Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm making a Phishing Filter with Machine Learning and I'm using the features mentioned in this paper http://scialert.net/abstract/?doi=jas.2011.3301.3307
One of the features says "URL contains hexadecimal characters or @ symbol", why is an @ in URL a potencial security risk, and more especific with Phishing?
EDIT: The filter is in the email level, so the URL would be as part of the message
The URI scheme is composed like so:
scheme:[//[user:password@]host[:port]][/]path[?query][#fragment]
As you can see, the @ is used to include (in this case, HTTP) authentication directly in the url. The question then becomes "Why would a url that includes authentication be a sign of phishing?".
I don't know the author's reasoning, but the most common argument I've seen is that it's an easy way to confuse the user about what the domain is. For example, http://www.mozilla.org&login3:141592653589793238462643383279502884197169@example.com/evil looks very much like it's loading www.mozilla.org, but if you look close enough it's actually example.com/evil. Tricking the user into trusting a false website is the core of a phishing attack, so this provides a really nice attack opportunity for a phisher.
www.google.com as expected. You can't have an unencoded / in the authentication part of the scheme.
http://www.mozilla.org&login3:141592653589793238462643383279502884197169@example.com/evil which is designed to trick users into thinking they are visiting www.mozilla.org while they are actually on example.com.
Mar 25, 2017 at 14:27
@mention one user at a time).
Mar 26, 2017 at 22:28