13

I'm making a Phishing Filter with Machine Learning and I'm using the features mentioned in this paper http://scialert.net/abstract/?doi=jas.2011.3301.3307

One of the features says "URL contains hexadecimal characters or @ symbol", why is an @ in URL a potencial security risk, and more especific with Phishing?

EDIT: The filter is in the email level, so the URL would be as part of the message

17

The URI scheme is composed like so:

scheme:[//[user:password@]host[:port]][/]path[?query][#fragment]

As you can see, the @ is used to include (in this case, HTTP) authentication directly in the url. The question then becomes "Why would a url that includes authentication be a sign of phishing?".

I don't know the author's reasoning, but the most common argument I've seen is that it's an easy way to confuse the user about what the domain is. For example, http://www.mozilla.org&login3:141592653589793238462643383279‌​502884197169@example‌​.com/evil looks very much like it's loading www.mozilla.org, but if you look close enough it's actually example.com/evil. Tricking the user into trusting a false website is the core of a phishing attack, so this provides a really nice attack opportunity for a phisher.

  • 2
    That example you're giving would resolve to www.google.com as expected. You can't have an unencoded / in the authentication part of the scheme. – Arminius Mar 23 '17 at 7:15
  • so the URL must look like this? https:%2F%2Fwww.google.com%2Fsearch%2Fsomethingverylong:somethingevenlonger@malicioussite.com – Carlos Gomez Mar 23 '17 at 13:04
  • 3
    Firefox shows an alert windows when visiting such a link and documented this feature. They illustrate it with the URL http://www.mozilla.org&login3:141592653589793238462643383279502884197169@example.com/evil which is designed to trick users into thinking they are visiting www.mozilla.org while they are actually on example.com. – WhiteWinterWolf Mar 25 '17 at 14:27
  • @WhiteWinterWolf Thanks, I've updated my answer (SE only allows me to @mention one user at a time). – Xiong Chiamiov Mar 26 '17 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.