Email authentication to prevent spoofing of email addresses will solve
85% of phishing attacks in their current form. At the Anti-Phishing
Working Group we recommend a two-step adoption of SenderID/SPF and then
email signing (most likely with Yahoo's Domain Keys or an IIM
derivative). See more about this at
http://truste.org/about/authentication.php
Mark, you point out that authenticating a website to a consumer is
necessary. www.passmarksecurity.com has an interesting image-based
approach that requires no software or hardware on the end user machine.
There are also a lot of things that can be done on the application
security side to detect and reduce phishing. These include:
- preventing cross-site scripting
- detecting load spikes
- preventing image referrals
- detecting NDN bounce floods
- detecting account takeovers
- detecting phishing site testing prior to attack launch
- application forensics
Dave
Night job: Chairman, Anti-Phishing Working Group. www.antiphishing.org
Day job: Sr. VP, Teros. www.teros.com
-----Original Message-----
From: Mark Burnett [mailto:mb@xato.net]
Sent: Monday, November 29, 2004 8:15 AM
To: webappsec@securityfocus.com
Subject: Re: Article - A solution to phishing
I have been watching this thread with great interest and although the
basic concept that Michael describes is interesting and might help
reduce phishing, as others have pointed out it is still vulnerable to a
number of other threats and heavily depends on a number of assumptions
that might not be realistic.
Nevertheless, the fundamental issue with phishing is not that an
attacker can obtain your credentials, but that an attacker can trick a
user into entering credentials in a fake web form. This is because it is
easy to create a fake web site that looks exactly like the original and
it is easy to direct the user to that site using deceptive links in
e-mails, browser vulnerabilities, DNS spoofing or poisoning, ARP
spoofing, stealth proxies, cross-site scripting, HOSTS file
modification, bookmark modification, trojans, social engineering, etc.
Protecting authentication credentials is also a problem, but the
solution to phishing is more one of authenticating the site rather than
authenticating the user. First solving the issue of authenticating the
site makes it easier to solve the problem of authenticating the user.
Mark Burnett
------------------------------------------------------------------
Hacking the Code: ASP.NET Web Application Security
http://www.hackingthecode.com
