Cyber criminals are now creating realistic single sign-on phishing login forms using fake Chrome browser windows.

What are single sign-on forms?

These forms are involved in the common practice of using a third party organisation, such as Google, Microsoft, or Apple, to sign in to a website. Many internet users utilise this feature, as it often allows individuals to create an account with the website without having to fill-in extra details that they have already entered into their third-party account.

An example of this can be seen on Dropbox’s website, which allows users to login using Google or Apple credentials:

Choosing to use either Google or Apple credentials then prompts the user with a single sign-on (SSO) browser window, which appears as a separate tab, showing only the login form and an address bar showing the URL of the login form:

As the SSO window still displays a URL, users will still use it to verify that the tab is a legitimate google.com domain. This adds to the authenticity of the form and encourages users to enter their login details.

SSO windows have been a source of phishing in the past, with Cyber Criminals attempting to create fake windows using HTML, CSS, and JavaScript, but these have typically contained flaws, helping users detect the scam.

Browser in the Browser attacks

New “Browser in the Browser (BitB)” attacks use premade templates to create fake but near perfect Chrome popup windows that include custom address URLs and titles that can be used in phishing attacks.

These templates include browser windows for Google Chrome on Windows and Mac, and even include dark and light mode variants.

As shown in the image above, there is practically no difference between the scam browser tab and it’s authentic equivalent, making this a very dangerous and effective phishing attack.

Our Advice

Our Technical Director Phill McManus has analysed this new attack, and offered professional advice on how to avoid being caught by it:

Spotting it “in the field”

“You can just about tell that this browser window isn’t authentic. Have a look at the video below:

“This shows me dragging the window about. You can see clearly that the popup window is contained within the browser instead of sitting on top of it. With normal SSO windows, you would be able to move it outside of the first browser.

Now that you know this, make sure to try it on any SSO windows you have to use in the future, to make sure it’s legitimate”.

Password Managers

“Using a password manager (such as LastPass, Dashlane, etc) will help against this attack. Password managers autofill login details for users, typically with very long and complex passwords for added security. A password manager will be able to recognise that these BitB attacks aren’t real login pages, and won’t automatically fill in your details, giving you a warning that this tab isn’t all it seems to be”.

Multi-Factor-Authentication

“Multi-Factor-Authentication (MFA) will help stop this attack outright. MFA requires two devices to login to an account. A user will have to enter their details on their main device, and then confirm they are trying to login using a second device, such as a phone or a tablet. This is secure as cyber-criminals may gain access to your login details, but it will be much harder for them to physically gain access to your second device as well. By implementing MFA, even if a user enters their details into this fraudulent browser window, hackers still won’t be able to gain access to the account with the user’s second device”.

General Training and Awareness

“Of course conducting cyber security training in your organisation is an effective preventative measure against all kinds of phishing scams, especially if the training is regular and up-to-date. Training will encourage you to treat suspicious emails and login screens with greater scepticism, and reduce the risk of losing your details to cyber criminals”.

TecSec are qualified providers of cyber security services, and are endorsed by seven separate UK police forces. We can provide affordable cyber security training of the kind mentioned in this article to help prevent your staff from falling foul of new and increasingly dangerous scams such as these.

If you would like to organise a conversation with us, please call us at 0114 223 8000 or email us at info@tecsec.co.uk.