Hi Dave,
Re "PassMark" ... This implementation is still easily susceptible to
MITM attack ... The phishing site could simply take the Image from the
real site.
Not to mention the education issue ... Users could easily be fooled
to completely forget about the image anyway:
Example:
------------------------------------------------
Welcome User,
IMPORTANT NOTICE: We have removed our image-authentication service due
to security concerns. We have improved our login system to use "best
practice ..." ...
Username: [ ]
Password: [ ]
[ Login ]
------------------------------------------------
-- Michael
-----Original Message-----
From: Dave Jevans [mailto:djevans@teros.com]
Sent: Tuesday, 30 November 2004 6:35 AM
To: Mark Burnett; webappsec@securityfocus.com
Subject: RE: Article - A solution to phishing
Email authentication to prevent spoofing of email addresses will solve
85% of phishing attacks in their current form. At the Anti-Phishing
Working Group we recommend a two-step adoption of SenderID/SPF and
then email signing (most likely with Yahoo's Domain Keys or an IIM
derivative). See more about this at
http://truste.org/about/authentication.php
Mark, you point out that authenticating a website to a consumer is
necessary. www.passmarksecurity.com has an interesting image-based
approach that requires no software or hardware on the end user
machine.
There are also a lot of things that can be done on the application
security side to detect and reduce phishing. These include:
- preventing cross-site scripting
- detecting load spikes
- preventing image referrals
- detecting NDN bounce floods
- detecting account takeovers
- detecting phishing site testing prior to attack launch
- application forensics
Dave
Night job: Chairman, Anti-Phishing Working Group. www.antiphishing.org
Day job: Sr. VP, Teros. www.teros.com
-----Original Message-----
From: Mark Burnett [mailto:mb@xato.net]
Sent: Monday, November 29, 2004 8:15 AM
To: webappsec@securityfocus.com
Subject: Re: Article - A solution to phishing
I have been watching this thread with great interest and although the
basic concept that Michael describes is interesting and might help
reduce phishing, as others have pointed out it is still vulnerable to
a number of other threats and heavily depends on a number of
assumptions that might not be realistic.
Nevertheless, the fundamental issue with phishing is not that an
attacker can obtain your credentials, but that an attacker can trick a
user into entering credentials in a fake web form. This is because it
is easy to create a fake web site that looks exactly like the original
and it is easy to direct the user to that site using deceptive links
in e-mails, browser vulnerabilities, DNS spoofing or poisoning, ARP
spoofing, stealth proxies, cross-site scripting, HOSTS file
modification, bookmark modification, trojans, social engineering, etc.
Protecting authentication credentials is also a problem, but the
solution to phishing is more one of authenticating the site rather
than authenticating the user. First solving the issue of
authenticating the site makes it easier to solve the problem of
authenticating the user.
Mark Burnett
------------------------------------------------------------------
Hacking the Code: ASP.NET Web Application Security http://www.hackingthecode.com
