Internet con artists can launch phishing attacks through innocent looking pop-up windows

• Browser flaw may leave you vulnerable to phishing attacks.
• Security researchers warned this week of a vulnerability in most Web browsers which could potentially allow scammers to launch phishing attacks from pop-up windows on trusted Web sites.
• The vulnerability arises when an Internet user opens browser windows for both a legitimate Web site and a malicious site at the same time.
• Because of an old functionality that exists in most browsers, the malicious site can potentially display information in a pop-up window from the trusted site, according to Secunia Research.
• While most users do not intentionally visit malicious Web sites, they often stumble upon them by following links, making it relatively common for Net surfers to have browser windows open for both legitimate and malicious sites at the same time, Kristensen says.
• This could be a particularly dangerous situation if exploited to display misleading information on a pop-up window from a legitimate bank Web site, for example, he warned.
• Secunia, based in Copenhagen, went public with its warning Wednesday, after saying that it had alerted browser vendors of the vulnerability months ago.
• Microsoft says Thursday that it has investigated the report, and customers who use Windows XP SP2 and follow its advice on spoofing attacks are at a reduced risk.
• The functionality described in the report allows a Web site to open or re-use a window without displaying the address bar.
• However, SP2 users will see a status bar in the pop-up window, allowing them to look for the yellow lock icon and confirm that the site is valid, Microsoft says.
• Opera has also included measures to mitigate the vulnerability in the latest beta version of its software, Kristensen says.