Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
The browsers have some capability to detect the phishing pages, but they are not able to detect all. Why is that?
Phishing still remains to be one of the most convenient way to hacking. Why is it not possible for browsers to detect all phishing pages, and not only the obvious ones.
To the best of my knowledge, there are 2 possible way browsers may detect phishing pages: DNS detection and Blacklist/White List detection. In blacklist method, if a page has been reported by several users as a phishing scam, it is saved in the blacklist database. So, when a new user will visit that link, it will show that the site is unsafe. In other way (DNS detection), if the URL of the phishing page resembles with a popular website or brand, the browser will regard it as phishing. To tackle this problem, there are some plugins available from the famous sites, such as Norton, iZooLogic and ScrapeBox and they work in the same way.
So, as you can see, there are some clear limitations to these methods. The hackers keep coming up with new URLs with different names. There has been some developments in theory regarding front-end code as well, but not applied fully. This can also bypassed easily by making a few changes in the code of the phishing page.
So, that’s why it is almost impossible for browsers (for now at least) to completely stop the phishing attacks.
Usually browsers don't actually detect the phishing page but rather use a blacklist of URL's provided by services such as PhishTank or OpenPhish. While some of the websites posted in these lists are provided by programmed detectors, most are reported by users.
The Chrome browser will use Google's large phishing DB compiled from Gmail reporting and other sources to block the visiting of such phishing pages. Google's DB (Google SAfe Browsing DB) is open to use and can be found here.
There is no one really to blame as phishing pages can be very complex and very targeted making it very hard to detect as a human and especially as a programmed detector. Browsers are trying their best to help out by blocking anything that is in the blacklists.
A reason for this is that modern (and old) mostly professional phishing campaigns use images such as the example below, which make it harder to detect it.
Also source-code obfuscation techniques are used to hide theirselves from the radar(such as encoding think like HEX, BASE64 or custom encoding, of certain places and values like urls or meta data).
Then people need to report such situations.
