- Open a website, let's say google.com
- Open a console and type in `window.open("http://xkcd.com")`
- Disable your popup blocker and do it again.
- Open a console in the new xkcd window and type in `window.opener.location = "https://news.ycombinator.com/user?id=Cpoll"`
Note that Google quietly turned into my profile page. Now, imagine that it instead turned into maliciousgoogle.com, which looks just like Google, and you can see the attack vector.
First we had pop-ups that opened on top of the current window
Then we had pop-unders that opened behind the current window
Now we have... what? pop-switches? that open your link target in a new window and change the source page to the "pop(-up)" behind your back.
Impressive idea, I opened both windows on purpose so they couldn't be blocked or else I wouldn't get to my content and one was transmogrified to an ad page behind my back.
- Disable JavaScript.
Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any page to run JS can imply.
I only allow JS for a very small number of sites which I thoroughly trust and require it, and haven't missed it one bit; the fact that it automatically rids a lot of other surprising and annoying things pages can do, besides phishing or exploiting you, is a nice bonus.
I don't even enable JavaScript for google.com, not since they integrated the pile of crap that is/was Google+ which added 10% usage load on my CPUs.
Limiting JS to a few sites won't protect you fully from this attack, though it will obviously limit your exposure.
If one of your trusted sites, A, has been compromised by, say, an XSS attack, with the ability to inject JS then this attack can be leveraged to also compromise your access credentials to site B by redirecting your login attempt on site B to a malicious imitation of site B's login page. (Of course this assumes that you already have B open in a tab somewhere and that you opened site A through a _blank link on site B. Mostly I would think that would be a plausible scenario for sites mostly based on user-generated content such as forums, social media, and such.)
AFAICT always explicitly force-reloading any login page should make you a lot safer, but remembering to always do that is perhaps not realistic.
but my god, how the web got better!
practically no ads. no frills. some sites don't work, but then I just move to one that does or allow js there.
If the attacker can run the javascript you mentioned, they've already run.