Site Jacking.........

[wizkid]

Site Jacking.........

It seems that there is an increased frequency of attacks where bogus links are placed on otherwise legitimate Web sites; these bogus links consequently send users that click on them to malicious pages. These malicious pages are hosted on a different domain and are built to mimic the legitimate site, and they can prompt a user to enter the username and password combination that would have been used on the original site. The username and password details can then be logged with the intention of future fraudulent use. For lack of a better name, I’ve started using the term "site jacking" to refer to this type of attack. This attack has some resemblance to phishing, except that instead of having a malicious link delivered via email, the link is “presented” on a well known (and even reputable) Web site.



There have been reported site jackings on MySpace and eBay. While people are unlikely to store sensitive financial data on social networking sites like MySpace, their username and password for MySpace may be the same as the username and password they use for other sites (for example, their online banking, brokerage account, or eBay Web sites). Additionally, some Web sites pop up warnings when you click on a link that forces you to leave the site, but it has been noted that users often ignore such warnings. In fact, users are often conditioned to ignore these warnings, especially since they are often following a legitimate link!



http://www.symantec.com/enterprise/s...e_jacking.html

[ranjeeth34]

GOOD INFO