IT

Daily News Roundup: New Chrome for Android Attack Spoofs the Omnibox

Author: Cameron Summerson / Source: How-To Geek

There’s a new Chrome attack on the horizon, and man, it’s a doozy. Dubbed the “Inception Bar” by the finder, it replicates Chrome’s Omnibox, essentially giving attackers the potential to take control of Chrome completely.

Found by developer James Fisher, the Inception Bar is an incredibly clever phishing attack that leverages the fact that Chrome for Android hides the Omnibox—that’s what the address bar on Chrome is called—as you scroll.

Новости СМИ2

Once you scroll down the page a bit, the Omnibox is hidden, and it’s automatically replaced with the spoofed bar. And it looks incredibly convincing—it can even lock the real Omnibox in an overflow container, preventing it from re-appearing once the Inception Bar is in place.

While it doesn’t look like this attack has been found present on the web (yet), Fisher built a working proof of concept on his site, which you can check out at the link. Once you visit the site, scroll down the page a bit, and right after the Omnibox disappears, you’ll see the spoofed Inception Bar—complete with a fake URL—appear in its place. The bar doesn’t work at this point (as it’s just a proof of concept), but it’s not hard to see how with a little bit of additional code it could become a very realistic clone. It’s also worth noting that this is still buggy—closing Chrome and reopening it will display both bars, for example.

Fisher notes in his post that he doesn’t see an easy way to fix this issue, which makes a lot of sense. Since the website itself is generating the faux bar, it will be incredibly hard for the Chome team to find a way to combat the issue.

As for possible ways for users to prevent encountering this issue should it become a legitimate problem, the first one is easy: use a different browser. Any page with the code to generate the Inception Bar will still do so, but it will be hilariously obvious because other browsers don’t use Chrome’s Omnibox. It’s also worth reiterating the fact that this only works on Chrome for Android—Chrome for iOS uses a different interface that prevents this from being any sort of convincing attack. [via Android Police]

In less terrifying news, Apple talks about why it pulled screen times apps from the App Store, Zuck built his wife a nifty “sleep box,” Facebook will be a necropolis in 50 years, Spotify hits 100m subs, and more.