There is another strategy that the industry has almost totally ignored -
allow the recipient to verify the sender's identity. Not verifed -> delete
the email.
This does not mean S/MIME, PGP or added email headers etc, but may also use
those techniques as well.
It means the sender and recipient can trust each other that the email they
send each other, and thus can treat all other email as suspect.
In the distributed internet, this would probably be best implemented in
selected gateways that authenticate senders, so the trust is
gateway-recipient, rather than the more complex sender-recipient, sicne the
former scenario has less trust paths than the latter.
This needs no databases, and no arms race of trying to keep up with spammers
tools.
Lyal
-----Original Message-----
From: Bjorn Borg [mailto:bjorn.brg@gmail.com]
Sent: Friday, 19 August 2005 11:30 PM
To: bugtraq@securityfocus.com; focus-virus@securityfocus.com;
focus-ms@securityfocus.com; honeypots@securityfocus.com;
pen-test@securityfocus.com; security-basics@securityfocus.com;
security-management@securityfocus.com; forensics@securityfocus.com;
webappsec@securityfocus.com; secureshell@securityfocus.com
Subject: anti-phishing implementation
Hi everyone,
I just started to develop an anti-phishing tool for my thesis.
The tool should have two tasks. First one is to detect and prevent known
attacks from web-based and POP3 emails. Second is to analyze emails' content
to identify unknown phishing email and spoofed link.
To make the first task work, I need a full database of known phishing
emails, links. Anybody know where I can get this database?
I really appreciate any suggestion about how to make this tool work,
sources,...
Many thanks,
Bjorn
Kungliga Tekniska Hogskolan, Stockholm, Sweden
