Picture-in-Picture Phishing Attacks and Operating System Styles

Phishing attacks are often targeted at organisations where login credentials can be used to gain financial reward, and these web sites almost always use SSL to allow users to authenticate the identity of the site and to protect data in transit from alteration or copying.

A recent paper Crying Wolf: An Empirical Study of SSL Warning Effectiveness from Carnegie Mellon University discussed the results of a survey of over 400 internet uses. The conclusion - users ignore warnings about invalid SSL certificates.

The subject of trust user experience (TUX) was discussed during the Workshop on Security and Human Behaviour (SHB 2009) at Cambridge University this summer, and summarised here. This included a discussion on how users, who are trained to be sensitive to warnings, become more susceptible to picture-in-picture attacks. These are where an image of a (fake) browser, perhaps with a graphical representation of a green extended validation address bar is displayed inside the user's real browser window, such as in the example mock-up below. This is most effective when the real browser is displayed at the full screen resolution.

Therefore I was interested to read about how web designers can use CSS to access operating system style settings (the "chrome" of Linux, Windows, Mac, etc) and use these to apply matching fonts and colours to web design elements. This means if users have a customised desktop colour scheme, the fake browser in the picture-in-picture attack doesn't need to be in standard desktop colours, but could pick up on the user's own settings, to confuse them further.

See also my comments about Colour Overload with IE8 Tab Grouping.