Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft

Phishing and Countermeasures......Page 5
CONTENTS......Page 9
Preface......Page 21
Acknowledgements......Page 26
1.1 What is Phishing?......Page 31
1.2 A Brief History of Phishing......Page 32
1.3 The Costs to Society of Phishing......Page 34
1.4 A Typical Phishing Attack......Page 35
1.4.1 Phishing Example: America’s Credit Unions......Page 36
1.4.2 Phishing Example: PayPal......Page 40
1.4.3 Making the Lure Convincing......Page 42
1.4.4 Setting The Hook......Page 48
1.4.5 Making the Hook Convincing......Page 50
1.4.6 The Catch......Page 52
1.5 Evolution of Phishing......Page 53
1.6 Case Study: Phishing on Froogle......Page 54
1.7 Protecting Users from Phishing......Page 58
References......Page 59
2 Phishing Attacks: Information Flow and Chokepoints......Page 61
2.1.1 Deceptive Phishing......Page 62
2.1.2 Malware-Based Phishing......Page 64
2.1.3 DNS-Based Phishing (“Pharming”)......Page 65
2.1.5 Man-in-the-Middle Phishing......Page 66
2.2 Technology, Chokepoints, and Countermeasures......Page 67
2.2.1 Step 0: Preventing a Phishing Attack Before It Begins......Page 68
2.2.2 Step 1 : Preventing Delivery of Phishing Payload......Page 70
2.2.3 Step 2: Preventing or Disrupting a User Action......Page 73
2.2.4 Steps 2 and 4: Prevent Navigation and Data Compromise......Page 79
2.2.5 Step 3: Preventing Transmission of the Prompt......Page 80
2.2.6 Step 4: Preventing Transmission of Confidential Information......Page 82
2.2.7 Steps 4 and 6: Preventing Data Entry and Rendering It Useless......Page 85
2.2.8 Step 5: Tracing Transmission of Compromised Credentials......Page 87
2.2.9 Step 6: Interfering with the Use of Compromised Information......Page 88
References......Page 92
3.1 Email Spoofing......Page 95
3.1.1 Filtering......Page 98
3.1.2 Whitelisting and Greylisting......Page 100
3.1.3 Anti-spam Proposals......Page 101
3.1.4 User Education......Page 103
3.2 IP Spoofing......Page 104
3.2.1 IP Traceback......Page 105
3.2.2 IP Spoofing Prevention......Page 108
3.2.3 Intradomain Spoofing......Page 110
3.3.1 Homograph Attacks......Page 111
3.3.2 Similar Unicode String Generation......Page 112
3.3.3 Methodology of Homograph Attack Detection......Page 113
3.4 Simulated Browser Attack......Page 119
3.4.1 Using the Illusion......Page 123
3.4.2 Web Spoofing......Page 124
3.4.3 SSL and Web Spoofing......Page 126
3.4.4 Ensnaring the User......Page 128
3.4.5 SpoofGuard Versus the Simulated Browser Attack......Page 129
3.5 Case Study: Warning the User About Active Web Spoofing......Page 131
References......Page 132
4.1 Malware......Page 135
4.1.1 Viruses and Worms......Page 136
4.1.4 Browser Hijackers......Page 145
4.1.7 Rootkits......Page 146
4.2.1 Defense Against Worms and Viruses......Page 148
4.2.3 Defense Against Rootkits......Page 151
4.3 Pharming......Page 152
4.3.1 Overview of DNS......Page 153
4.3.2 Role of DNS in Pharming......Page 154
4.3.3 Defense Against Pharming......Page 155
4.4 Case Study: Pharming with Appliances......Page 156
4.4.1 A Different Phishing Strategy......Page 157
4.4.2 The Spoof: A Home Pharming Appliance......Page 158
4.4.3 Sustainability of Distribution in the Online Marketplace......Page 161
4.4.4 Countermeasures......Page 162
4.5 Case Study: Race-Pharming......Page 163
4.5.1 Technical Description......Page 164
4.5.2 Detection and Countermeasures......Page 165
4.5.3 Contrast with DNS Pharming......Page 166
References......Page 167
5.1 An Overview of Anti-Spam Techniques......Page 169
5.2 Public Key Cryptography and its Infrastructure......Page 174
5.2.1 Public Key Encryption......Page 175
5.2.2 Digital Signatures......Page 176
5.2.3 Certificates & Certificate Authorities......Page 177
5.2.4 Certificates......Page 179
5.3 SSL Without a PKI......Page 181
5.3.2 The Handshaking Protocol......Page 182
5.3.3 SSL in the Browser......Page 185
5.4 Honeypots......Page 189
5.4.1 Advantages and Disadvantages......Page 191
5.4.2 Technical Details......Page 192
5.4.3 Honeypots and the Security Process......Page 196
5.4.4 Email Honeypots......Page 198
5.4.5 Phishing Tools and Tactics......Page 200
References......Page 202
6.1 Overview of Context Aware Phishing......Page 205
6.2 Modeling Phishing Attacks......Page 207
6.2.1 Stages of Context Aware Attacks......Page 212
6.2.2 Identity Linking......Page 215
6.2.3 Analyzing the General Case......Page 217
6.2.5 Defenses Against Our Example Attacks......Page 220
6.3 Case Study: Automated Trawling for Public Private Data......Page 221
6.3.2 Availability of Vital Information......Page 223
6.3.3 Heuristics for MMN Discovery......Page 224
6.3.5 Assessing the Damage......Page 226
6.3.6 Time and Space Heuristics......Page 228
6.3.8 Other Ways to Derive Mother’s Maiden Names......Page 229
6.4 Case Study: Using Your Social Network Against You......Page 232
6.4.2 Design Considerations......Page 233
6.4.3 Data Mining......Page 234
6.4.4 Performing the Attack......Page 236
6.4.5 Results......Page 237
6.4.6 Reactions Expressed in Experiment Blog......Page 238
6.5.1 Who Cares Where I’ve Been’?......Page 240
6.5.2 Mining Your History......Page 241
6.5.3 CSS to Mine History......Page 246
6.5.6 Protecting Against Browser Recon Attacks......Page 248
6.6 Case Study: Using the Autofill Feature in Phishing......Page 249
6.7 Case Study: Acoustic Keyboard Emanations......Page 251
6.7.2 Description of Attack......Page 253
6.7.3 Technical Details......Page 256
6.7.4 Experiments......Page 261
References......Page 267
7.1.1 Human Behavior......Page 271
7.1.2 Browser and Security Protocol Issues in the Human Context......Page 273
7.1.3 Overview of the HCI and Security Literature......Page 276
7.2 Understanding and Designing for Users......Page 277
7.2.1 Understanding Users and Security......Page 278
7.2.2 Designing Usable Secure Systems......Page 285
7.3.1 How Does Learning Occur?......Page 290
7.3.2 The Lessons......Page 291
7.3.3 Learning to Be Phished......Page 299
7.3.4 Solution Framework......Page 301
References......Page 303
8.1.1 Cleartext Passwords......Page 307
8.1.3 Hashed Passwords......Page 308
8.1.4 Brute Force Attacks......Page 310
8.1.6 Time-Memory Tradeoffs......Page 311
8.1.7 Salted Passwords......Page 313
8.1.8 Eavesdropping......Page 314
8.1.10 Alternatives to Passwords......Page 315
8.2.2 Recent Changes and New Challenges......Page 316
8.3 Security Questions as Password Reset Mechanisms......Page 320
8.3.1 Knowledge-Based Authentication......Page 321
8.3.2 Security Properties of Life Questions......Page 322
8.3.3 Protocols Using Life Questions......Page 326
8.3.4 Example Systems......Page 328
8.4 One-Time Password Tokens......Page 331
8.4.2 Advanced Concepts......Page 336
References......Page 338
9.1 The Need for Reliable Mutual Authentication......Page 339
9.1.1 Distinctions Between the Physical and Virtual World......Page 340
9.1.2 The State of Current Mutual Authentication......Page 341
9.2.1  A Comparison Between PAKE and SSL......Page 342
9.2.2 An Example PAKE Protocol: SPEKE......Page 343
9.2.3 Other PAKE Protocols and Some Augmented Variations......Page 346
9.2.4 Doppelganger Attacks on PAKE......Page 347
9.3 Delayed Password Disclosure......Page 348
9.3.1 DPD Security Guarantees......Page 350
9.3.2 A DPD Protocol......Page 353
9.4 Trusted Path: How To Find Trust in an Unscrupulous World......Page 357
9.4.1 Trust on the World Wide Web......Page 358
9.4.2 Trust Model: Extended Conventional Model......Page 359
9.4.4 Trust Model: Untrusted Local Computer......Page 363
9.4.5 Trust Model: Untrusted Recipient......Page 365
9.4.6 Usability Considerations......Page 368
9.5 Dynamic Security Skins......Page 369
9.5.2 Why Phishing Works......Page 370
9.5.3 Dynamic Security Skins......Page 371
9.5.4 User Interaction......Page 379
9.5.5 Security Analysis......Page 380
9.6 Browser Enhancements for Preventing Phishing......Page 381
9.6.1 Goals for Anti-Phishing Techniques......Page 383
9.6.2 Google Safe Browsing......Page 384
9.6.3 Phoolproof Phishing Prevention......Page 388
9.6.4 Final Design of the Two-Factor Authentication System......Page 390
References......Page 394
10.1 Biometrics......Page 399
10.1.1 Fundamentals of Biometric Authentication......Page 401
10.1.2 Biometrics and Cryptography......Page 407
10.1.3 Biometrics and Phishing......Page 412
10.1.4 Phishing Biometric Characteristics......Page 414
10.2 Hardware Tokens for Authentication and Authorization......Page 415
10.3 Trusted Computing Platforms and Secure Operating Systems......Page 417
10.3.1 Protecting Against Information Harvesting......Page 422
10.3.2 Protecting Against Information Snooping......Page 428
10.3.3 Protecting Against Redirection......Page 435
10.4 Secure Dongles and PDAs......Page 437
10.4.1 The Promise and Problems of PKI......Page 438
10.4.2 Smart Cards and USB Dongles to Mitigate Risk......Page 439
10.4.3 PorKI Design and Use......Page 443
10.4.4 PorKI Evaluation......Page 446
10.4.5 New Applications and Directions......Page 449
10.5 Cookies for Authentication......Page 450
10.5.2 Cache-Cookie Memory......Page 453
10.5.3 C-Memory......Page 454
10.5.5 Schemes for User Identification and Authentication......Page 455
10.5.6 Identifier Trees......Page 457
10.5.7 Rolling-Pseudonym Scheme......Page 459
10.5.8 Denial-of-Service Attacks......Page 460
10.5.9 Secret Cache Cookies......Page 461
10.5.10 Audit Mechanisms......Page 462
10.5.11 Proprietary Identifier-Trees......Page 463
10.5.12 Implementation......Page 464
10.6 Lightweight Email Signatures......Page 465
10.6.1 Cryptographic and System Preliminaries......Page 468
10.6.2 Lightweight Email Signatures......Page 469
10.6.3 Technology Adoption......Page 474
10.6.4 Vulnerabilities......Page 477
10.6.5 Experimental Results......Page 479
References......Page 483
11.1 Detection and Takedown......Page 491
11.1.1 Avoiding Distributed Phishing Attacks—Overview......Page 494
11.1.3 Classification of Phishing Emails......Page 495
References......Page 497
12.1 Client-Side Protection of Browser State......Page 499
12.1.1 Same-Origin Principle......Page 500
12.1.2 Protecting Cache......Page 503
12.1.3 Protecting Visited Links......Page 504
12.2 Server-Side Protection of Browser State......Page 506
12.2.1 Goals......Page 508
12.2.2 A Server-Side Solution......Page 510
12.2.3 Pseudonyms......Page 511
12.2.4 Translation Policies......Page 515
12.2.6 Security Argument......Page 516
12.2.8 Pseudonyms and Translation......Page 517
12.2.9 General Considerations......Page 520
References......Page 521
13.1 Browser-Based Anti-Phishing Tools......Page 523
13.1.1 Information-Oriented Tools......Page 524
13.1.2 Database-Oriented Tools......Page 531
13.1.3 Domain-Oriented Tools......Page 537
13.2.1 Study Design......Page 544
13.2.2 Results and Discussion......Page 547
References......Page 551
14 Social Networks......Page 553
14.1 The Role of Trust Online......Page 554
14.2.1 Reputation Systems and Social Networks......Page 557
14.2.2 Third-Party Certifications......Page 562
14.2.3 First-Party Assertions......Page 564
14.3 Case Study: “Net Trust”......Page 565
14.3.1 Identity......Page 568
14.3.2 The Buddy List......Page 569
14.3.4 The Rating System......Page 572
14.3.5 The Reputation System......Page 573
14.3.7 Usability Study Results......Page 576
14.4 The Risk of Social Networks......Page 578
References......Page 579
15 Microsoft’s Anti-Phishing Technologies and Tactics......Page 581
15.1 Cutting the Bait: Smartscreen Detection of Email Spam and Scams......Page 582
15.2 Cutting the Hook: Dynamic Protection Within the Web Browser......Page 586
15.3 Prescriptive Guidance and Education for Users......Page 590
15.4 Ongoing Collaboration, Education, and Innovation......Page 591
References......Page 592
16 Using S/MIME......Page 593
16.1 Secure Electronic Mail: A Brief History......Page 594
16.1.1 The Key Certification Problem......Page 595
16.1.2 Sending Secure Email: Usability Concerns......Page 597
16.1.3 The Need to Redirect Focus......Page 598
16.2. 1 Survey Methodology......Page 599
16.2.2 Awareness of Cryptographic Capabilities......Page 600
16.2.3 Segmenting the Respondents......Page 603
16.3 Signatures Without Sealing......Page 604
16.3.1 Evaluating the Usability Impact of S/MIME-Signed Messages......Page 606
16.3.2 Problems from the Field......Page 612
16.4 Conclusions and Recommendations......Page 616
16.4.1 Promote Incremental Deployment......Page 617
16.4.2 Extending Security from the Walled Garden......Page 618
16.4.3 S/MIME for Webmail......Page 619
References......Page 620
17.1 Behavioral Studies......Page 625
17.1.1 Targets of Behavioral Studies......Page 626
17.1.2 Techniques of Behavioral Studies for Security......Page 627
17.1.3 Strategic and Tactical Studies......Page 629
17.2 Case Study: Attacking eBay Users with Queries......Page 630
17.2.1 User-to-User Phishing on eBay......Page 632
17.2.2 eBay Phishing Scenarios......Page 638
17.2.3 Experiment Design......Page 639
17.2.4 Methodology......Page 645
17.3.1 Trusting Applets......Page 648
17.3.2 Exploiting Applets’ Abilities......Page 649
17.3.3 Understanding the Potential Impact......Page 651
17.4 Case Study: Ethically Studying Man in the Middle......Page 652
17.4.1 Man-in-the-Middle and Phishing......Page 653
17.4.2 Experiment: Design Goals and Theme......Page 658
17.4.3 Experiment: Man-in-the-Middle Technique Implementation......Page 659
17.4.4 Experiment: Participant Preparation......Page 662
17.4.5 Experiment: Phishing Delivery Method......Page 664
17.4.7 Preliminary Findings......Page 665
17.5 Legal Considerations in Phishing Research......Page 670
17.5.1 Specific Federal and State Laws......Page 671
17.5.2 Contract Law: Business Terms of Use......Page 681
17.5.3 Potential Tort Liability......Page 682
17.5.4 The Scope of Risk......Page 684
17.6 Case Study: Designing and Conducting Phishing Experiments......Page 685
17.6.1 Ethics and Regulation......Page 687
17.6.2 Phishing Experiments - Three Case Studies......Page 691
17.6.3 Making It Look Like Phishing......Page 695
17.6.4 Subject Reactions......Page 696
17.6.5 The Issue of Timeliness......Page 697
References......Page 698
18.1.1 Anti-SPAM......Page 701
18.1.3 Copyright......Page 704
18.2.1 Fraudulent Access......Page 705
18.2.2 Identity Theft......Page 706
18.2.4 Pretexting......Page 707
18.2.6 Phishing-Specific Legislation......Page 708
18.3.1 Fraud......Page 710
18.3.2 Identity Theft......Page 711
18.3.4 Trespass to Chattels......Page 712
References......Page 715
19 The Future......Page 717
References......Page 724
Index......Page 725
About the Editors......Page 730