Phish Proof Website. Possible? [closed]

Question

Seeing how big names like Gmail, Yahoo! (despite the login seal) and Hotmail (Live Mail) are prone to phishing attacks, this raises the question of whether it is possible (theoretically) to safeguard a website login form from phishing scams?

Now before we go in answering whether it is possible to (theoretically) phish-proof a website, I understand that we need to establish a few factors.

1. What is the general method used for creating a phish login page? Is it possible to counter this generalized phish-page-creation method? That is, if a programmer is able to defeat the "generalized" phish-creation-method, can he/she expect to make a major change in the security industry?

2. What is the programming and tech understanding of the majority of phish-hackers? If it is not possible to completely phish-proof a website's login system, is it possible to effectively push out 80-90% phish-makers out of the game by making the phish-page-creation a complex and difficult process?

3. What is the theory behind some of the phish-proofing mechanisms in practice today (Yahoo login seal etc)? Are these methods effective? If the methods are practically ineffective, is it possible to improve the efficiency of these methods while sticking to the same theory/idea? Or is it the very approach which is erratic?

I know experts would have varying views on these matters, but I hope I could at least find some points of consensus on these issues.

Answer 1

Probably no.

A phishing attack doesn't rely on using the content of the actual login page, it just relies on the user treating the phishing page as if it were the login page. Even if, as suggested in the comments, you shut your servers down completely, that doesn't mean that your users wouldn't respond to a phishing email pretending to be you.

To elaborate, it doesn't matter how fancy and advanced your underlying security algorithms are. If I can't use your page as it is, I can just (worst case) take a screenshot and drop some forms on it, and this will be good enough for a decent portion of my targets.

If you can't make the page itself phish-proof, you could try to help your users respond better to phishing attempts by training them to recognise your legitimate site and having some part of that site that is unique to them. For example, banks often have a personal image that they show you during the login process. A phishing page is unlikely to be able to accurately reproduce these unique sections, and instead will remove the segment or substitute a generic image. If the user is vigilant, they will notice this and abort before submitting their information.

However, as Adam Shostack comments, there's evidence that training users is unreliable and has a low payoff. Additionally, an advanced phishing page could feed information to the real site and echo back the unique parts as you go along.

Answer 2

No. You cannot make a web site un-phishable.

Phishing is an attack on human understanding, not on your website. Adding images, EV SSL, all these things fail because people don't pay attention to them.

In his book, "Thinking Fast and Slow" Kahneman talks about "WYSIATI" (What You See Is All There Is") as an issue in human perception. It goes way beyond security.

Answer 3

I think for this reason using Extended Validation SSL Certificates is a wise idea. Also with HTTP Strict Transport Security (HSTS) enabled in Browsers, we can provide some security. Refer https://www.chromium.org/hsts. Users if are directed to genuine site with fake SSL certificates, they will be interrupted by the Browser. If it's a fake website, Users should be vigilant enough to check padlock in the address bar. There are some plugins (e.g. CertPatrol, etc.) in Firefox who keep track of visits and certificates and store them locally and alert in case of change.

I found these URL Shorteners a threat which does not give you an idea before they expand into actual URL. Also looking at email-headers can give some lead about the phishing emails.

Recently I have come across some claims about Web Application Firewalls which prevents someone from site-scraping. Educating Users and awareness about phishing is the most effective way however, given the rapidly changing social engineering attack methodology.

Answer 4

Make phishing not useful

The only reasonable way to protect yourself from phishing threats is to assume that a determined attacker will be able to obtain the initial set of credentials from some of your users through phishing, and ensure that this is not enough to provide a worthwhile benefit to the attacker. If you eliminate incentives for attackers, you will not only mitigate your damage in case of a successful attack but also greatly reduce the chance of such attacks as serious attackers will usually choose other targets.

A common example used in banking is a careful use of two factor authentification tokens. If an user gives their credentials and code from the token to a phishing site, then this can be enough to log in once immediately, but not enough to do take over the account afterwards or, for example, approve a transaction - which would require to obtain an additional code from the real user at that time.

Similar functionality can be achieved even with low tech pre-mailed paper sheets with single use challenge-response codes.

In this case a successful attack needs to perform a MITM attack in real time, requesting (and obtaining) the appropriate code from the user at the same time while your system is performing a transaction in real website. This raises the required competence and deters some attackers, and also makes them easier to detect as, unlike in normal phishing, the actual exploiting must be happening while the phishing campaign is running instead of enabling the attacker to gather a large amount of credentials silently.