2

Suppose $S$ is a set of known websites which are very important. Assume there is an anti-phishing tool company $A$ which is aware of such websites. Can the company A reliably develop an anti-phishing tool just to distinguish the websites of set $S$ from its complement $S'$? In other words is it possible for the anti-phishing tool to notify its users if the currently visited website is from set $S$ or set $S'$?

I think this problem is relatively easy as the anti-phishing tool has to distinguish between set $S$ of known websites from the complement set $S'$. Or can such anti-phishing tool can be fooled?

Another related question: Assume that the number of websites over the internet remains same over the time (static) and anti-phishing tool company A knows the set of legitimate websites $S$ and illegitimate websites $S'$. Is it possible to prevent phishing by distinguishing the set $S$ from the set $S'$, for example by blacklisting the sites in $S'$ or by allowing connection only to sites in $S$?

  • https + digital certs? – curious_cat Jun 10 '15 at 7:31
  • is it not possible that the phishing site is also using the https connection? – Curious Jun 10 '15 at 8:16
  • another option seems a regex like tool parsing the web address itself. i.e. gooogle.com instead of google.com. – curious_cat Jun 10 '15 at 12:02
2

A common phishing website looks extremely similar to the website it is trying to impersonate, but is still a different website.

One could develop a tool which examines any websites the user visits and alerts them when they look exactly identical to one of the websites is set $S$.

Unfortunately there is a problem with this: A phishing website only needs to be almost identical. Comparing data for exact equality is trivial for computer programs, but detecting almost equality is a far more difficult problem. The tool would require a complex heuristic algorithm to rate the similarity of two website. Such algorithms could be gamed: It would be easy for the phisher make subtle changes which are invisible to the user but causes the program to mistake it for an unrelated website.

There is, however, also the opposite approach which is far easier: Notify the user when the website they visit is legitimate and do nothing on illegitimate websites. This is already built into most modern web browsers in form of certificate notification icons in the navigation bar. This mechanism requires https to be used, so it won't work when you regularly use the http version of said websites. Training users to only enter login credentials when they see the green lock-icon with the name of the website in the address bar (extended certificate) is very reasonable.

The browser plugin HTTPS Everywhere by the Electronic Frontier Foundation automatically redirects the user to the https version of many popular websites. It is highly recommendable for security-conscious internet users (and even more recommendable for those who are not).

  • is it not possible that the phishing site is also using https connection? – Curious Jun 10 '15 at 8:15
  • so instead of blacklisting every website in the complement set $S'$, one can notify users if the website being visited is in $S$. Does this approach prevent the phishing attack on any website in the set $S$? – Curious Jun 10 '15 at 8:28
  • @curious A phishing attack is a social engineering attack. There is never a 100% reliable software solution which prevents humans from being stupid. But when the user is properly trained to only enter their login credentials when they have the notification that the website is genuine, it should work. – Philipp Jun 10 '15 at 9:03
  • yes of course, my question assumed that human doesn't provide valid credentials to the suspected website upon the warning by anti-phishing tool. – Curious Jun 10 '15 at 9:10
  • @Curious A phishing website can of course get a TLS certificate, but it won't get an extended validation certificate with the company name of the website they are trying to impersonate. When the websites you want to protect can not afford EV certificates, certificate pinning is another option. – Philipp Jun 10 '15 at 9:18
0

As mentioned by curious_cat in the comments, https connections should help as the identity of the website is then validated.

There are several client side tools that attempt to identify the content of the website by using a browser plugin: Phishtank, Web of Trust, Avast!

Popular web browsers also come with some sort of mechanism to try to identify phishing websites, however they are unreliable and considered a best-effort approach.

Alternatively, if this is a custom browser or a special set up, you may be interested in an api approach like isitphishing.org or cryptophoto.com

0

I'm not sure the answer to your actual question - for example whether it is possible for a tool to distinguish between www.google.com and www.gooogle.com and alert the user of a phishing attempt.

The best protection would be a browser based password manager.

This will only offer login credentials for matching sites. So if the user goes to www.google.com their Google credentials are offered by the plugin for completion of the login form.

If the user goes to www.gooogle.com the credentials will not be offered as the domain does not match.

  • yes, if gooogle.com is not in set $S'$, anti-phishing tool can also warn user about the potential phishing website – Curious Jun 10 '15 at 10:59
0

I use a tool from a vendor that does exactly this. It's basically a set of regex applied the the text of the domain name to permutate over variations.

Can it be fooled? Of course. If you only use string manipulation, then one can figure out the manipulation patterns and devise domain names that meet the attack criteria.

The trouble for the phishers here is to create a domain name with high enough similarity to the target domain such that enough users will be fooled, while the domain name is different enough from the string analysis techniques of the defences. Any technical defences will never be 100% effective because the technology (or designer) needs to be able to predict the psychological weakness of the users. Technology problems are easy to solve with technology. Psychology problems are difficult to solve with technology.

For instance, the tool I use does not inspect the path in the URL. So, an URL of the type log.in.co/m/kjfbkbwbfekjb/example.com would not be detected as a potential spoof of example.com, while it might be interpreted as a login page by an unwary user. This is a weakness of the tool, but not necessarily a failing of the tool. Imagine valid services that reference your domain by using the domain name in the URL (email management services, survey sites, etc. can do this). By blocking the domain in the path, then you prevent these valid services from functioning.

As always, there's the balance of usability vs. security and sometimes that balance is unique for each person/organization. Add to that the technology/psychology interplay I mention above and you find that, yes, it is possible to effectively protect against the attacks you mention, but there might be an unacceptable cost in usability.

  • Tool can notify user if the site being visited is legitimate, by flashing some noticeable message or animation. And if the site is illegitimate, the absence of notification by tool should concern the user. Will this technique work perfectly? – Curious Jun 11 '15 at 3:46
  • The tool redirects users to a landing page. As I say, it is not (and cannot be) perfect. – schroeder Jun 11 '15 at 3:49
  • Suppose the legitimate site is paypal.com and illegitimate site is login.co/paypal.com. If user visits paypal.com the antiphishing tool can display some noticeable messages. But if user visits login.co/paypal.com, the tool will not display anything and the absence of any such activity should concern the user. Will it not? – Curious Jun 11 '15 at 3:53
  • That's one way of doing it, but that's not how my tool does it. – schroeder Jun 11 '15 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.