7

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, states:

Second, Safe Browsing helps to protect you against targeted phishing attacks (sometimes called “spear phishing”), where a site may not already be known to Google so isn’t on the list of phishing sites. Chrome does this by analyzing the content on the site and warn you if it seems suspicious.

Does anyone have any more information on the specific type of "content analysis" that Chrome is doing?

Thanks!

Improve this question
1
  • 1
    I would assume indicators might include hotlinked images from a legitimate site, along with input forms and perhaps the presence of particular natural language phrases like "your account will be deactivated unless you..." Also, perhaps detecting identical clones of known high-value login pages. That's just a guess of possible approaches -- I'm also very interested in a canonical answer, if one is publicly available.
    – apsillers
    Jun 21, 2013 at 16:37

1 Answer 1

Reset to default
2

I believe this refers to malicious redirects. Let's say that E. Vildoer has been phishing and sending people to evil.example.net. If E. Vildoer then manages to put malicious code on your site, such that your pages are redirecting visitors to evil.example.net, then Chome should trigger on that. It's not the code on your site per se that triggers the block, it's where the code would be sending the visitor.

Of course, I believe Chrome browsers report such incidents back to Google, leading to a scan of your site, leading to you being added to the Safe Browsing blacklist, so it's kind of a short window where you're not on the blacklist but trying to send visitors somewhere that'll get you on the blacklist.

Improve this answer
2
  • Does chrome actually detect this behavior?
    – rook
    Jun 21, 2013 at 17:21
  • @Rook, that's my interpretation of Cross-site malware warnings, and consistent with behavior observed on a Wordpress site that got Tom Thumb'ed with links to a malicious site.
    – gowenfawr
    Jun 21, 2013 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .