Slashdot Mirror
Watered Down Phishing Protection In IPhone OS 3.1?
CrazyCanucklehead writes "Security Researcher Michael Sutton discusses his findings when looking at the advertised anti-phishing features in the recently released iPhone OS 3.1. It turns out that the protection is far less than what is provided in OS X and the feature may not provide any protection at all."
It turns out that the protection is far less than what is provided in OS X and the feature may not provide any protection at all.
the iphone in general contains far less than what is provided in OS X so this doesn't come as a surprise to me.
now, whether or not iphone 3.1 phishing protection is a big oversite on apple's part is another discussion and a worthy one at that
FTA:
If you work for Apple, please comment on why you went with watered down phishing protection on the iPhone.
If anyone from Apple does comment, we'll not know for sure as they'll not be able to identify themselves sufficiently. As such, everything we do see will just be guesses. Some may make sense and quite probably be right, but who knows...
The Mothership
It works really well. If I don't know how I got to a site, I don't enter my banking information. Simple. It's amazing how well that works. If I get an email from "my bank" asking me to click on a link to verify something, I don't click on the link. If I think that it has the slightest chance of being legit, I'll open a web browser and type my bank's URL in by hand and log into my account. If the original email was legit, I'll be prompted to do whatever it is they need. If I get an email asking me to reply with my username and password, I know it's a scam. How could anyone NOT know that's a scam? It's not frickin' rocket science.
Instead of putting all this effort into anti-phishing technology, we should make people less stupid.
That's troubling. Phishing protection that doesn't work is more dangerous than no protection at all. At least if you know you have no protection you'll be more careful.
Free Martian Whores!
You do realize that just about any security feature of any platform could be broken or circumvented and "may not provide any protection at all"
It doesn't matter how many bells and whistles, security and user protection systems you put on a device. A dumb user is still a dumb user. Look at your typical computer user. Even though they are using the latest A/V software, their ISP scans for email viruses and spam, they are using Firefox which has anti-phishing protection, a firewall program or a router with SPI, and malware protection software they still manage to blow their computer out of the water on a regular basis requiring tech support to fix it, or fall victim to a phishing scheme. This is 10 years of doing consumer tech support talking. Most user's have the "Press Yes" mentality. The dialog could clearly state, press Yes to install this nice virus on your computer, and without reading it, they would hit yes.
The best solution out there is to actually train users of online devices to know how to spot problems or suspicious sites, programs, etc. Until the users are trained how to recognize problems they won't learn how to deal with them.
... you're already fished.
Latency is the likely reason to not go with the Google lookup method.
Besides, don't know about you, but I'd prefer that not all my browser habits be logged to the government.
But it's Apple! I thought everything from Apple was considered magically delicious here. Now I'm confused :(
Given that the iPhone OS 3.1 was just released yesterday, I've got to wonder just how thoroughly this blogger investigated anything.
Note that doesn't mean I think the features in question are good or bad - but really, I'm not going to put much stock into anything anyone wrote up after at most a few minutes of use.
Sigh... I'll be so happy when blogs die their already-overdue natural death.
#DeleteChrome
Anything from Apple is considered magically delicious and explicitly loathed here.
11 was a racehorse
12 was 12
1111 Race
12112
I followed the same steps as outlined in TFA: download the verified online phishing list, pick a few URLs and load each into MobileSafari.
The very first one on the list, citibanking.ru, was blocked by both Firefox and MobileSafari. Since it was at the top, I thought that perhaps it was too recent (reported Sept 10, 2009), so I went down the list a bit, and got colorear.org/ray/, also blocked on Firefox and MobileSafari (reported Aug 26, 2009). guildoftibia.w.interia.pl was also blocked on both (reported July 28, 2009). I also found a few that were blocked on neither, but none that were blocked only on one and not the other, suggesting that MobileSafari uses Google's list (further reinforced by the fact that the "about" link takes you to a help page on Google.
So, I call sloppy research on the part of this security researcher (who writes "In fact, I have yet to identify a single phishing page blocked on the iPhone", emphasis his), since I was quite easily able to find several pages which were blocked.
Iphone security is already a joke. There's no anti-virus, firewall, or malware protection of any sort. Get a keylogger on one and any competent hack could bankrupt by buying up Itunes, the first time the owner buys anything on the app stores or itunes. That doesn't even count what could happen if someone were to actually make a purchase at an actual website with the thing. Apple is more worried about protecting the phone from people who want to put their own applications and themes on it, than they are with making it secure. Go figure.
The trouble with phishing blacklists is that if you take a hard enough line to make them work, there's collateral damage. Blacklisting by URL is useless; most attackers with a clue use a different URL in each email. Even blacklisting by full domain is no longer enough; many attackers use a bogus subdomain for each phishing e-mail.
If you take a hard line and blacklist at the second-level domain, blacklists are more effective. We measure the collateral damage of doing that. We (as SiteTruth) maintain an updated list of major domains being exploited by phishing scams. This is a list of domains that are both in PhishTank with a hostile URL, and OpenDirectory, as "major". Today, there are only 37 domains on the list, which is about as low as it's ever been. The high was around 175, back in 2008. This matters because the big-name sites are likely to be whitelisted, and phishers look for exploits that will let them use a big-name domain to evade filters.
We nag sites into fixing security holes which allowed some phishing site to exploit them. Microsoft, Yahoo, and eBay have cleaned up their act. Only a few major sites are still on the list. Google is on the list because someone figured out a way to use a Google Docs spreadsheet to host a phishing site. Piczo.com, a free hosting service now hosting 103 phishing URLs, just doesn't seem to care. The other sites with more than one entry tend to be dying hosting services: Geocities, FortuneCity, RoadRunner.
The problem of big-name sites being exploited by phishers is coming under control. It's probably safe to blacklist by second-level domain now. (If only Google gets their act together and deals with that spreadsheet exploit.)