Dave Naffziger’s Blog

I’ve been following the anti-phishing market recently (there are few good solutions), and was forwarded an article on a new pop-up exploit that enables a malicious site to take advantage of any ‘friendly’ popups on a bank’s website.

Check out this demonstration of the exploit on Citibank’s website:

http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

There will always be either technical (keyloggers, browser expoits, etc) or social engineered solutions to nab people’s login information. You can’t stop phishing by protecting users from themselves, you need to stop it at the bank’s website.