preglednik u pregledniku (eng. <em>Browser-in-the-browser <\/em>(dalje: BitB))<\/strong> mogu\u0107e je simulirati sko\u010dni prozor preglednika kako bi se la\u017eirala legitimna domena, a <em>phishing<\/em> napad izgledao uvjerljivo.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ova vrsta napada iskori\u0161tava mogu\u0107nost <strong><a href=\"https:\/\/en.wikipedia.org\/wiki\/Single_sign-on\"><em>Single sign-on <\/em>prijave<\/a> (SSO) <\/strong>koja omogu\u0107ava prijavu pomo\u0107u jednog ra\u010duna u razli\u010dite, neovisne sustave (npr. prijava Facebook ra\u010dunom u web aplikaciju Canva).<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a07563740&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a07563740\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2022\/03\/image.png\" alt=\"\" class=\"wp-image-109954\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Prilikom odabira opcije \u201ePrijavite se Google ra\u010dunom\u201c (ili Facebook, Apple, Microsoft) uobi\u010dajeno je da se pojavi sko\u010dni prozor koji tra\u017ei potvrdu autentifikacije. <strong>BitB napad poku\u0161ava imitirati cijeli proces, sko\u010dni prozor i formu za prijavu kombinacijom HTML i CSS\u00a0 koda.<\/strong> Kombiniranjem dizajna sko\u010dnog prozora i <strong><a href=\"https:\/\/www.w3schools.com\/html\/html_iframe.asp\">iframe-a<\/a><\/strong>, te\u0161ko je razlikovati legitimno od zlonamjernog web sjedi\u0161ta. Budu\u0107i da la\u017eni sko\u010dni prozor i forma izgledaju uvjerljivo pove\u0107ana je \u0161ansa za nasjedanje na phishing i odavanje svojih podataka.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dosad se mislilo da je dovoljno prije\u0107i kursorom preko gumba kako bi se vidjela poveznica na koju gumb vodi ako ga se klikne (\"jer poveznica ne la\u017ee\"). Ali, <strong><a href=\"https:\/\/mrd0x.com\/browser-in-the-browser-phishing-attack\/\">mr.d0x<\/a><\/strong> navodi kako i to vi\u0161e nije dovoljno. Naime, svojstvo poveznice (<em><strong>href<\/strong><\/em>) koje se prikazuje prilikom postavljanja kursora preko gumba, <strong>mo\u017ee biti la\u017eirano pomo\u0107u JavaScripta.<\/strong> <strong>Ako se gumbu doda<\/strong> <strong>doga\u0111aj (eng. <em>event<\/em>) (npr. \u201e<em>onclick<\/em>\u201c) koji prilikom klika vodi na poveznicu druga\u010diju od one navedene u <em>href<\/em> svojstvu, <em>href<\/em> svojstvo se ignorira, ali se i dalje prikazuje prilikom prijelaza kursorom preko gumba.<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a07563c42&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a07563c42\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2022\/03\/image-1.png\" alt=\"\" class=\"wp-image-109955\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Napad mo\u017ee biti toliko vje\u0161to izveden da otkrivanjem operacijskog sustava, preglednika i teme koju koristite, prilagodi izgled sko\u010dnog prozora svakom korisniku.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kako bi do\u0161li do koraka prijave u formu unutar la\u017enog sko\u010dnog prozora prvo se korisnika mora namamiti na zlonamjerno web sjedi\u0161te. Zato je iznimno va\u017eno prilikom posjeta web sjedi\u0161tu paziti na uobi\u010dajene detalje (https protok, lokot, naziv domene i sl.) kako bi na vrijeme prepoznali prijevaru, jer se otvaranjem la\u017enog sko\u010dnog prozora za prijavu (zbog njegovog uvjerljivog izgleda) uvelike pove\u0107ava \u0161ansa za kra\u0111u podataka.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a075640bb&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a075640bb\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2022\/03\/image-2.png\" alt=\"\" class=\"wp-image-109956\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>","protected":false},"excerpt":{"rendered":"<p>The Hacker News pi\u0161e o novoj tehnici phishinga koja uvelike ote\u017eava njegovo otkrivanje. Pomo\u0107u tehnike Preglednik u pregledniku (eng. Browser-in-the-browser (dalje: BitB)) mogu\u0107e je simulirati sko\u010dni prozor preglednika kako bi se la\u017eirala legitimna domena, a phishing napad izgledao uvjerljivo. Ova vrsta napada iskori\u0161tava mogu\u0107nost Single sign-on prijave (SSO) koja omogu\u0107ava prijavu pomo\u0107u jednog ra\u010duna u [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1216,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-779","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/779","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=779"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/779\/revisions"}],"predecessor-version":[{"id":1219,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/779\/revisions\/1219"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1216"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=779"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=779"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}