Is there any way to detect Phishing and Deceptive page ( social engineering )

Question

I'm programmer and I have a website that allows users to upload their HTML websites to it.

The user will zip up a folder and then will upload it to my website where it will show up as sub-domain.

I don't allow PHP files or some other extension (only HTML and some stuff)

The problem I have now is that there are some bad users who are trying to upload some HTML file with social engineering contents (Facebook login , PayPal, etc)

Now Google is sending me notifications about these harmful links and asks me to find a solution and remove this content.

As a programmer the only solution that i have is checking the file by myself manually and it's so hard to do that.

Anyone have a solution for this problem? I found some free hosting that detects some social engineering contents immediately, so some workable solution must exist.

Answer 1

As long as you

• allow javascript
• or allow forms
• or allow storage

then you are providing an exploitable asset for phishers.

As for detecting such sites...there are various approaches you can apply to catch the low hanging fruit such as word checking and bayesian filtering. You should also be monitoring your hids to see when new content appears.

But if it were me, I would also inject a (smallish) floating banner with something like "hosted by badr" into the html pages.

Answer 2

Assuming you have the ability to run scripts on the server, I would do a number of things.

Firstly make sure you have an agreement with any users to alter and/or delete their content for the purposes of security. You do that through terms and conditions of use and/or a standard contract. Also make sure that you have rock-solid disclaimers about content - it is strongly advised to get some legal advice. In some countries, you will need to register your site so you aren't liable for the content - e.g. USA.

Then set up an approval process for any uploaded content. As you are unlikely to want to do that by hand, amend whatever upload script you are using to make some checks on the unpacked HTML.

• Unless you really want to allow it, remove or at least restrict what JavaScript can be embedded in the HTML.

• If you can, only allow simplified HTML, for example:

  • No script tags
  • No embed tags
  • No IFrames
  • No data: urls
  • Limit the amount of obfuscation allowed (where code is replaced by HTML entities to hide what it is doing)

• Finally, create a function that auto-reviews any URL's (href, src attibutes) and filters out any like the ones you mention (PayPal, etc.)

That is just an example list, you may well want to adjust to your own requirements.

Answer 3

So you are acting as a hosting service for plain HTML sites with enabled scripting. You should have 2 different défense lines here.

As explained by Julian, first is a legal point: you must include in the usage terms clauses explaining that you reserve a right to immediately remove a hosted site if it does not respect your fair use terms. You could find examples for those in many ISP contracts. And still on a legal point of view and dependant on your country, you should make clear for the authorities that you are not responsable for hosted content. Maybe consult a lawyer here.

The second point is technic. There is no way to automatically detect a bad site in a 100% reliable way. You can only setup a bayesian filter that will research patterns that you find in bad sites. You should then manually review those that are above a certain threshold.

But beware, you must be able to be pretty quick to process a request from Google or from local authorities to stop a bad site. Failure to do so could lead to a global unreferencing of all your sites by Google, and possible legal actions against you - last part being highly dependant on your country...