Internet Explorer version
The version for Internet Explorer looks more like the previous pages I've seen.
 |
| Fake AV page for Internet Explorer |
The malicious executable InstallInternetDefender_722.exe is detected by only 9.5% of AV!
 |
| Virustotal results for malicious executable |
Firefox version
The version displayed in Firefox browsers is very interesting. It looks like the security warning Firefox shows for malicious and phishing sites.
 |
| Fake AV page for Firefox |
The source code of the pages shows that the page is using internal elements of the browser to construct the page:
- chrome://global/skin/netError.css
- chrome://global/skin/icons/blacklist_favicon.png
 |
| Use of internal Firefox elements |
The warning looks very legitimate.
Chrome version
Like for Firefox, the Chrome version looks like a legitimate browser warning.
Safari version
For Safari, only the first popup box is tailored to the browser. The main page is the same as Internet Explorer.
Fake AV continues to evolve. This new version for Firefox will surely fool more than one user.
-- Julien
Chrome version
Like for Firefox, the Chrome version looks like a legitimate browser warning.
 |
| First warning from the fake AV page |
 |
| Fake AV page fro Chrome |
Safari version
For Safari, only the first popup box is tailored to the browser. The main page is the same as Internet Explorer.
 |
| Fake Av warning for Safari |
Fake AV continues to evolve. This new version for Firefox will surely fool more than one user.
-- Julien
Posts
2 comments:
The Safari one isn't tailored at all - that's Safari's standard JavaScript alert() call box. It's more likely a fall-back to 'unknown browser' - I dare say it behaves the same on other less well-used browsers.
I've thought this for years though, browsers really should make it clear when a modal pop-up dialog box comes from a website - how about dimming the page in question and having the alert() in the middle of the page? Using the same alert window style as the rest of the OS is just asking for trouble. (At least Chrome puts "The page at example.com says" above, but it's still not distinct enough really.)
nice
Post a Comment