Dealing with Phishing

Apu writes "SecurityFocus has published an interesting interview with Rachna Dhamija, co-author of the paper 'Why Phishing Works' and creator of Dynamic Security Skins (a plugin for Mozilla). She presented some very interesting results from her research efforts, for example 'simply showing a user's history information ("you've been to this website many times" or "you've never submitted this form before") can significantly increase a user's ability to detect a spoofed website and reduce their vulnerability to phishing attacks.' She also suggested to 'make it easy for users to personalize their interfaces. Look at how popular screensavers, ringtones, and application skins are — users clearly enjoy the ability to personalize their interfaces. We can take advantage of this fact to build spoof resistant interfaces.'"

Comments

Re:PDF, Not Plugin Link

[aymanh]

This is why I use the TargetAlert Firefox extension, it adds icons next to links indicating the files or effects they lead to.

Re:PDF, Not Plugin Link

[aymanh]

By the way, I've just noticed that the version available at Mozilla Add-Ons isn't compatible with Firefox 1.5, however, the one available at the author's homepage is, sorry for that.

Here's what she meant

[Moraelin]

Lots of people here seem to assume that somehow the skins are for the web site, or overriding CSS elements, or whatever, which is just not the case. What she was talking about with those skins is: fake UI. Nothing more, nothing less.

E.g., let's say that you got your old mom to use Mozilla, so she has _both_ the coloured URL box _and_ the padlock on the status bar as indication that she's indeed at a secure site. I'll assume you've also educated her to carefully read the URL up there.

So noone can fool her now, right? I mean, right? Well, wrong. One attack method they used in that study was fake UI.

So let's say your mom now lands at some www.phishers-r-us.ru site pretending to be her bank. The site doesn't even use SSL or anything. How can that site spoof all those checks both up there in the browser's toolbar and down there on the status bar? Simple. Fake them.

So the site gives you a javascripted popup, requesting a window without those interface elements. But fakes them as .gif images in the page itself. The page is, say, a frame set with three horizontal frames: one at the top, with a faked toolbar and URL bar (with the correct URL of the bank in that .gif, and correctly colour coded as if it were Mozilla saying it's HTTPS), the login page in the middle, and a faked status bar at the bottom (complete with the padlock icon telling you it's secure.)

_That_ is the problem. Fake UI fools most users.

So the researcher's idea is basically, "I know, so let's encourage each user to skin their own UI." So let's say your mom has set her Mozilla UI to be brushed blue-hued metal, the colour for HTTPS URLs to be green, and the padlock icon to be replaced by a thumbs up icon. The fake UI site can't know that. So when they show her a page with the UI in the default colours and icons instead of hers, hopefully your mom will know that it's faked UI. It doesn't look like her other browser windows.

Now personally I think the idea isn't that great anyway, since (A) it requires users to actually do that, and I'll bet most will just click on the default theme and be done with it, and (B) because it's working around what I consider a fucking stupid mis-feature. IMHO there's no need to allow browser windows without an URL bar and without a status bar in the first place. In an age where those are the main (and often only) things that can warn you against such attacks, allowing a site to disable them is just stupid. So just disable the option to hide the UI and, voila, suddenly noone can fake that UI any more. It's that simple.