Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, states:

Second, Safe Browsing helps to protect you against targeted phishing attacks (sometimes called “spear phishing”), where a site may not already be known to Google so isn’t on the list of phishing sites. Chrome does this by analyzing the content on the site and warn you if it seems suspicious.

Does anyone have any more information on the specific type of "content analysis" that Chrome is doing?

Thanks!

share|improve this question
1  
I would assume indicators might include hotlinked images from a legitimate site, along with input forms and perhaps the presence of particular natural language phrases like "your account will be deactivated unless you..." Also, perhaps detecting identical clones of known high-value login pages. That's just a guess of possible approaches -- I'm also very interested in a canonical answer, if one is publicly available. –  apsillers Jun 21 '13 at 16:37

1 Answer 1

I believe this refers to malicious redirects. Let's say that E. Vildoer has been phishing and sending people to evil.example.net. If E. Vildoer then manages to put malicious code on your site, such that your pages are redirecting visitors to evil.example.net, then Chome should trigger on that. It's not the code on your site per se that triggers the block, it's where the code would be sending the visitor.

Of course, I believe Chrome browsers report such incidents back to Google, leading to a scan of your site, leading to you being added to the Safe Browsing blacklist, so it's kind of a short window where you're not on the blacklist but trying to send visitors somewhere that'll get you on the blacklist.

share|improve this answer
    
Does chrome actually detect this behavior? –  Rook Jun 21 '13 at 17:21
    
@Rook, that's my interpretation of Cross-site malware warnings, and consistent with behavior observed on a Wordpress site that got Tom Thumb'ed with links to a malicious site. –  gowenfawr Jun 21 '13 at 21:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.