No Identity Theft

What is tabnabbing?

Tabnabbing is considered a specific type of attack where a fake, malicious website will replace a legitimate website already open on a web browser.

The goal is to mimic a legitimate site in order to entice a victim to type in a username, password, or other sensitive information.

How tabnabbing works

The process is, overall, simple. You open a web browser and pull up two or three “tabs” to browse a few websites.

You start out by reading up on the day’s latest news and checking posts on the social media tab you have open.

While you’re on those web sites, a malicious, hidden script targets one of your inactive tabs and replaces it with a fake page that could very well look legitimate.

In fact, if the code is familiar with your browsing activities, it may choose to mimic your bank account page, your email program, or another site you frequently visit.

Without realizing what has happened, you go to the tab and use the fake site to type in a username and password, or perhaps a bank account number.

In the blink of an eye, you’ve just been the victim of tabnabbing, and you may not even realize it.

Cybercriminals may now have a copy of the information you typed into the fake web page, and can use it to steal your money or your identity.

Hackers have learned to use malicious scripts to carry out this switcheroo, allowing a page to be rewritten with a sort of clone after the initial, legitimate page has gone unused for a period of time.

Often, malicious tabs will use a “favicon” – a well-known icon or image associated with legitimate sites – to further convince a victim that the tab they see is one they often use.

According to security experts, plug-ins and other computer add-ons are the largest sources of the tabnabbing attack finding its way onto a computer.

JavaScript, ActiveX, Flash and other scripts can also be a cause of attacks against your browser.

How to avoid tabnabbing attacks

Keep your web browser up to date so it uses the latest security features and has the best chance of avoiding such an attack.

Also, use updated anti-virus software and anti-malware products.

If you use plug-ins, keep them up-to-date; if they aren’t necessary, see if your web browser will allow them to be disabled, or to prompt you before allowing them to run.

Watch for suspicious changes to your tabs and the web addresses that accompany them.

Make it a habit to use one tab at a time, and to never open a series of tabs and then allow them to sit idle.[/vc_column_text][/vc_column][/vc_row]