3

For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more likely to be a problem for place like Cooking or Music than a community of Security enthusiasts)

At least in StackExchange there is an extra layer of security in that it takes one more click to get to the Google login.

But other services do not have that. These example pages could have been crafted to submit login information to a third party. Then bring up one of Google's better known error pages and re-word it to say that the service is temporarily unavailable, and to please try again in a couple minutes.

A non-techie user is now hacked. Teaching them about these attacks is going to be incomplete.

But what about automatic ways to detect pages like these?

Is there any screen-shot recognition plugin? Or resource recognition? That IT Security logo for example, is a resource. All the resources could be check-summed, and identified to their domain name. I visit this page often, so it is pretty clear that the logo belongs here, and not on any other sites I visit.

This could warn the user of some of the more simply crafted hacks that are still under the radar and not detected & reported yet.

What is there to know on this subject?

Improve this question
2
  • A resource checksumming service would probably be so unscalable as to render it useless.
    – logicalscope
    Dec 23, 2011 at 18:33
  • @logical, Actually I was thinking something local to the browser. It would only keep track of the most frequently used resources per user. Images are already cached, identified to their domain name. All that is needed is a combination of a few counters and one or two timestamps, a checksum, and then a warning when a highly used resource for one domain is identical to the new source. I think one could be designed with only slight overhead. And of course only the most frequented resources need to be accounted for.
    – 700 Software
    Dec 23, 2011 at 19:42

2 Answers 2

Reset to default
1

There is no protection like that. It's even technically impossible (or very hard) to prevent users from trusting the website looks and believing that the site is known when the URL bar clearly states that they are on a totally different site. This is why phishing is so popular and current browser fight phishing through blacklisting phishing domains using e.g. Google Safebrowsing. But, as every service based on a black list, this does not eliminate the problem.

I don't know any 'resource checksumming' service and I doubt any exists. It's much simpler to just look at the address bar when you're logging in. As an website owner you can also use EV SSL certificate to enhance positive feedback, displaying entity name together with the website address.

Improve this answer
4
  • much simpler to just look at the address bar when you're logging in I am aware of that, I was just thinking about the non-technical users, who can't be taught to check the address bar and expected to remember the practice for more than a few weeks.
    – 700 Software
    Dec 23, 2011 at 19:39
  • 1
    -1 EV SSL certificates are a scam created by CA's to make more money. This is not a security measure.
    – rook
    Dec 24, 2011 at 0:10
  • Whatever the intent was for introducing EV certificates they do offer positive feedback on website identity now.
    – Krzysztof Kotowicz
    Dec 24, 2011 at 1:02
  • 1
    EV SSL certificates, with a level of identity verification outside the network, are what normal SSL certificates were originally intended to be. You can get a normal SSL certificate issued to you these days just by having access to its DNS or passive man-in-the-middle against its mail server, so there's certainly a case for a higher standard of verification. (Not that this excuses all the other problems of the SSL/CA infrastructure of course.)
    – bobince
    Dec 24, 2011 at 17:09
0

Netcraft has a cool method of determining alike pages. But is this really a solid security measure? After all you could radically change the code on the page so that such a check would fail, but would look identical. Such as introducing invisible <div> tags, or modifying the page with html after it loads.

Perhaps this approach has a more fundamental flaw in that the phishing page could look totally different but if the attacker used a homograph attack they would be widely successful. Really is the look of the page the most important part of the attack?

I think that Google Safebrowsing is a great idea, and I think its the best solution we have for the time being.

Improve this answer
2
  • It can be worked around. But it may help make the phisher's job harder.
    – 700 Software
    Dec 23, 2011 at 22:35
  • 1
    @George Bailey Yeah, and a candy bar in a wrapper is harder to eat.
    – rook
    Dec 24, 2011 at 0:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .