I got this from my information security instructor...
hopefully everyone can be more aware of these things...
Quote:
Italian Bank's XSS Opportunity Seized by Fraudsters
An extremely convincing phishing attack is using a cross-site scripting vulnerability on an Italian Bank's own website to attempt to steal customers' bank account details. Fraudsters are currently sending phishing mails which use a specially-crafted URL to inject a modified login form onto the bank's login page.
The vulnerable page is served over SSL with a bona fide SSL certificate issued to Banca Fideuram S.p.A. in Italy. Nonetheless, the fraudsters have been able to inject an IFRAME onto the login page which loads a modified login form from a web server hosted in Taiwan.
|
more information and images as follow
News.NetCraft.com
02-27-2008, 08:14 PM
(FW) cross-site scripting vulnerabilities over SSL Warning *Jan, 08/2008*
Linear Mode
