13

I'm making a Phishing Filter with Machine Learning and I'm using the features mentioned in this paper http://scialert.net/abstract/?doi=jas.2011.3301.3307

One of the features says "URL contains hexadecimal characters or @ symbol", why is an @ in URL a potencial security risk, and more especific with Phishing?

EDIT: The filter is in the email level, so the URL would be as part of the message

1 Answer 1

17

The URI scheme is composed like so:

scheme:[//[user:password@]host[:port]][/]path[?query][#fragment]

As you can see, the @ is used to include (in this case, HTTP) authentication directly in the url. The question then becomes "Why would a url that includes authentication be a sign of phishing?".

I don't know the author's reasoning, but the most common argument I've seen is that it's an easy way to confuse the user about what the domain is. For example, http://www.mozilla.org&login3:141592653589793238462643383279‌​502884197169@example‌​.com/evil looks very much like it's loading www.mozilla.org, but if you look close enough it's actually example.com/evil. Tricking the user into trusting a false website is the core of a phishing attack, so this provides a really nice attack opportunity for a phisher.

4
  • 2
    That example you're giving would resolve to www.google.com as expected. You can't have an unencoded / in the authentication part of the scheme.
    – Arminius
    Mar 23, 2017 at 7:15
  • so the URL must look like this? https:%2F%2Fwww.google.com%2Fsearch%2Fsomethingverylong:[email protected] Mar 23, 2017 at 13:04
  • 3
    Firefox shows an alert windows when visiting such a link and documented this feature. They illustrate it with the URL http://www.mozilla.org&login3:[email protected]/evil which is designed to trick users into thinking they are visiting www.mozilla.org while they are actually on example.com. Mar 25, 2017 at 14:27
  • @WhiteWinterWolf Thanks, I've updated my answer (SE only allows me to @mention one user at a time). Mar 26, 2017 at 22:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .