Hacker News Reader

Since you're opening a new window from another domain and writing arbitrary HTML into it, I wonder if this vulnerability could be used to bypass cross-domain restrictions...

View on HN

I've written an alternative iOS browser myself, and my guess is this bug is due to the Safari UI misinterpreting the network events that get fired when pages and frames are loaded.

Wrapping UIWebView makes it really hard to distinguish between page loads and iframe loads to figure out which URL is currently displayed. While Safari uses lower-level interfaces, I'd guess this is happening at a higher-level than webkit, so cross-domain restrictions should still be in place.

Nope, it's just a spoofing issue, that doesn't affect (as far as I tested) the actual implementation of Same Origin Policy by Safari. I.e., you cannot get access to my-cool-site.com DOM, if you're leveraging this bug.

But, my-hacker-site.com could, instead of including an iframe to my-banking-site.com, simply do a server-side proxy of your bank and execute a pretty effective phishing attack.

The advice I've seen re:phishing is usually to check the URL. That doesn't help here.

Check the URL is not a solid advice, there are many ways to trick you (e.g. google.com vs goog1e.com). Enter the URL yourself is a better one.

Reply on news.ycombinator.com