phishing thesis
DESCRIPTION
Masters Thesis IOE Pulchowk CampusTRANSCRIPT
-
TRIBHUVAN UNIVERSITY
INSTITUTE OF ENGINEERING
PULCHOWK CAMPUS
Problems in Web Browser's Inbuilt Anti-Phishing Techniques and their Solutions
By
Rajendra Bahadur Thapa
A THESIS
SUBMITTED TO DEPARTMENT OF MECHANICAL ENGINEERING
IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE
DEGREE OF MASTER OF SCIENCE IN
TECHNOLOGY AND INNOVATION MANAGEMENT
DEPARTMENT OF MECHANCIAL ENGINEERING
LALITPUR, NEPAL
February, 2014
-
2
COPYRIGHT
The author has agreed that the library, Department of Mechanical Engineering,
Pulchowk Campus, Institute of Engineering may make this thesis freely available
for inspection. Moreover, the author has agreed that permission for extensive
copying of this thesis for scholarly purpose may be granted by the professor(s)
who supervised the work recorded herein or, in their absence, by the Head of the
Department wherein the thesis was done. It is understood that the recognition will
be given to the author of this thesis and to the Department of Mechanical
Engineering, Pulchowk Campus, Institute of Engineering in any use of the
material of this thesis. Copying or publication or the other use of this thesis for
financial gain without approval of the Department of Mechanical Engineering,
Pulchowk Campus, Institute of Engineering and authors written permission is
prohibited. Request for permission to copy or to make any other use of the
material in this thesis in whole or in part should be addressed to:
Head
Department of Mechanical Engineering
Pulchowk Campus, Institute of Engineering
Lalitpur, Kathmandu
Nepal
-
3
TRIBHUVAN UNIVERSITY
INSTITURE OF ENGINEERING
PULCHOWK CAMPUS
DEPARTMENT OF MECHANICAL ENGINEERING
The undersigned certify that they have read, and recommended to the Institute of
Engineering for acceptance, a thesis entitled "Problems in Web Browsers' Inbuilt
Anti-Phishing Techniques and their Solutions" submitted by Rajendra Bahadur
Thapa in partial fulfillment of the requirements for the degree of Master of Science in
Technology and Innovation Management.
______________________________
Supervisor, Dr. Jyoti Tandukar
Associate Professor,
IOE, Pulchowk Campus
_______________________________
External Examiner,
..
Committee Chairperson,
Name.
Title
Department of Mechanical
Engineering
Date .....................................................
-
4
ABSTRACT
Phishing is a form of crime in which identity theft is accomplished by use of
deceptive electronic mail and a fake site on the World Wide Web. Phishing threatens
financial institutions, retail companies, and consumers daily and phishers remain
successful by researching anti-phishing countermeasures and adapting their attack
methods to the countermeasures, either to exploit them, or completely circumvent
them.
This study attempts to identify solutions to phishing. It consists of an experiment on
browsers inbuilt phishing detection system using walk through inspection and batch
scripting codes to analyse problems in them, meta-analysis of phishing anomalies on
various research works, experimental quiz on users for phishing detection by
developing web application, development of model for phishing prevention and
verification of the proposed model on a extension made to use in Google Chrome.
The experiment using 96 samples of phishing websites from phishtank.com in 5 most
used browsers (Internet Explorer, Google Chrome, Mozilla Firefox, Safari and Opera).
The results show that they can detect 85% of the phish websites with their inbuilt anti-
phishing system on average. Browsers don't provide the solutions after detecting the
phishing websites which is the main problem in the existing anti-phishing system in
the browsers.
The experiment done through web application quiz showed users find most difficult to
detect misspelled/derived names in URL, URLs using http in place of https and URLs
using multiple Top Level Domains (TLD). An anti-phishing solution model
constituting of white list and heuristic approach has been developed where fore
mentioned anomalies in the URL are taken into consideration. An extension plug-in
for Google's Chrome browser is developed and tested with different test cases of
problems in anti phishing system in browsers and the top severe anomalies in the
URL. The proposed model was tested with 96 phishing sites with lack of SSL
anomalies, 66 with lengthy URL, 39 with multiple TLDs, etc from PhishTank could
detect all the phishing websites where Google Chrome detected 86 of them. The lack
of SSL was seen in all the phishing websites and awareness regarding SSL could
definitely prevent users from phishing.
-
5
ACKNOWLEDGEMENT
For the completion of this thesis different people from different sectors, professionals
and non-professionals had helped to their limit. I would like to thanks them all for
devoting their valuable time in this study. I would like to express my heartily
gratitude to supervisor Dr. Jyoti Tandukar, for his guidance and encouragement
throughout my graduate study. His expert knowledge and advice guided me though
this thesis, without which I would not have been able to get this point.
I would like to express my very special thanks for our Program Coordinator of
Masters of Science in Technology and Innovation Management, Prof. Amrit Man
Nakarmi, for his valuable time and coordinating us for the completion of this thesis. I
would like to thank Dr. Rajendra Shrestha, Head of Department of Mechanical
Engineering, Pulchowk Campus, for his regular inspiration and motivation for the
project. I would also like to thank to core member groups of Technology and
Innovation Management Program, without them I would not have got courage for the
completion of thesis.
I would like to gratitude to DIGP Mahesh Singh Kathayat, Ins. Pashupati Ray, Mr.
Shreeniwas Sharma, Mr. Ashish Bhandari, Mr. Sunil Chaudary and others who are
involved and help directly or indirectly for the completion of thesis. I am thankful to
Upveda Technology Pvt. Ltd, Jwagal for providing web app hosting support for the
thesis.
Finally, I would like to express a bouquet full of thanks to all my colleagues of
Technology and Innovation Management and all the friends of Pulchowk Engineering
Campus, IOE. And I cannot forget my family members for their full support to
complete my thesis.
-
6
TABLE OF CONTENTS
COPYRIGHT ........................................................................................................... 2
ABSTRACT ............................................................................................................. 4
ACKNOWLEDGEMENT ........................................................................................ 5
LIST OF FIGURES ................................................................................................ 10
LIST OF TABLES ................................................................................................. 12
LIST OF ABBREVIATION .................................................................................. 13
CHAPTER ONE ..................................................................................................... 15
INTRODUCTION .................................................................................................. 15
1.1 Background ............................................................................................. 15
1.2 Problem Statement .................................................................................. 16
1.3 Objective of the Study ............................................................................. 18
1.4 Research Questions ................................................................................. 18
1.5 Scope and Limitation of the study .......................................................... 18
1.5.1 Scope ....................................................................................................... 18
1.5.2 Limitation ................................................................................................ 19
1.6 Organization of Thesis ............................................................................ 19
CHAPTER TWO .................................................................................................... 21
LITERATURE REVIEW ....................................................................................... 21
2.1 Phishing ................................................................................................... 21
2.2 Methods of Phishing Attacks .................................................................. 22
2.3 Phishing Medium .................................................................................... 23
2.3.1 Phishing via Social Media ....................................................................... 23
2.3.2 Phishing via Mobile ................................................................................ 24
-
7
2.3.3 Phishing via Apps ................................................................................... 25
2.4 Phishing: International Scenario ............................................................. 26
2.5 Phishing in Nepal .................................................................................... 28
2.5.1 Incident 1: Nabil Bank ............................................................................ 28
2.5.2 Incident 2: Nepal Investment Bank ......................................................... 28
2.5.3 Incident 3: Bank of Asia ......................................................................... 29
2.5.4 Incident 4: Nepal SBI Bank .................................................................... 29
2.6 Phishing Prevention System .................................................................... 31
2.6.1 List Based Methods ................................................................................. 32
2.6.2 Heuristic Method ..................................................................................... 33
2.7 Anti Phishing Techniques in Web Browsers .......................................... 39
2.7.1 Google Chrome ....................................................................................... 41
2.7.2 Mozilla Firefox ........................................................................................ 43
2.7.3 Internet Explorer ..................................................................................... 45
2.7.4 Opera ....................................................................................................... 47
2.7.5 Safari ....................................................................................................... 48
2.7.6 Summary of technology used by anti phishing systems in browsers ...... 50
2.8 Problems in Browsers Inbuilt Phishing Prevention Systems ................. 51
2.9 Organization Working against Phishing ................................................. 52
2.9.1 APWG (Anti phishing Working Group) ................................................. 52
2.9.2 PhishTank ................................................................................................ 53
2.10 Phishing prevention as a social aspect .................................................... 53
2.11 Past research on phishing detection model ............................................. 54
CHAPTER THREE ................................................................................................ 57
-
8
METHODOLOGY ................................................................................................. 57
3.1 Research Design ...................................................................................... 57
3.2 Sources of Data ....................................................................................... 57
3.3 Methodology Insight ............................................................................... 58
3.4 Experimental Research for phishing detection in browser ..................... 59
3.4.1 Size of the sample of phishing websites ................................................. 59
3.4.2 Pre-validation of the setup: ..................................................................... 60
3.5 Development of model and its validation ............................................... 62
3.5.1 Selection of anomalies through web app ................................................ 62
3.5.2 Development of model ............................................................................ 67
3.5.3 Validation of the anti phishing solution model ....................................... 69
3.6 Tools and Technologies Used ................................................................. 71
3.7 Accessing the Web Application and chrome extension/plug-in ............. 71
3.7.1 Accessing the Web Application .............................................................. 71
3.7.2 Assessing the Extension/Plug-in for Google chrome ............................. 72
CHAPTER FOUR .................................................................................................. 74
DATA ANALYSIS / RESULTS ............................................................................ 74
4.1 Detection of phishing websites ............................................................... 74
4.2 Experimental Analysis ............................................................................ 74
4.2.1 Results of Phishing Anomalies in the URL ............................................ 75
4.2.2 Development of Anti Phishing Model .................................................... 78
4.2.3 Test Results and Analysis ....................................................................... 80
4.3 Solutions .................................................................................................. 83
CHAPTER FIVE .................................................................................................... 85
-
9
CONCLUSION AND RECOMMENDATION ..................................................... 85
5.1 Conclusion ............................................................................................... 85
5.2 Recommendation ..................................................................................... 86
5.3 Future Research Work ............................................................................. 88
REFERENCES ....................................................................................................... 89
-
10
LIST OF FIGURES
Figure 1 Cyber crime statistics in Nepal ...................................................................... 16
Figure 2 Internet users in Nepal ................................................................................... 17
Figure 3 Social media network users ........................................................................... 23
Figure 4 Fake PayPal for mobile (left) vs legitimate site (right) ................................. 25
Figure 5 Phishing attacks per year ............................................................................... 26
Figure 6 Daily submittted phishes ............................................................................... 27
Figure 7 Daily verified phishes .................................................................................... 27
Figure 8 Phishing email for the customers of Nepal SBI bank.................................... 30
Figure 9 Classification of phishing prevention system ................................................ 31
Figure 10 World map according to the use of browsers. ............................................. 39
Figure 11 Global statistics of browsers users. ............................................................. 40
Figure 12 Statistics of percentage of browser user in Nepal ....................................... 40
Figure 13 Phishing detection in Google Chrome ......................................................... 43
Figure 14 Anti phishing setting in Mozilla Firefox ..................................................... 44
Figure 15 Enabling SmartScreen filter (IE 8) .............................................................. 46
Figure 16 Phishing detection in IE 8 after using SmartScreen filter ........................... 46
Figure 17 Phishing detection in Opera browser. .......................................................... 48
Figure 18 Checking enable or disable of anti-phishing in safari browsers .................. 50
Figure 19 Phishing detection in Safari ......................................................................... 50
Figure 20 SSL lock icon in Gmail. .............................................................................. 52
Figure 21 Model of research process ........................................................................... 57
-
11
Figure 22 Research Methodologies in block diagram ................................................. 59
Figure 23 Existing phishing prevention systems ......................................................... 67
Figure 24 Proposed phishing prevention system ......................................................... 67
Figure 25 Implementation of the model ....................................................................... 69
Figure 26 Installation of plugin/extension in Google Chrome. .................................. 73
Figure 27 Output of Web App ..................................................................................... 75
Figure 28 Result from web app for recognizing phish site and real site ..................... 76
Figure 29 Detail diagram of proposed phishing prevention system ............................ 78
Figure 30 Educative message provided by the model ................................................. 79
Figure 31 Solutions advised by the model ................................................................... 80
Figure 32 Test Result (n = 96 websites) of the Model ................................................. 81
Figure 33 Information revealed from advice legitimate solution by the model. ......... 82
Figure 34 Analysis of solution on IP addresses ........................................................... 83
-
12
LIST OF TABLES
Table 1 Anomalies found in the URL .......................................................................... 38
Table 2 Messages seen after malware detection in chrome ......................................... 42
Table 3 Technologies used by anti phishing system in browsers. ............................... 51
Table 4 Sampling Methodology................................................................................... 60
Table 5 Environmental variables for experimental test for detection of phishing ....... 61
Table 6 Anomalies in the URL and target brands and organizations .......................... 64
Table 7 List of Messages disseminated to alert users about their mistakes ................. 66
Table 8 Tools and Technologies used .......................................................................... 71
Table 9 Result of Detection of phishing sites by browsers .......................................... 74
Table 10 Rank of Anomalies in the URL based on mistakes from the test users ........ 77
Table 11 Solutions provided by the tools developed. .................................................. 84
Table 12 The Chi-Square Test for detection of phishing website ............................. 108
Table 13 T-Test calculation for detection of phishing websites by browsers. ........... 110
-
13
LIST OF ABBREVIATION
API Application Programming Interface
Apps Applications
APWG Anti Phishing Working Group
ATM Automatic Teller Machine
CCPM Computer Crime Prevention Model
CERT Computer Emergency Response Team
CMU Carnegie Mellon University
CSIRT Computer Security Incident Response Team
DIGP Deputy Inspector General of Police
FINRA Financial Industry Regulatory Authority
FIRST Forum of Incident Response and Security Team
HTML Hypertext Markup Language
ICANN Internet Corporation for Assigned Names and Numbers
ICT Information and Communication Technology
IE Internet Explorer
IP Internet Protocol
IS Information System
ISP Internet Service Provider
IT Information Technology
JSON JavaScript Object Notation
MPCD Metropolitan Police Crime Division
-
14
MS MicroSoft
MTPD Metropolitan Traffic Police Division
NG Not Good
NIBL Nepal Investment Bank Limited
NST Nepal Standard Time
PIN Personal Information Number
SEI Software Engineering Institute
SMS Short Messaging Service
TIM Technology and Innovation Management
TLD Top Level Domain
URL Uniform Resource Locater
W3C World Wide Web Consortium
WOT Web of Trust
-
15
CHAPTER ONE
INTRODUCTION
1.1 Background
With the enormous advancement in Information and Communication Technologies,
computers and related technologies are now being used in almost all walks of life.
Computers today touch every aspect of society including the financial industry,
manufacturing industry, universities, insurance companies, law enforcement, and
governmental agencies. There are numerous benefits of these technologies in every
sector. Along with the benefits, there are several issues, complications and crimes
created associated with these technologies.
Wide popularity in the usage of Information and Communication Technologies (ICT)
has enabled criminals to use them in illegitimate ways (Sen & S, 2001). It is imminent
that technologies including the Internet open doors to numerous opportunities for
enterprises, it has also a dark side, which involves not only hacking and cracking,
fraud and theft, pervasive pornography, pedophile rings etc. but also includes
extortion, money laundering, pirating, corporate espionage, drug trafficking and
criminal organizations. (South Asia Partnership, 2007)
Cybercrime is rapidly rooting even in the developing country like Nepal. Figure
1show the statistics of cybercrime in Nepal (Cybercrime Division Nepal Police).
Nepal police handled 15 cases of cyber crime in fiscal year 2067/68, 46 cases in
2068/69 and 78 in the current fiscal year (2069/70). Cybercrimes dealing with insults
on social networking sites, abuse of photographs, etc. does not seem to be a big issue
in Nepal where political instability and other criminal activities are challenging to the
law enforcing agencies regularly.
-
16
Figure 1 Cyber crime statistics in Nepal
Technical-human resource in the law enforcing agencies has to be developed to
embark upon accelerating computer crimes in Nepal. Rationally, as most of the
processes in organizations are automated through computers, the crime associated
with it will also scale. There has to be systematized monitoring of with crimes borne
from the social networking sites, ATM frauds, etc.
The development of Computer Crime Prevention Model (CCPM) is imperative. This
research particularly deals with the prevention model for a category of computer
crime called phishing. Phishing consists of various on hand tools and techniques
which will be extensively studied through literatures and case studies. The research
also analyzes problems of the existing system and proposes a validated Anti-Phishing
Model.
1.2 Problem Statement
Phishing threatens financial institutions, retail companies, and consumers' cyber
activities daily. Phishers remain successful by researching anti-phishing
countermeasures and adapting their attack methods to exploit the fore mentioned
organizations and completely circumvent them. As people increasingly rely on
Internet to do business, Internet fraud becomes apparent threat to peoples Internet life.
12
2 1 0 0 0 0 0 0 0
32
51 1 2 1 2 2 0 2
57
8
1 03 3
03 2 1
0
10
20
30
40
50
60
2067/68
2068/69
2069/70
Cyber Crime In Nepal
Source: Nepal Police Crime Division, Hanumandhoka
-
17
Internet fraud uses misleading messages online to deceive human users into forming a
wrong belief and then to force them to take dangerous actions to compromise their or
other peoples welfare.
The internet users in Nepal are increasing rapidly. The internet users in Nepal are
increasing in double exponential manner (Annex 2). It is forecasted, there will be
18% internet users by 2015 and 25% by 2018. With this rapid growth of internet user,
the crimes related to internet will also increase.
Figure 2 Internet users in Nepal Source: (The World Bank, 2013)
In addition, financial institutions are flourishing in Nepal. The banking and business
scenarios in Nepal are gradually changing with the enormous application of ICT in
their businesses. These institutions are using ICT technologies in different forms and
serving their customers. More people are adopting internet and mobile to perform
their transactions in these institutions. On the other hand these technologies are
susceptible to the phishers. However, these changing scenarios have also attracted
many cybercriminals (Pritush, 2012; Shrestha, 2013).
Some incidents and phish scams are already seen in the police record. The prevention
of phishing is very important and localization of the solution will provide better
assurance to the Nepalese people. There are several anti-phishing solutions available;
0.00 0.00 0.20 0.83
9.0011.15
15.9718.35
25.47
30.22
0
5
10
15
20
25
30
35
1980 1990 2000 2010 2020 2030
Internet users population of Nepal
Per
centa
ge
of
Popula
tion
-
18
in fact, all the popular web browsers come with inbuilt anti-phishing solutions. There
is no complete measure to stop or prevent Internet users falling prey to phishing
attacks (Dhamija, Tygar, & Hearst, 2006). Every year Internet users lose hundreds of
millions of dollars to phishing attacks (APWG, 2013). In case of Nepal, where
computer literacy is very low, making the internet users to install anti phishing
solution can be cumbersome due to limited knowledge and utility of these tools.
Therefore, such internet users should be facilitated with the effective inbuilt anti-
phishing solutions in browsers.
1.3 Objective of the Study
The main objectives of the study are:
1) To propose a phishing prevention model that increases user awareness
The specific objectives of the study are:
1) To study about phishing detection in web browsers.
2) To explore problems in web browsers inbuilt anti-phishing techniques.
3) To identify URL anomalies that are likely to confuse users in phishing
websites.
4) To ensure a higher level of protection against phishing through user awareness
1.4 Research Questions
For satisfying the objective of the study, the following research questions are prepared.
1) What are the problems in web browsers anti phishing system?
2) How can technology intervene to increase user awareness so that users are not
misled by phishing sites?
1.5 Scope and Limitation of the study
1.5.1 Scope
The scope of this study is stated below:
1) It aware internet user about phishing.
2) It improves the phishing detection.
-
19
3) Protect internet users from falling to phishing attacks and save money as well
as resources.
1.5.2 Limitation
The study is done for the fulfilment of MSTIM program. There are some limitations
of the study. The limiting factors are as follow:
1) The phishing websites taken from phishtank.com are of only one day, which
lacks the varieties in the phishing websites.
2) It is valid for login page or other page which asks for confidential information,
e.g., PIN code, banking information, social security, etc.
1.6 Organization of Thesis
The report is organized in six chapters that are linked to the issues in relation to the
study. It also includes information from various sources related to the study.
Chapter One gives the background of the study, its rationale, objectives and research
questions.
Chapter Two includes literature review on the phishing, methods of phishing,
phishing types, phishing detection tools and techniques, browsers anti phishing tools,
etc.
Chapter Three reviews the research methodology used in the study. It elaborates the
expert survey method and experimental methods used, ways of collecting data,
development of the anti phishing model and experimental set up with test cases
development for the verification of the model.
Chapter Four analyze the different browsers anti phishing system and its detection
with phishing websites. The results from the users accessing the web application
based on the anomalies on the URLs. With these experimental result and based on the
meta analysis of phishing detection a solution model for Nepal is proposed. This
model is verified by developing an extension plug-in in Google chrome. The results
are analyzed in this part.
-
20
Chapter Five contains Conclusion and Recommendation.
-
21
CHAPTER TWO
LITERATURE REVIEW
2.1 Phishing
Phishing is a criminal, fraudulent mechanism which uses the Internet to acquire
susceptible personal information, such as usernames, passwords or credit card details
by masquerading as a reliable business website or electronic communication (Frost &
Sullivan , 2009). It is derived from "fishing". Phishing (also called brand spoofing) is
a term used for a short of fraud where phishers send out spoof email to a random
database to fool the recipient in to divulging personal information like credit cards
details, usernames and passwords, that can be used for identity theft. Phishing is one
of the most well known and fastest growing scams on the Internet today (Singh,
2007). According to Kay, phishing is a technique used to gain personal information
for purposes of identity theft, using fraudulent e-mail messages that appear to come
from legitimate businesses. These authentic-looking messages are designed to fool
recipients into divulging personal data such as account numbers and passwords, credit
card numbers and Social Security numbers.(Kay, 2004)
PhishTank explains phishing as a fraudulent attempt, usually made through email to
steal personal information. The best way to protect users from phishing is to learn
how to recognize a phish. Phishing emails usually appear to come from a well-known
organization and ask for your personal information such as credit card numbers, social
security numbers (USA), account numbers or passwords. Often phishing attempts
appear to come from sites, services and companies with which users do not even have
their account in. In order for Internet criminals to successfully "phish" their personal
information, they must get the users to lure from an email to a website. Phishing
emails will almost always tell the users to click a link that takes you to a site where
users' personal information is requested. Legitimate organizations would never
request this information of via email. (PhishTank, 2013).
-
22
2.2 Methods of Phishing Attacks
Singh mentions four main techniques of phishing. These techniques are briefly
described below: (Singh, 2007)
Dragnet: This method involves the use of spammed E-Mails, bearing falsified
corporate identification (e.g., corporate names, logos and trademarks), which are
addressed to a large group of people (e.g., customers of a particular financial
institution or members of a particular auction site) to websites or pop-up windows
with similarly falsified identification. Dragnet phishers do not identify specific
prospective victims in advance. Instead, they rely on false information included in an
E-Mail to trigger an immediate response by victims typically, clicking on links in
the body of the E-Mail to take the victims to the websites or pop-up windows where
they are requested to enter bank or credit card account data or other personal data.
Rod-and-Reel: This method targets prospective victims with whom initial contact is
already made. Specific prospective victims so defined are targeted with false
information to them to prompt their disclosure of personal and financial data.
Lobsterpot: It consists of creation of websites similar to legitimate corporate
websites which narrowly defined class of victims by phishers. Smaller class of
prospective victims identified in advance, but no triggering of victim response. It is
enough that the victims mistake the spoofed website as a legitimate and trust worthy
site and provides information of personal data.
Gillnet: In gillnet phishing; phishers introduce malicious code into emails and
websites. They can, for example misuse browser functionality by injecting hostile
content into another sites pop up window. Merely by opening a particular email, or
browsing a particular website, Internet users may have a Trojan horse introduced into
their systems. In some cases, the malicious code will change settings in users
systems, so that users who want to visit legitimate banking websites will be redirected
to a lookalike phishing site. In other cases, the malicious code will record users
keystrokes and passwords when they visit legitimate banking sites, then transmit those
data to phishers for later illegal access to users financial accounts.
-
23
In these all techniques, the phishing schemes seem typically rely on three basic
elements. First, phishing solicitations often use familiar corporate trademarks and
trade names, as well as recognized government agency names and logos. Second, the
solicitations routinely contain warning intended to cause the recipients immediate
concern or worry about access to an existing financial account. Third, the solicitations
rely on two facts pertaining to authentication of the e-mails: (1) online consumers
often lack the tools and technical knowledge to authenticate messages from financial
institutions and e-commerce companies; and (2) the available tools and techniques are
inadequate for robust authentication or can be spoofed.
2.3 Phishing Medium
Internet is a playground for the phishers. Internet is mainly access through the web
browsers. The history of phishing dates back to 1985 in AOL mail where phisher
posed as an AOL staff member and sent an instant message to a victim, asking to
victim reveal his/her password(Wordspy.com). With the uses of internet for social
networking, mobile and apps, these are also being a medium for phishers to find preys.
2.3.1 Phishing via Social Media
The number of social network users worldwide will rise from 1.47 billion in 2012 to
1.73 billion in 2013, an 18% increase Year on Year (YoY) and by 2017, and the
number of users globally will total 2.55 billion. (Sigsworth, 2013)
Figure 3 Social media network users Source: (Sigsworth, 2013)
-
24
Data collected from Fortune's Global 100 revealed that more than 50% of companies
said they have Twitter, Facebook, and YouTube accounts. Facebook membership for
example has increased nearly 10 times since 2008, with over 7 billion unique visitors
per month worldwide. Twitter shows that the number of members increased by a
factor of five over the same period, boasting over 555 million regular users. (EMC
Corporation, Jan, 2013)
With the world turning into a smaller and more social village than ever,
cybercriminals are by no means staying behind. They follow the money and so as user
behavior changes, RSA expects cybercriminals to continue following their target
audience to the virtual hot-spots. According to a Microsoft research study, phishing
via social networks in early 2010 was only used in 8.3% of the attacks- by the end of
2011 that number stood at 84.5% of the total. Phishing via social media increased
through 2012, jumping as much as 13.5% in one month considering Facebook alone.
Another factor affecting the success of phishing via social media is the vast popularity
of social gaming; an activity that brought payments into the social platform. Users
who pay for gaming will not find it suspicious when they are asked for credit card
details and personal information on the social network of their choice.(EMC
Corporation, Jan, 2013)
2.3.2 Phishing via Mobile
Mobile phishing is an emerging threat targeting the customers of popular financial
entities. By the end of 2012, we already saw 4,000 mobile phishing URLs,
representing less than 1% of all our phishing URL detections. Of the total combined
URLs used in phishing attacks against the top targeted entities, 7% were mobile
URLs. (Trend-Micro, Feb, 2013)
The most prominent market trends relevant to the mobile channel have to do with the
growth in mobile device usage in both our personal and work life and the pivotal role
of mobile apps. RSA experts to see more phishing directed at mobile device users
particularly smart phones as we move into 2013. Varying social engineering schemes
will target users by voice (vishing), SMS (smishing), app-based phishing (rouge
-
25
apps), as well as classic email spam that users will receive and open on their mobile
devices. (EMC Corporation, Jan, 2013)
Cybercriminals launch mobile phishing attacks because they can take advantage of
certain limitations of the mobile platform. A mobile devices small screen size, for
example, inhibits the mobile browsers ability to fully display any anti-phishing
security elements a website has. This leaves users no way to verify if the website
theyre logging in to is legitimate or not.(Trend-Micro, Feb, 2013)
Figure 4 Fake PayPal for mobile (left) vs legitimate site (right) Source:(Trend-Micro,
Feb, 2013)
2.3.3 Phishing via Apps
Apps are the central resources for Smartphone users, and that overall popularity of
apps will become just as trendy with cybercriminals.
Nowadays, users download apps designed for just about day-to-day activity, with the
most prominent of those being gaming, social networking and shopping apps. To late
both Apple and Google have surpassed 35 billion app downloads each from their
respective stores. According to research firm Gartner, this umber will grow to over
185 billion by 2015. (EMC Corporation, Jan, 2013). In Nepal also, there are day to
day familiar apps for Nepali calendar (Hamro Patro), load shedding schedule (Batti
Gayo), iMusic, news of Nepal, etc. which are becoming part of day to day
activities.(Techsansar.com, 2013)
In 2013 organizations will continue to aggressively tap into this growing market and
respond by further moving products and services to this channel, delivering
-
26
specialized small-screen adaptations for web browsing and developing native apps
that supply mobile functionality and brand-based services to enable customers
anywhere-anytime access.
Cybercriminals will focus on apps in order to deliver phishing conceal malware,
infect devices and steal data and money from users of different mobile
platform.(EMC Corporation, Jan, 2013)
Google's Android market has a developer-friendly reputation, with open source code
and no strict Apple-like approval process before they can sell their software.
Sometimes that openness is used for nefarious purposes, though, and malware creeps
in. Just recently, the Android Market was hit with its first phishing attack, via some
apps that used fairly standard tactics of mimicking bank websites to deceive users into
entering their passwords.(Hathaway, 2010)
2.4 Phishing: International Scenario
The total number of phishing attacks in 2012 was 59% higher than 2011. It appears
that phishing has been able to set another record year in attack volumes, with global
losses from phishing estimated at 1,5 billion in 2012. This represents a 22% increase
from 2011.(EMC Corporation, Jan, 2013)
Figure 5 Phishing attacks per year Source: (EMC Corporation, Jan, 2013)
PhishTank lists the link of phishing websites. According to statistics phishtank.com,
there are 1,206,474 valid phishes and out of which 12,745 are online. (PhishTank.com,
2013).
-
27
Figure 6 Daily submittted phishes Source: (PhishTank.com, 2013)
Figure 7 Daily verified phishes Source: (PhishTank.com, 2013)
One creative phishing attack offered Australian tax payers a special printable form to
access their refund payments. After the victim entered their sensitive financial
information into the form and clicked print, their private data was sent to the
cybercriminals. Fortunately, the Australian tax authorities discovered the fraud and
worked diligently to shut down the servers hosting the attack. (Merritt, 2009)
-
28
2.5 Phishing in Nepal
The internet users in Nepal are increasing in double exponential manner. It is
forecasted, there will be 18% internet users by 2015 and 25% by 2018. The phishing
incidents are being registered in the Nepal Police Crime Division (Figure 1). Some of
the cases which came in the media are highlighted below.
2.5.1 Incident 1: Nabil Bank
The incident posted on ekantipur.com (Shrestha, 2013). Naresh Lamgade of
Anarmani, Jhapa allegedly hacked into the accounts of Nabil Banks customers by
creating a fake website of the bank. The phiser sent email messages to Nabils e-
banking customers asking them to change their security codes and providing links to
do so. The link was taken to the fake e-banking website of Nabil Bank. Upon entering
the customers' identity and password, the unsuspectingly revealed their private login
details to the phiser.
Using the details obtained by phishing, Lamgade withdrew money from the accounts
of Nabils clients. According to the police, Lamgade has admitted that he has obtained
Rs 32,000 from the accounts of Nabils clients while the bank has claimed that he has
taken Rs 50,000.
2.5.2 Incident 2: Nepal Investment Bank
According to Shrestha (2013), the customers of Nepal Investment Bank Limited
(NIBL) got emails stating that their e-banking accounts had been disabled and telling
them to go to a given link to enable them to ask for a new identity and password. As
its customers clicked on the link, they were informed about enabling of the account.
But it was just an attempt to dupe and collect e-banking account of these customers.
As a result, Rs 1.2 million of active depositors of NIBL was stolen as one who sent
the email got access to the password of the banks client. (Shrestha, 2013).
The Central Investigation Bureau (CIB) of the Nepal Police was investigating the
incident. The police said that the IP address of the email is from outside the country.
However, the issue has got less priority as the bank has not lodged a formal complaint
yet on the issue, said a CIB official.
-
29
2.5.3 Incident 3: Bank of Asia
(Shrestha, 2013) A customer having an e-banking account with the Bank of Asia
(BoA) received an email telling him to change the security code of his account. The
customer, who is also an employee of NMB Bank, asked the BoA why they had sent
such an email. After finding out that a fake email had been sent to its customer, the
BoA, lodged a complaint at the cyber crime cell of Metropolitan Police Range,
Hanuman Dhoka.
Shrestha states that not all the incidents of phishing have been reported so far. So
there might be many other cases of phishing and many lose which are not lodged or
unknown yet.
2.5.4 Incident 4: Nepal SBI Bank
Online Internet Banking is sort of new topic among the Nepali internet users.
Currently lots of Nepali users are getting phishing email which is claimed to be from
reputed banks like Nepal Investment Bank, SBI Bank, Nabil bank etc. (Pritush, 2012)
.
The email gives you the warning that you account has been suspended and to
reactivate it you have to go to web address listed in your email address and put your
password. Below we have attached some pictures of phishing email you might
receive. Before login check if the address is of banks and connection is secure (https).
-
30
Figure 8 Phishing email for the customers of Nepal SBI bank Source: (Pritush, 2012)
-
31
2.6 Phishing Prevention System
Phishing prevention systems build awareness of potential phishing attempts, and
developing and promoting innovative technology solutions that help protect user
against phishing. They implement prevention and detection measures. The prevention
measure focuses to practices and technical solutions that either reduces the frequency
of phishing attempts users receive or that educate users so that they are less likely to
respond to phishing attempts (American Bankers Assocation, 2005). There are
number of techniques that can be used in the prevention systems, however the most
reliable is educating the users. Then other is detection measure which includes the
techniques and tools used to detect the phishing. There is no standard solution in order
to address and manages phishing attacks, however any solution that attempts to
approach phishing in a holistic way needs to focus on both consumer and business
audiences to help create trustworthy e-commerce system in which all parties are
protected and aware of potential hazards. (Microsoft, 2005).
The phishing prevention systems can broadly be classified into Technical and Non-
Technical types. The technical type can be further sub classified into list based
method and heuristic method. (Chaudhary, 2012). The Non-technical includes
Education and Awareness is kept in this classification based on the description of non
technical methods.
Figure 9 Classification of phishing prevention system
Many anti-phishing applications are developed on the client side. These are automated
techniques such as browser toolbars and plug-ins. Meanwhile, more and more
researchers on the topics of security realize the need for improving server security, in
Phishing Prevention Systems
Technical
List Based Methods
Black List White List
Heuristic Methods
Anomalies on URL
Anomalies on Source code
Search Enginesvisual similarities
Non-Technical
Education & Awareness
-
32
order to protect against phishing by considering both the client and the server.
However, the awareness about phishing in users is the most effective way for phishing
prevention. It is important that users get familiar with widely used techniques and
tricks of social engineering, psychology of manipulating people into divulging
confidential information and performing unwitting actions.
The client based solutions include techniques like: e-mail analysis (use Bayesian filter
and content analysis), blacklist filter (queried URLs identified as malicious),
information flow (keep track of the sensitive information that the user enters into web
forms and raise an alert if something is considered unsafe like URL obfuscation, a
fake domain name), similarity of layouts (compare visible similarity), etc. Similarly,
the server based solutions include techniques like: brand monitoring (crawling on-line
to identify clones and add suspected to a centralized blacklist), behavior detection
(detect anomalies in the behavior of users), security event monitoring (identifies
anomalies activity or post mortem analysis to detect attack or fraud), strong
authentication (use of more than one identification factor), new authentication
techniques (use of latest authentication techniques), etc.
Lastly, education and awareness are related to developing user ability to identify a
phishing attack mechanisms and about precautionary actions needed to safeguard their
personal and confidential data or information. This is also the most difficult methods,
since user need to guard their data or information from the vulnerabilities generated
by their own activities.
The technical phishing prevention methods explained in details below.
2.6.1 List Based Methods
List based methods are reactive techniques for phishing prevention. They maintain a
lookup of either trusted websites (white list) or malicious website (blacklist). These
list may be hosted either locally or hosted at the central server.
a) White-list Method
White list is the list of trusted websites that an Internet user visits in regular basis.
When the white list is exclusive, it allows access to only those websites which are
-
33
considered trusted and thus is highly effective against zero hour phishing. It also does
not produce any false positive results unless there is any wrong entry in the white-list.
However, it is very difficult to determine beforehand all the websites which users may
want to browse and accordingly update the list on time. (Chaudhary, 2012).
b) Blacklist Method
Blacklist is the list of IP addresses or domain names or URLs of treacherous websites,
although, IP addresses and domain names used by the scammer can be blocked.
However, many times phishers use hacked Domain Names (DN) and servers. So,
blocking the whole DNs or IP addresses can unintentionally block many legitimate
websites which share the same IP addresses and DNs. Therefore, blacklisting URLs
is, comparatively more appropriate for blacklist (Chaudhary, 2012).
Compiling and distributing a blacklist is a multi-step process. First, a blacklist vendor
enters into contracts with various data sources for suspicious phishing emails and
URLs to be reviewed. These data sources may include emails that are gathered from
spam traps or detected by spam filters, user reports (eg. Phishtank or APWG), or
verified phish compiled by other parties such as takedown vendors or financial
institutions. Depending on the quality of these sources, additional verification steps
may be needed. Verification often relies on human reviewers. The reviewers can be a
dedicated team of experts or volunteers, as in the case of Phishtank. To further reduce
false positives, multiple reviewers may need to agree on a phish before it is added to
the blacklist. For example, Phishtank requires votes from four users in order to
classify a URL in question as a phish.(Cranor, Wardman, Warner, & Zhang, 2009)
2.6.2 Heuristic Method
Heuristic-based approaches check one or more characteristics of a website to detect
phishing rather than look in a list. Those characteristics can be the Uniform Resource
Locater (URL), the Hypertext Markup Language (HTML) code, or the page content
itself. (Alkhozae & Batarfi, 2011). These characteristics are anomalies in the
components of phishing websites. In fact, even the automatic verification of phishing
websites used to maintain blacklists employs heuristic methods. Some of the heuristic
methods are next analyzed.
-
34
a) Visual similarity measures
Phishing websites often imitate the look and feel of official websites with the same
layouts, styles, key regions, rendering, blocks, and most of the contents. They use
various non-text elements, such as images and flash objects to display contents. Such
mimic of an authentic website with only minimal required changes are often difficult
for Internet users to distinguish. Moreover, the use of non-text elements to display
web contents makes it even harder for general content based anti-phishing techniques.
(Chaudhary, 2012)
b) Use of search engines
There are several search engines (e.g., Google, Bing, Yahoo!, Baidu) that maintain
crawl database and perform page ranking to display search results. Page-Rank
algorithm that was formulated by Google founder Larry Page and Sergey Brown uses
factors, such as number of inbound links, number of outbound links, and other
damping factors. Moreover, there is a set of recommended guidelines from Google
web master to prevent removable of websites from Google search engine index.
(Source: Google webmaster guidelines). Phishing websites have short duration and
have low page rank in the search engines (Chaudhary, 2012).
Google will display results for the search. Google Search will not rank the phishing
websites due to following nature of phishing websites.
1) Life span is very less. (The average uptime of phishing attacks dropped to a
record low of 23 hours and 10 minutes in the first half of 2012.(APWG,
2012))
2) Google's top ranking need to be accessed from long time and should be
genuine. (Google, 2013)
3) Phishing websites are either absent in the search results or possess a very low
page rank. (Chaudhary, 2012, p. 46)
c) Anomalies in URL
The anomalies found in the URL are as follows.
-
35
Anomalies in URL Short Description
Use IP address in
URLs.
APWG reported that 1.19%, 1.4%, and 2.09% of the phishing
websites had used URLs containing IP address during the first
quarter of 2012. An example of such URL is:
http://184.173.179.200/~agarwal/rbc/. However, some genuine
web applications usually used in intranet also can contain IP
address in URL.(APWG, 2012)
URLs contain brand,
or domain, or host
name.
In this form of phishing websites' URLs, the targets company
brand or domain or host name is included in the path segment
of URLs. McGrath and Gupta found that 50%-75% of phishing
websites URLs with targeted brand or domain or host
name.(McGrath & Gupta, 2008)The report of APWG (APWG,
2012) found that 49.53%, 45.39%, and 55.42% of the phishing
websites used URLs containing targeted companys brand, or
domain, or host name in their URLs.
An example of such URL is: http://abc.com/paypal.html.
URLs use http in
place of https, i.e.,
abnormal SSL
certificate.
For SSL-enabled phishing sites, public key certificates are
employed. In many phishing attacks, the Distinguished Names
(DN) in their certificates are inconsistent with the claimed
identities.(Pan & Ding, 2006)
URLs contain
misspelled or derived
domain name.
There are various tricks used by phishers to derive domain
name that looks similar to genuine domain name but disobey
the URL naming conventions. Some of the techniques used to
generate derive domain name for phishing websites are: like
replacing the characters of real domain name with similar
looking elements (can be Hexadecimal, Integer). An example
of such URL is:
http://paypa1.com, where character l is replaced by number
one, introduces a hyphen (-) in domain name, etc.(Chaudhary,
2012)
URLs using long host
name
There is no exact URL length limitation for both phishing and
legitimate websites. But phishing websites are usually longer
-
36
than normal URLs. Example of such URL is:
http://m.cgiebay.asmodeiproductions.com/
6872289d0ce2ae531422edfcc5b1fdc0/
8dfe2e5502027428ec505c6f138b9db7/?
pagein=http://www.ebay.com/itm/200942010334?
ru=http://www.ebay.com/sch/i.html?_from=
R40&_sacat=0&_nkw=261164572330&_rdc=1
According to McGrath and Gupta, URL lengths peak at 67 for
PhishTank and at 107 for MarkMonitor.(McGrath & Gupta,
2008).
Use short URLs.
Some phishing websites use URLs shortening services, such as
TinyURL to shorten their URLs which ultimately redirect to
long URLs. An example of such URL is:
http://prophor.com.ar/prophor/wells/alerts.php that redirected
to URL http://specialneedssvg.org/wp/wpadmin/import/
wellsfargo/wellsfargo/wellsfargo2011/indx.php(McGrath &
Gupta, 2008)
Use // character in
URLs path.
When URLs path contains // character, it is suspicious and
there is greater chance that it will redirect. An example of
such URL is: http://bganketa.com/libraries/eBaiISAPI.dll.htm?
https://signin.ebay.co.uk/ws/eBayISAPI.dll?SignIn (Gastellier-
Prevost, Granadillo, & Laurent, 2011).
URLs use unknown
or unrelated domain
name.
Sometime phishers use a domain name that is either
completely unknown or unrelated. An example of such URL
targeted to Facebook is: http://www.ckku.com/includes/In.htm
URLs use multiple
Top Level Domains
(TLD) within domain
name.
Some phishing websites URLs use multiple TLDs within
domain name. Such URLs can be detected from the number of
dots (.) used in URLs. (Zhang, Hong, & Cranor, 2007)
http://paypal.com.bin.webscr.skin.
a5s4d6a5sdas56d6554y65564y65564y4a56s4d56as4d65sad4.
shoppingcarblumenau.com.br/
-
37
URLs use different
port number.
Some phishing websites use port other than port 80.(Gastellier-
Prevost, Granadillo, & Laurent, 2011) Example:
http://27.251.96.35:8888.
URLs with abnormal
DNS record.
Legitimate websites usually have record in DNS record;
however, phishing websites usually do not have record. In case
if they have, most of the information remains empty.
:http://27.251.96.35:8888 used for Paypal. (Zhang, Hong, &
Cranor, 2007)
Life of Domain.
In general, the life of phishing sites is not long. Even when
they have registered domain, it is usually a recently registered
one. However, everyday many recently registered legitimate
websites are added to Internet.(APWG, 2012)
Use of free web
hosting.
Free web hosting services are widely misused by phishers to
host their phishing websites. (McGrath & Gupta, 2008)
An example of such URL is:
http://arnodits.net/ysCntrlde/webscr_prim.php?YXJub2RpdH
M ubmV0NTAxNmNmYTVjMzY4NQ==M TM0
MzY3MjIyOQ.
URLs hosted by
geographical
location.
The majority of phishing websites are hosted in USA (APWG,
2012). This might be because USA hosts the highest number
of other websites as well.
Use of special
character "@"
Special character "@" is used to redirect the user to a website
different from that appears within the address bar. An example
of such URL is:
http://www.amazon.com:[email protected]
42.34(Zhang, Hong, & Cranor, 2007). Here the website is
redirected to 69.10.142.34.
Use of sensitive
words
Phishing URLs are found to contain several suggestive word
tokens. For example the words login and signin are very often
found in a phishing URL. (Garera, Provos, Chew, & Rubin,
-
38
2007). They stated 8 words as "secure", "account", "webscr",
"webscr", "login", "ebayisapi", "signin", "banking" and
"confirm"
Table 1 Anomalies found in the URL
However, these anomalies can be seen in the real websites also. So, these are not the
sure shot for phishing detection.
d) Anomalies found in the source codes of phishing websites
According to Chaudary, phishing websites are built in hurry and in cheap manner. So
it contents may have flaws and anomalies in the source code too.(Chaudhary, 2012).
These are listed below:
Abnormal anchor URLs.
Genuine websites link use an anchor to provide navigational guidance. The URLs
used in the anchor are usually from their own domain and sometime to different
domain. However, in phishing sites such anchor URLs are mostly from different
domain. It has been also found that sometimes the anchor in phishing websites does
not link to any pages, for example, AURL can be file:///E/ or #.
Abnormal Server Form Handler (SFH).
Security is one of the prime concerns for organizations that do online transactions.
Such organizations require credentials for login which are generally username and
password. Thus, their websites include SFH. Legitimate websites always take actions
upon the submission of form; however, phishing websites can either contain
about:blank or #. Moreover, legal sites SFHs are handled by the server of the
same domain. So whenever the form is handled by any foreign domain server, it
makes the websites suspicious.
Similarly there are many other anomalies like abnormal request URLs, abnormal
cookie, Mismatch hyperlink, use of authentic logos, illegal use of pop-ups, etc. are
found in the source code of phishing websites.
-
39
2.7 Anti Phishing Techniques in Web Browsers
According to Statcounter.com, statistics of browser's users are shown in the figure
below. In the figure, the map of the world is segmented according to the number of
users using browsers in that country or region. The users using Google Chrome are
shown in green color, Inter Explorer (IE) are shown in blue color, Mozilla Firefox are
shown in orange color, Safari users are shown in light grey color and Opera users are
shown in red color.
Figure 10 World map according to the use of browsers. Source: (statcounter.com,
2013)
-
40
Figure 11 Global statistics of browsers users. Source: (statcounter.com, 2013)
Thus, the top five browsers with respect to the number of users are Google Chrome,
Internet Explorer, Mozilla Firefox, Safari and Opera. (statcounter.com, 2013)
Similarly the statistic of browser's user in Nepal is shown below:
Figure 12 Statistics of percentage of browser user in Nepal Source: (statcounter.com,
2013)
From Figure 12, 5 most used browsers in Nepal in June, 2013 to August, 2013 are
Chrome (53.9%), Firefox (32%), Internet Explorer (7.48%), Safari (2.81%) and Opera
(2.05%). So, these 5 browsers are selected for the study purpose.
Browsers have various options for protection against phishing. Some of the options
are directly related to phishing while others too can be used against phishing. These
options are briefly described:
a) Block pop-ups windows: Online thieves use pop-up window in the legitimate
website and direct user to perform activity via which the phishers can fulfill
their motives. Blocking the pop-up window when not required can be done.
(Hacker Factor Solutions, 2005)
b) Enable JavaScript: JavaScript is being used in phishing purpose. There are
several flaws in JavaScript which would enable malicious web sites to install
something bad on user computer or even probe the details of other computers
on users private network. Many phishing attacks claims to be security
warnings, alerting users to suspicious activity in their account or offering a
-
41
new security mechanisms using JavaScript. In addition to that, traceable
JavaScript function is being used that allows phishers to check if a user is
logged into certain websites, hence the in-session name given to this attack
and the code would generate a web-based pop-up claiming to from website.
Disabling JavaScript when not required can be helpful against phishing.
c) Protocols (Use SSL 3.0, Use TLS 1.0): These Secure Socket Layer (SSL) and
Transfer Layer Socket (TLS) are cryptographic protocols and helpful in war
against phishing. TLS and SSL encrypt the segments of network connections
above the Transport Layer, using symmetric cryptographic for privacy and a
keyed message authentication code for message reliability. For example:
Gmail, Hotmail use 128-bit encryption and TLS 1.0 while Yahoo mail uses
256-bit encryption and TLS 1.0.
d) When a server requests my personal certificate (Ask one automatically, Ask
me every time): Setting ask me every time can be safer against phishing.
e) Warn me when sites try to install add-ons, Block reported attack sites, and
block reported web forgeries are three options made for phishing
preventions.
2.7.1 Google Chrome
Google Chrome is a free, open-source web browser developed by Google. It was
released in 2008, and has grown to be one of the most popular browsers today.
When Google decided to make a browser, they wanted to completely rethink the
browser, as browsing now is very different from browsing simple text pages. Now we
email, shop, pay bills, and run large application in our browsers.
(www.w3schools.com, 2013).
Google discovers suspicious websites during constant crawl and re-crawl of the web.
Suspicious websites are the website that may look like a phishing website, designed to
steal personal information, or it may contain signs of potentially malicious activity
that would install malware onto users PC without consent. Any website that looks like
its a phishing page; it gets added to a list of suspected phishing websites. If found a
website that contains signs of potentially malicious activity, a virtual machine is
-
42
started, the website is browsed, and watched its activity. If malicious activities occur,
the website is added to a list of suspected malware infected websites. These black lists
maintained by Google are used by Google Chrome.(Provos, McNamee,
Mavrommatis, Wang, & Modadugu, 2007)
All the above options are also in Google Chrome. These options have same benefits
as mentioned:
1) Check for server certificate revocation,
2) Use SSL 3.0., Use TLS 1.0
3) Allow all sites to run JavaScript
4) Do not allow any sites to show pop-ups
5) Enable phishing and malware protection (precisely for phishing).
Steps to disable phishing and malware protection:
1) Click the Chrome menu on the browser toolbar.
2) Select Settings.
3) Click Show advanced settings and find the "Privacy" section.
4) Deselect the "Enable phishing and malware protection" checkbox.
Here are the messages users may see when phishing and malware detection is
enabled:
Message What it means
The Website Ahead
Contains Malware!
This message appears if Google Chrome detects that the
site you're trying to visit may have malware.
Danger: Malware Ahead! This message appears if Google Chrome detects that the
web page you're trying to visit may have malware.
Reported Phishing Website
Ahead!
This message appears if Google Chrome detects that the
site youre trying to visit is suspected of being a phishing
site.
Table 2 Messages seen after malware detection in chrome
-
43
Figure 13 Phishing detection in Google Chrome
2.7.2 Mozilla Firefox
Firefox contains built-in Phishing and Malware Protection to help keep you safe
online. These features will warn user when a page user visit has been reported as a
Web Forgery of a legitimate site (sometimes called phishing pages) or as an Attack
Site designed to harm users' computer (otherwise known as malware).(Firefox, 2013)
Mozilla Firefoxs Phishing feature provides two modes of operation, local and third
party mode. Under the local mode, it uses inbuilt Phishing and Malware protection
that warn users when a visited page has been reported as a web forgery of a legitimate
site or an attack site designed to harm users computers. These lists are automatically
downloaded and updated every 30 minutes or so when the Phishing and Malware
protection features are enabled.
There are two times when Firefox communicates with Mozillas partners that manage
the lists while using Phishing and Malware protection. The first is during regular
updates to the lists of reporting phishing and malware sites. No information about user
or the sites visited is communicated during lists updates. The second is when a
reported phishing or malware sites is encountered. Before blocking the site, Firefox
requests a double check to ensure that the reported site has not been removed from the
lists since the last update. In case of a visited URL matches a URL in the list of
known phishing sites, the browser block the website and displays a warning message
to the user. (Mozilla iSEC Partner, 2006)
-
44
This way the local mode provides security from phishing website to the user and is
able to ensure the integrity of a users browsing experience as well as the privacy of
their browsing activity. The third party mode uses online third party service (the
default third party service used by the browser is Google) and allows user to have
immediate check of a URL in real time. Users can test to see if Phishing Protection is
active by trying to visit Firefox phishing test site.(Firefox, 2013)
Alike Google chrome, Mozilla Firefox has also many options for phishing prevention.
1) Block pop-up windows (Can be accessed by going to Main Menu =>
Options=> Content)
2) Enable JavaScript
3) Protocols (use SSL 3.0, use TLS 1.0)
4) When a server requests my personal certificate (Select one automatically,
Ask me every time): Setting ask me every time can be safer against
phishing.
5) Warn me when sites try to install add-ons, block reported attack sites, and
block reported web forgeries are three options made for phishing
preventions.
Figure 14 Anti phishing setting in Mozilla Firefox
-
45
2.7.3 Internet Explorer
Internet Explorer has a built-in Anti-Phishing feature using phishing filter. Phishing
filter in Internet Explorer, also called SmartScreen filter helps detect phishing
websites.
Phishing filter uses three methods to help protect you from phishing scams. First, it
compares the addresses of websites user visit against a list of sites reported to
Microsoft as legitimate. This list is stored on user's computer. Second, it helps analyze
the sites user's visit to see if they have the characteristics common to a phishing
website. Third, with user's consent, phishing filter sends some website addresses to
Microsoft to be further checked against a frequently updated list of reported phishing
websites.
If the site users are visiting is on the list of reported phishing websites, Internet
Explorer will display a warning webpage and a notification on the address bar. From
the warning webpage, user can continue or close the page. If the website contains
characteristics common to a phishing site but isnt on the list, Internet Explorer will
only notify user in the address bar that it might possibly be a phishing website.
When users install and run Internet Explorer for the first time, it will prompt to user to
enable phishing-filter. However, if users choose not to turn on, s/he can enable
phishing-filter as follows:
Similar to above two browsers, MS IE too contains options for phishing prevention:
1) Trusted sites and restricted sites: These two options have facility to list
trusted and restricted websites respectively. Any website suspicious to be
phishing can be made restricted website.
2) Turn on pop-up blocker: Has feature to list the website in which pop-up
can be allowed.
3) Active scripting: This is to enable and disable JavaScript.
The options primarily for phishing or is a part of phishing prevention systems of IE
are below:
-
46
1) Report unsafe website: This options can be use to determine if the website
is unsafe or not. It sends requests to Microsoft server which checks their
list to verify whether the website is phishing or legitimate.
2) Check this website and Turn on SmartScreen filter:
Figure 15 Enabling SmartScreen filter (IE 8)
Figure 16 Phishing detection in IE 8 after using SmartScreen filter
-
47
2.7.4 Opera
With Opera, every webpage user request is subjected to phishing and malware filters.
The security status of the page is displayed in a security badge in the address field. If
a website is found on lists of known, suspicious sites, a warning page may display
before the page is shown. Users decide whether to visit the questionable website, to
return safely to the browser home page, or to read additional information about the
status of the page. If users open a phishing or malware page, it will be marked with a
red warning badge.(Opera, 2013).
Opera have given more selectable options in particular sections of the option. These
are explained below:
1) Pop-ups: Users can handle pop-ups in their own preference as below.
a) Open all pop-ups
b) Open pop-ups in background
c) Block unwanted pop-ups.
d) Block all pop-ups.
2) Check box for "Enable JavaScript has also JavaScript options button which pop-
ups JavaScript options are below:
a) Allow resizing of windows
b) Allow moving of windows
c) Allow raising of windows
d) Allow lowering of windows
e) Allow changing of status field
f) Allow scripts to detect context menu events.
g) Allow scripts to hide address bar
h) Open console for error.
i) User JavaScript folder path text box.
3) Enable plug-ins has inner check box to enable plug-ins only on demand.
4) Manage site preferences: This option facilitates users to add, edit and delete the
website to be allowed. The added websites can be customized for pop-ups,
cookies, content, JavaScript, etc. This is like maintaining white list from the users
side.
-
48
5) Blocked content: This option facilitates users to add, edit and delete the websites
to be blocked.
The options primarily for phishing prevention systems are as follow
6) Enable "Fraud and Malware Protection"
7) Manage Certificates: It provides options to import, export, and view and delete
certificates of personal (client certificates) and authorities (authority certificates
like VeriSign, Go Daddy, Entrust, etc.). These certificates can be kept in
intermediate, approved and rejected group.
8) Security Protocols: The options of enabling security protocols like Enable SSL3,
Enable TLS1, etc.
9) Trusted Websites: There is provision of add, delete and edit the trusted websites.
Figure 17 Phishing detection in Opera browser.
2.7.5 Safari
Safari employs sandboxing techniques to isolate Web content and applications from
other information on systems, and also include malicious code blocking capabilities.
As with the other browsers, Safari also relies on current reports about malicious and
fraudulent websites to warn and protect its users. If a website contains malicious code
intended to capture personal data or tamper with users' computer, sandboxing
provides a built-in blocker that restricts the code from doing harm.(Tittel, 2011)
-
49
User personal data is safer on Safari. Thats because Safari protects user from cross-
site scripting, phishing, and malware attacks that try to obtain user's personal data. So
if users visit a site that might contain phishing or malware content, Safari alerts users
and wont open the page. Safari makes it easy to see when user's connection to a
website is encrypted. (Safari, 2013)
When users first launch Safari 3.2, it connects to safebrowsing.clients.google.com and
requests information on the two main blacklists that Google maintains: a list of known
phishing sites, and a list of known malware sites. Google returns the list of hashed
URLs to your computer in chunks, starting with the freshest information first and
gradually filling in older information. Once users find that folder, users will see two
files within it: "cache.db" and "SafeBrowsing.db". The former is indeed Safaris
cache. The latter file contains the blacklists from Googles Safe Browsing initiative
user will notice that the file was most likely created right about the time users first
launched Safari 3.2, and if users have the browser open, the file should have been
modified within the past 30 minutes. (Macworld.com, 2008)
Safari contains following option for phishing prevention.
1) Enable plug-ins: Check box for enable plug-ins.
2) Enable Java: This is for enabling Java
3) Enable JavaScript
4) Block pop-up windows
The options primarily for phishing or is a part of phishing prevention systems of
Safari are as follow:
1) Warn when visiting a fraudulent website. (Uses Google Safe Browsing
Service)
2) Ask before sending a non-secure form to secure website.
By default the anti-phishing system is on in safari. It can be checked by going to
Setting=>Preference=> Security
-
50
Figure 18 Checking enable or disable of anti-phishing in safari browsers
Figure 19 Phishing detection in Safari
2.7.6 Summary of technology used by anti phishing systems in browsers
Browsers Detection Technology Used Remarks
Google Chrome Blacklist and heuristic on
web crawl data
Safe browsing API
Internet Explorer white list,
blacklist and heuristic
smart screen filters
Mozilla Firefox local mode: black list
third party mode: Google
Safe browsing API
Safari blacklist: Google
heuristic
Safe browsing API;
Third party cookie blocking
-
51
Opera blacklist: PhishTank PhishTank; Netcraft
Table 3 Technologies used by anti phishing system in browsers.
2.8 Problems in Browsers Inbuilt Phishing Prevention Systems
The technical and non-technical issues are mentioned below:
1) Warning and pop ups message is another problem which can be irritating to user.
A further difficulty is that of warning the user (or taking other action when
phishing is detected or suspected). Halting the browser connection (i.e. refusing to
connect to the site) is usually unacceptable unless it is absolutely certain that the
site is phishing. (Dhamija, Tygar, & Hearst, 2006; Wu, Miller, & Garfinkel, 2006;
Li & Helenius, 2007; Egelman, Cranor, & Hong, 2008)
2) The above mentioned browsers use blacklist approaches in their default anti-
phishing systems. The problems of blacklist approach are false positive, false
negative, and list update. The anti-phishing systems have to struggle with effort to
maintain both false positives and false negatives error rate low. The false positives
erode trust in the system and cause inconvenience and possible loss to website that
are erroneously classified as phishing. Similarly, the false negative can turn the
effort to protect phishing futile. Furthermore, to halt the browser connection to
certain website unless it is not confirmed that it is phishing is unacceptable.
Moreover, blacklist approach attempt to inform clients of phishing sites either
pushing an update list to the client or having the clients check with server to
request information on a URL it is visiting (Florencio & Herley, 2006; Cranor,
Wardman, Warner, & Zhang, 2009). Both of these approaches are inconvenient
because they can cause definite latency and serve over load respectively.
3) There are many rules or heuristics that can appear promising when run on training
data. They can even perform worthwhile to protect small fraction of overall
population. However, their efficiency is inverse relation to their scale of
deployment: the more people use them the less effective they are. (Islam &
Abawajy, 2013)
4) There is white-list approach that is maintained by user. This is used to reduce the
traffic to server and can only be used in conjunction with sites that have high
-
52
security standards, and do not host personal pages.(Dhamija, Tygar, & Hearst,
2006; Odaro & Sanders, 2010)
5) Secure Sockets Layer (SSL) is a protocol commonly used in validating the
identity of a website and enabling the transmission of private information over the
Internet. It makes use of cryptographic keys to encrypt the data being transmitted
and to provide a signature used in identification. Browser SSL certificates are
electronic documents that enable encryption on secure websites, and also contain
information about the certificate holder. The use of these certificates (and the
related well known SSL lock icon) has traditionally been one way of providing
identity information to the user, but studies have shown that many users have
difficulty interpreting certificates or may not even be aware that they exist. There
are many other options in the browser which users rarely use due to lack or very
little knowledge about them.
Finally, the biggest problem is getting users to alter their behavior. Even study
showed that either user tend to ignore or fail on to act on security warning. This is
highest threat for several anti-phishing solutions. (Odaro & Sanders, 2010)
Figure 20 SSL lock icon in Gmail.
2.9 Organization Working against Phishing
There are many organizations working against phishing. These organizations are the
resources for studying and tackling against phishing. Some of the main organizations
are as follow:
2.9.1 APWG (Anti phishing Working Group)
The APWG is a worldwide coalition unifying the global response to cybercrime
across industry, government and law-enforcement sectors. APWGs membership of
more than 2000 institutions worldwide is as global as its outlook, with its directors,
-
53
managers and research fellows advising: national governments; global governance
bodies like ICANN; hemispheric and global trade groups; and multilateral treaty
organizations such as the European Commission, Council of Europe's Convention on
Cybercrime, United Nations Office of Drugs and Crime, Organization for Security
and Cooperation in Europe and the Organization of American States. (APWG, 2013)
Websites of APWG public-service enterprises include its public website,
; the website of public awareness program, "STOP.
THINK. CONNECT." messaging convention and
the APWGs research website . These serve as
resources about the problem of phishing and electronic frauds perpetrated against
personal computers and their users and resources for countering these threats.
(APWG, 2013)
The APWG collects, analyzes, and exchanges lists of verified credential collection
sites, like those used in phishing. (APWG, 2013)
2.9.2 PhishTank
PhishTank is an anti-phishing website. PhishTank was launched in October 2006 by
entrepreneur David Ulevitch as an offshoot of OpenDNS. The company offers a
community-based phish verification system where users submit suspected phishes and
other users "vote" if it is a phish or not. PhishTank is used by Opera, WOT (Web of
Trust), Yahoo! Mail, McAfee, APWG, CMU, Mozilla, Kaspersky, Firetrust, Officer
Blue, FINRA, Message Level, SURBL < http://www.surbl.org/ >, Site Truth, Avira,
CSIRT and by PhishTank SiteChecker.(Wikipedia, 2013)
PhishTank data is provided gratis for download or for access via an API call but only
under an extremely limited, restrictive license. PhishTank SiteChecker is a tool
available for Mozilla Firefox browser to check the user site against phishing.
2.10 Phishing prevention as a social aspect
The social aspects that are vital for the phishing prevention mentioned in American
Bankers Association report are:
-
54
1) Public Education on Phishing: Since phishing is a form of identity theft that
differs substantially from other physical based identity theft techniques, it is
the responsibility of government and private sector towards public to update
them about latest phishing techniques and method to recognize them.
2) Authentication: No doubt education of phishing is helpful to fight against
ph