{"id":8604,"date":"2018-09-07T12:00:54","date_gmt":"2018-09-07T19:00:54","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=8604"},"modified":"2018-09-20T04:49:19","modified_gmt":"2018-09-20T11:49:19","slug":"an-seo-expert-has-shown-how-chromes-back-button-can-be-hijacked-to-spy-on-users","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/an-seo-expert-has-shown-how-chromes-back-button-can-be-hijacked-to-spy-on-users\/","title":{"rendered":"An SEO Expert Has Shown How Chrome’s Back Button can be Hijacked to Spy on Users"},"content":{"rendered":"

For an unknown amount of time, the Chrome browser has contained a vulnerability which allows malicious websites to hijack the back button. This was recently demonstrated with striking effect by SEO expert Dan Petrovic of Dejan, an Austrialian internet marketing company. According to his public disclosure on the Dejan website, Petrovic used an elaborate proof-of-concept attack, which involved exploit code launched from his test website. He combined this exploit with a fake search engine results page and impersonation of the websites found within those results. This allowed Petrovic to spy on users\u2019 traffic to impersonated versions of his competitors\u2019 websites. He was able to record mouse movement, clicks and typing, among other things. The way this attack unfolded, was that first a Chrome user would conduct a search that related to Petrovic\u2019s website, using Google. At some point, that user would then potentially click on Petrovic\u2019s website, which was using a JavaScript exploit to hijack the Chrome back button. If the user clicked the back button while on Petrovic\u2019s website, they would be redirected to a fake version of the search results page they had previously navigated to his site from. Very tricky, indeed. Within this fake search results page, were links to fake versions of Petrovic\u2019s competitor\u2019s websites, using similar domain names. Since Petrovic controlled these fake versions of his competitor\u2019s websites, he was able to spy on all traffic to these sites. This included any data entered into forms on those websites. If Petrovic had the motivation, he could have potentially recorded any passwords or credit cards numbers entered into these sites. No matter that these impersonation sites used SSL encryption, because he controlled the sites, and therefore could capture decrypted data.<\/p>\n

\n

Interesting: guy hijacked browser back button to record user interactions on his competitors' sites. Most people didn't notice, since his SSL certs were still valid. As long as there's a green padlock, they didn't check the actual URL they were visiting https:\/\/t.co\/PnZuuhttag<\/a><\/p>\n

\u2014 Mike Payne (@the_mikepayne) August 27, 2018<\/a><\/p><\/blockquote>\n