Share on facebook
Share on twitter
Share on linkedin
Share on whatsapp
xnegra.png

What is Reverse Tabnabbing and Why is it Important to be Aware Of?

Learn how to protect your website users and yourself from bad guys.
Reverse Tabnabbing

Information security is a topic of growing importance in recent times and today is a necessary and essential aspect of our daily lives.

Every day we learn of new attacks on organizations and in the midst of the pandemic they are happening more frequently than ever.
While we know that the weakest link in information security is the end user, we are all responsible for preventing these malicious incidents. That’s why today I want to tell you about a little-known attack that developers can easily prevent: Reverse Tabnabbing.
If you are a developer and you want to add good practices for the development of secure applications this article is for you!

Reverse Tabnabbing: Definition

We are going to answer the question in the title of this article: What is reverse tabnabbing and why is it important to be aware of? 

Reverse tabnabbing is a technique that allows, through links, the redirection to a site from a parent site.
It sounds like a mouthful, but it is very easy to understand: suppose we have Site A, which is a blog or social network, and someone posts a link with a target=”_blank” tag (often this tag is automatically placed in the links in the comments on these types of sites, since in most cases they are links to external sites), and with an href to Site B.
From Site B, Site A could be redirected to a malicious Site C that has, for example, a login box identical to one on Site A.
Reverse Tabnabbing

The malicious site can only access the following properties from the opener Javascript object reference (that is in fact a reference to a window javascript class instance) in cases of cross origin (cross domain) access:

  • Opener.closed: Returns a boolean value indicating whether a window has been closed or not
  • Opener.frames: Returns all iframe elements in the current window
  • Opener.length: Returns the number of iframe elements in the current window
  • Opener.opener: Returns a reference to the window that created the window
  • Opener.parent: Returns the parent window of the current window
  • Opener.self: Returns the current window
  • Opener.top: Returns the topmost browser window

Attack

Although Facebook was at one point susceptible to this misnamed vulnerability, it no longer is, but it will serve us very well as an example here.

This type of attack is possible on those web pages that allow a user to make a persistent publication with a link, which is generally the case on social networks and blogs.
The attacker publishes a link on their wall or in a chat box where several people can see it:
Reverse Tabnabbing
The site site.malicious.com will open in a new tab and display the offer, so the user may not notice anything awry, but at the same time the original Facebook tab is redirected to a fake login box from the social network, using the following code on site B.
Reverse Tabnabbing 2

The website https://phishing.malicious.com (Site C) could be easily created with the SET tool, which is a tool that allows a website to be cloned simply.

It is generally used to clone a login page, which then redirects to the original site showing that the credentials are not valid. The user does not suspect that their credentials have been stolen, simply believing that they have entered their password incorrectly.

Solution

The good news is that it is very easy to correct the Reverse Tabnabbing problem and if you are a developer you can use it as a good practice when creating your links, because it is always beneficial and has no negative impact. Here you can see how we should create links to avoid this type of attack, just by adding the html rel attribute with the following parameters:
Reverse Tabnabbing 3
Although the tag rel=”noopener” should suffice, sometimes Firefox doesn’t support it, so we should also add rel=”noopener noreferrer” to be 100% covered.
If we use javascript to open an external page via windows.open() we must always reset the opener property.
Reverse Tabnabbing 4
Finally it is recommended that you add the HTTP response header Referrer-Policy: no-referrer to every HTTP response sent by the application (Header Referrer-Policy information). This configuration will ensure that no referrer information is sent along with requests from the page.

Bonus

If you are a Firefox browser user, you can protect yourself from this type of attack by modifying its settings.
As a user of this browser I personally recommend doing so, as you can avoid becoming a victim due to a small oversight. Here I explain how:
  • Open a new tab and enter about:config
  • Click on the “Accept the risk and continue” button.
Reverse Tabnabbing
  • Search “dom.targetBlankNoOpener”
Reverse Tabnabbing 5
  • Change the value to true and that’s it! You can now browse with peace of mind.

References

Valen Mantovani

About the Author

Valentino Mantovani, is a Senior Software Programmer and IT security specialist with more than 10 years of experience. A person motivated by the challenge of learning to use new technologies to carry out a project.

Don't forget to share this post!

Share on facebook
Share on google
Share on twitter
Share on linkedin
Share on whatsapp
Share on print

Continue Reading...

SAN DIEGO

6790 Embarcadero Lane Suite 100
Carlsbad, CA 92011, USA
+1 (888) 622-7098

MIAMI

1951 NW 7th Ave #600
Miami, FL
33136, USA
+1 (888) 622-7098

CÓRDOBA

Velez Sarsfield 576
Cordoba, Argentina X5000CCD
+54 (351) 426-5110

LIMA

Jiron Colina 107
Barranco, Lima CP 04, perÚ
+51 (1) 248-8687

MEDELLÍN

Calle 29 #41 – 105
Edificio Soho
El Poblado, Medellin COLOMBIA
+57 (4) 403-1770

©Santex 2019. All rights reserved.