[WEB SECURITY] Google Redirect URL actively used for Phishing

[Jeremiah Grossman <jeremiah@xxxxxxxxxxxxxxx>]

Caught this on RSnakes blog:

Google Redirection Hole Used For Phishing
http://ha.ckers.org/blog/20060822/google-redirection-hole-used-for- 
phishing/

He got a fake eBay email with the following linked url: (Clicking is  
NOT recommended)
http://www.google.com/url?q=http://66.207.71.141/signin.ebay.com/ 
Members_Log-in.htm

While redirect URL functionality does not seem particularly dangerous  
on the face of it, Phishers are using them to increase the  
credibility of their attacks.


Regards,

Jeremiah Grossman
Chief Technology Officer
WhiteHat Security, Inc.
http://www.whitehatsec.com

----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]