Researcher: Wii and iPhone browsers could allow phishing

In a paper (PDF) presented at the Usability, Psyschology, and Security Conference 2008 in San Francisco, researchers from the University of California at Davis warned that browsers within popular electronic gadgets often eliminate important security features available on desktop browsers.

Researchers Yuan Niu, Francis Hsu, and Hao Chen looked at the Mobile Safari browser in Apple iPhone, as well as the Opera browser included in the Nintendo Wii and DS gaming systems. In general, they cited the reliance on screen typing as a deterrent to typing in known URLs. They said users are more likely to click on URLs presented in an e-mail.

They also said reduced screen sizes tend to force the address bar off the screen. On the Nintendo DS, only the first 22 characters display. They gave an example of a page called www.bankofamerica.com.phishydomain.com, which would be truncated to simply www.bankofamerica.com.

On the iPhone, the researchers said a simple ScrollTo() JavaScript could knock the address bar off the Safari screen. In the paper, they gave an example in which JavaScript directs the page to load somewhere in the middle, forcing the address bar off the top of the page.

Even when the address bar is visible, the researchers were able to use JavaScript to overwrite the bogus address with a more legitimate address. The overwrite trick could also lead the user into thinking a site was Secure Sockets Layer (SSL)-protected when it was not.

On the Nintendo Wii, the researchers found that the URL bar disappears when the page is loaded.

The researchers state that porting the traditional browser to a mobile device requires some foresight, and they suggest that even built-in features within browsers are ignored by users. They suggest instead that vendors use a proxy to filter out phishing before routing the pages to the devices.

[krosavcheg]

Stupid

That's a stupid point to make, and it just goes to show how the
most popular things always attract the most unfair criticism. It's
like people who are calling for banning Harry Potter books for no
other reason than because they're popular. Who the hell is going to
go shopping online on their Wii? It can't even get e-mail, how do
they expect people to click fraudulent links from it. This is just an
attention-seeking "OMG THE WII AND IPHONE ARE HACKER
MAGNETS!!!1" shout into the wilderness.

[aka_tripleB]

If you use a web client

You can get e-mail. But seriously, who is going to use their Wii as their first choice to shop or manage their bank account? It's more of a way to let kids watch online video without hogging the computer. I can, however, see mobile phones being a problem. Banks are increasingly using mobile alerts to notify customers of different things. It wouldn't be to hard to fool someone if you can manage to spoof an alert.

[Brad S. S.]

Blame the fish, not the line.

ANY browser can allow phishing... it's just a question of whether the user is stupid enough to believe the phisher. Besides, it really sounds like you're blaming the screens for not being big enough.