The attack, dubbed “tabnabbing,” preys on browser tabs and the fact that users generally don't keep track of all the tabs they have open at one time, said Aza Raskin, creative lead for Mozilla's Firefox web browser, who discovered and publicized the technique.
When a user eventually returns to the tab, they see the spoofed page for a site, for example, Gmail or Facebook.
The attack is different from most phishing ploys, which rely on deception alone, Raskin said. This tacic relies on the “perceived immutability of tabs."
“What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking,” Raskin wrote. “That'll catch us by surprise.”
An attacker could make the phishing ruse even more cunning by creating a targeted attack that takes advantage of a user's web browsing history file, Raskin warned. In addition, instead of simply displaying a login screen on the spoofed page, an attacker could display a message that the user's session has timed out, thereby adding legitimacy to the attack.
Raskin provided a proof-of-concept of the attack, in which a bogus Gmail page is displayed.
According to researchers at Mac security vendor Intego, the proof-of-concept at least works on Firefox and Safari.
“For now, there's no way to indicate that the page has changed, and users should be extremely careful before logging into any webmail, bank or online commerce site page,” Intego researchers wrote in a blog post Tuesday.
In addition, they said users should check the URL of a site carefully if an unexpected login screen appears.
To further protect themselves, users can consider running the NoScript add-on for Firefox, Mike Rothman of security consultancy Securosis said in a Tuesday blog post. Or they can deploy a password management tool, which should not make saved logins available for use at malicious sites.