Progressive Web Apps (PWAs) Phishing

[theteapot]

What's the difference between this and just having a button on your website that redirects to a spoof microsoft login page?

[codetrotter]

Because this one makes it look like there’s a url bar with a Microsoft domain

[ffpip]

A PWA can have the familiar "Sign in with google" button now, which pops up a similar page as shown in the article, but with accounts.google.com in the fake URL bar.

[josephcsible]

Being a PWA lets you hide the real URL bar.

[meiraleal]

That's indeed a tricky one. Even tho I work with PWAs I could see myself being misled by this with a github credential. Good remind to only connect third party services with access tokens.

[jeroenhd]

Many applications will obtain such a token through an OAuth flow of some kind.

Using a browser-integrated password manager or passkey will usually prevent this attack, though.

[beardyw]

Surely you could pull this trick just by using full screen mode couldn't you? And all that requires is any user interaction.

[erikerikson]

Does this fool tools like 1Password?

[phartenfeller]

No as the page's URL is still not the real login URL. The shown address bar is just a fake with styled website content if I understood it correctly. Really smart!

[RcouF1uZ4gsC]

I don’t things is much worse than OAuth itself. You just have to make a login with Google/Facebook/X button.

Also the thing about the URL won’t have much practical difference for the user. The reason is that a lot of the flows can redirect through different domains. For example, when I sign in with Google into a third party site, I often see a redirect through the YouTube domain.

So users are not expecting full fidelity to the domain.

[kmf84]

Yes, but I found it a little earlier. ( 4 years ago) https://github.com/0x1235/PWA_Spoofing_PoC

[toddmorey]

What makes this PWA specific rather than just “installable software”?

[arendtio]

PWAs are generally considered safe to install because they are just a website (running in a sandbox) plus some fancy desktop integration. Normal software you install doesn't run in a sandbox and has much more capabilities.

However, as with every phishing attack, the user must ignore small (security related) hints.

[toddmorey]

Ah, I’m thinking Windows maybe requires less permission to install a PWA?

[difosfor]

I think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..

[kristiandupont]

I guess the argument would be that a screened app store would block such a malicious app.

But since the trick requires the user to go to a malicious website to install this app, it seems to me that the user might similarly be tricked into entering credentials on that website.

[dzhiurgis]

This reminds me OAuth screens where you are not sure why your password manager doesn’t work…