Phishing Attack

CHAPTER 1 INTRODUCTION In the subject argona of computer warrantor, Phishing is the crimin anyy ambidextrous process of attempting to acquire sensitive culture such as practice sessionrnames, pass says and consultation f atomic recite 18 details, by masquerading as a trustworthy entity in an electronic communication. Phishing is a fraudulent electronic mail that attempts to shoot for you to divulge ad hominem data that great deal then be utilize for il decriminalize purposes. at that place be homophiley variations on this scheme. It is possible to Phish for other information in additions to handlingrnames and war crys such as credit rating waggle numbers, bank account numbers, affable protection numbers and mothers maiden names.Phishing presents shoot risks through the enjoyment of stolen credentials and indirect risk to institutions that conduct business on line through erosion of client confidence. The damage ca employ by Phishing ranges from denial of admi ssion price to e-mail to substantial financial loss. pic anatomy 1. 1 the simplify flow of information in a Phishing attack 1. A deceptive message is sent from the Phishers to the drug user. 2. A user provides confidential information to a Phishing server (normally after each(prenominal)(prenominal) interaction with the server). 3.The Phishers obtains the confidential information from the server. 4. The confidential information is used to impersonate the user. 5. The Phishers obtains illicit monetary gain. Steps 3 and 5 ar of interest primarily to law enforcement personnel to come upon and prosecute Phishers. The discussion of technology countermeasures go outinging oculus on ways to disrupt steps 1, 2 and 4, as well as related technologies extracurricular the information flow puritanical. CHAPTER 2 PHISHING TECHNIQUES Phishers use a wide variety of techniques, with one joint thread. affair MANIPULATIONMost methods of Phishing use nearly form of technical deception knowing to make a link in an e-mail appear to belong to the hoaxed organization. Misspelled uniform resource locators or the use of sub admitledge bases argon common tricks used by Phishers. In the following heavy example, http//www. yourbank. example. com/, it appears as though the URL will take you to the example section of the yourbank network identify actually this URL points to the yourbank (i. e. Phishing) section of the example vane locate. An old method of spoofing used links containing the symbol, in the first place intended as a way to include a username and cry. For example, http//www. oogle. emailprotected tripod. com/ might deceive a cursory observer into believing that it will open a page on www. google. com, whereas it actually directs the browser to a page on members. tripod. com, employ a username of www. google. com the page opens normally, regardless of the username supplied. 1 2 FILTER escape valve Phishers excite used images instead of text to m ake it harder for anti-Phishing filters to detect text comm only used in Phishing e-mails. wind vaneSITE FORGERY Once a victim visits the Phishing web web site the deception is non over. around Phishing scams use JavaScript commands in enounce to alter the address bar.This is done either by placing a picture of a legitimate URL over the address bar, or by closing the overlord address bar and opening a new one with the legitimate URL. pic Fig 2. 1 An website which does non shows real address bar telecommunicate PHISHING Messages that claimed to be from a bank told users to dial a promise number regarding problems with their bank accounts. Once the phone number (owned by the Phishers) was dialed, prompts told users to enter their account numbers and PIN. Vishing (voice Phishing) sometimes uses fake caller-ID data to give the appearing that calls come from a trusted organization. pic Fig 2. 2 How Phishing Attack ass take place CHAPTER 3 REASONS OF PHISHING Lets consider some of the reasons masses fall victim to Phishing scams. TRUST OF AUTHORITY When a Phishing email arrives marked as High Priority that curseens to close our bank account unless we update our data immediately, it engages the same billet response mechanisms that weve obeyed for millennia. In our modern culture, the old markers of authority physical strength, aggressiveness, ruthlessness leave largely habituated way to signs of economic power. Hes richer than I am, so he must be a punter man.If you equate market capitalization with GDP then Bank of America is the 28th most respectable country in the world. If you receive a ad hominem email purported to come from BOA questioning the hardness of your account data, you will baffle a healthy compulsion to respond, and respond quickly. TEXTUAL AND GRAPHIC intro LACKS TRADITIONAL CLUES OF VALIDITY Most concourse feel that they can tell an honest man by minding him in the eye. You can spot a professional panhandler forward he get s to the fourth leger in his spiel. Without clues from the verbal and physical realms, our ability to determine the validity of business transactions is diminished.This is a radix of the direct mail advertising business. If a piece of mail resembles some type of official correspondence, you argon much more likely to open it. Car dealers send sales flyers in manila envelopes stamped official Business that look like the envelopes tax refund checks are mailed in. Banks send credit card offers in large cardboard envelopes that are almost indistinguishable from FedEx overnight packages. Political advertisements are adorn with all manner of patriotic symbols to help us link the candidate with our nationalistic feelings.E-MAIL AND WEB PAGES CAN LOOK REAL The use of symbols laden with familiarity and repute lends legitimacy (or the illusion of legitimacy) to informationwhether faithful or fraudulentthat is placed on the imitating page. Deception is possible because the symbols that repr esent a trusted companion are no more real than the symbols that are reproduced for a fictitious troupe. Certain elements of dynamic web cognitive content can be difficult to copy directly precisely are ofttimes easy sufficiency to fake, especially when 100% accuracy is not required.Email messages are normally easier to replicate than web pages since their elements are predominately text or static HTML and associated images. Hyperlinks are easily subverted since the visible tag does not have to match the URL that your click will actually redirect your browser to. The link can look like http//bankofamerica. com/login but the URL could actually link to http//bankofcrime. com/got_your_login CHAPTER 4 ANTI PHISHING TECHNIQUES To counter the phishing threat, a number of anti-phishing solutions have been proposed, both by patience and academic world.The anti phishing techniques can in general be divided into three categories. 1. Spam Filters 2. Anti-phishing tool bars and 3. cry prot ection mechanism Spam Filters A class of anti-phishing approaches aims to solve the phishing problem at the email level. The key idea is that when a phishing email does not get at its victims, they cannot fall for the scam. Hence, filters and content analysis techniques are often used to attempt to identify phishing emails before these emails are delivered to users. Clearly, this line of research is closely related to anti-spam research 10.By continuously training filters (e. g. , Bayesian filters), a large number of phishing emails can be blocked. This is because such emails often contain words that whitethorn be identified as suspicious tokens that do not frequently occur in legitimate emails (e. g. , ? update? , ? login? , etc. ). The main disadvantage of anti-spam techniques is that their success depends on the availability of these filters and their proper training. That is, when the user does not actively help in training the filter, the filter typically does not perform as expected.Furthermore, til now when filters are trained well and a user rarely receives any spam or phishing emails, in one case a phishing email bypasses the filter, the users belief of the legitimacy of this mail is strengthened. Anti-Phishing Toolbars To identify a page as a phishing site, there are a variety of methods that can be used, such as white lists (lists of known safe sites), blacklists (lists of known fraudulent sites), various heuristics to see if a URL is quasi(prenominal) to a well-known URL, and community ratings. The toolbars examined here employ assorted combines of these methods.By using publicly uncommitted information provided on the toolbar download web sites as well as observations from using each toolbar we get a basic understanding of how each toolbar functions. Some of the toolbars that are used for anti-phishing are 1) eBay Toolbar The eBay Toolbar uses a combination of heuristics and blacklists. The toolbar too gives users the ability to report ph ishing sites, which will then be verified before being blacklisted. 2) GeoTrust TrustWatch Toolbar GeoTrusts web site provides no information or so how TrustWatch determines if a site is fraudulent however, it is fly-by-night that the company ompiles a blacklist that includes sites reported by users through a button provided on the toolbar. 3) Google Safe search Google provides the source code for the Safe Browsing feature and says that it checks URLs against a blacklist 4) McAfee SiteAdvisor SiteAdvisor claims to detect not scarce phishing websites, but any sites that send spam, offer downloads containing spyware, or engage in other similar noisome practices. The determination is made by a combination of automated heuristics and manual verification. 5) Microsoft Phishing Filter in Windows mesh ExplorerThis toolbar largely relies on a blacklist hosted by Microsoft. However, it also uses some heuristics when it encounters a site that is not in the blacklist. Users also have the option of using this feature to report suspected phishing sites 6) Netcraft Anti-Phishing Toolbar The Netcraft toolbar also uses a blacklist, which consists of fraudulent sites identified by Netcraft as well as sites submitted by users and verified by the company. The toolbar also displays a risk rating between one and ten as well as the hosting location of the site. pic Fig 4. 1 Netcraft Anti-Phishing Toolbar ) Netscape Browser 8. 1 It appears that the functionality of Netscape Browser relies solely on a blacklist, which is retained by AOL and updated frequently. When a suspected phishing site is encountered, the user is redirected to a built-in warning page. Users are shown the original URL and are considered whether or not they would like to proceed. 8) Spoofguard Spoofguard does not use white lists or blacklists. Instead, the toolbar employs a series of heuristics to identify phishing pages. 9) AntiPhish AntiPhish is an academic solution which keeps track of where sensitive i nformation is being submitted to. 0) Dynamic credential skins Dynamic security skins is also an academis solution which leave behind a remote server to prove its identity element in a way that is easy for humans to verify. Most of the tools that were tested used blacklists, but only half of them were able to identify the majority of phishing web sites. We dont know the size of the blacklists used by each toolbar, nor do we know what heuristics are used by any of the toolbars other than Spoofguard. We suspect that the toolbars that performed best use larger and more frequently updated black lists.They may also use heuristics that allow them to detect phishing sites that havent yet been put on the blacklist. The only toolbar known to make no use of blacklists was Spoofguard. While it was able to identify the majority of phishing sites using only heuristics, it still missed some phishing sites and it had a very high false positive rate. Spoofguard could potentially be improved throu gh the use of a whitelist, which would pr scourt the problems that occurred when phishing sites were visited before their corresponding legitimate sites.The whitelist would not necessarily need to be super large or updated frequently to be effective. Password egis Mechanism A tidings is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource. The watchword should be kept secret from those who are not allowed for access. So, the major concern for any user is to safeguard his/her password. The password can be cracked with the attacks such as Guessing attack, Brute-force attack, vocabulary attack, Phishing attack etc. ,. other problem regarding password is single password problem where the user uses a single password for both insecure sites and financial sites. The hackers can break into the vulnerable sites that simply stores username and password and apply those retrieved combination of username and password on high security sites such as banking sites. All these problems at a single stroke can be solved by hashing the curb password using scene of action name as key on client side. Some of the applications/tools that use this powerful technique are 1) Password Composer This extension 25 puts a tiny red icon to the left of a password entry field.If one clicks on this icon, the password field is overlaid with a replacement input, where one can ply a single, deposit password (Master Password). 2) Magic Password Generator This extension combines master password and the domain name of the site to make another(prenominal) unique password for that site. For advanced users, with a catchall address at a domain, just put example. com (whatever ones domain is) for the address, and MPWGen will make a different email for every site too. Alternately, use emailprotected and the value will be inserted after the + sign, for email accounts that clog this feature, like gmail. ) Password generator Password Ge nerator gets the hostname from the pages URL and mixes it together with ones personal master password using a little cryptographic magic MD5. It always gets the same issuing if given that hostname and master password, but will never get that result if either changes. 4) Hassapass Hasspass automatically generates strong passwords from a master password and a parameter like domain name. The password generation is performed inner(a) this very browser window in JavaScript 5) Genpass GenPass is a JavaScript/MD5 bookmarklet-based password generator. GenPass is no longer being updated. currently consider using SuperGenPass however, note that SuperGenPass is not compatible with GenPassgiven the same input, they generate different passwords. 6) Password Hasher When the master key is given to Password Hasher and it enters the hash word into the sites password field. A hash word is the result of scrambling the master key with a site tag. Click on a marker near to a password field or press the Control-F6 key combination when in a password field or choose Password Hasher from either the Tools menu or the right-click popup menu on a password field to enter the master key. ) Pwdhash Pwdhash is a browser extension that transparently converts a users password into a domain-specific password. The user can activate this hashing by choosing passwords that start with a special prefix () or by pressing a special password key (F2). Pwdhash automatically replaces the contents of these password handle with a one-way hash of the pair (password, domain-name). Based on the features like application type, hashing algorithm, security, password strength, spoof proof, visibility to webpage, visibility to user etc. Pwdhash is the best among the above mentioned applications. But some of its disadvantages are as follows a) Invisible to user Password hashing done by Pwdhash is invisible to user. If this extension stops working, user will not know somewhat this, i. e. , passwords will not be hashed. b) Visibility of activation to webpage Webpage gets the intimation about the activation of Pwdhash. This made Pwdhash vulnerable for JavaScript attacks. So webpage can put some labours to know the original master password. ) Password availability as plain text The master password is directly filled in password field given by webpage. i. e. , password is available in plain text. d) Easily spoof-able As activation is visible to webpage and by using Alexs corner method it is very easy to know the master password of user by fake webpage. e) Affect on others / Affecting webpage Pwdhash have some side-effects on websites. Any JavaScript attached with password fields will not work properly. For ex. keyPress event will not work properly. f) Not secure Finally, Pwdhash is not looking so secured. CHAPTER 5 ANTI-PHISHINGThere are some(prenominal) different techniques to combat Phishing, including legislation and technology created specifically to protect against Phishing. SOC IAL RESPONSES One schema for combating Phishing is to train people to recognize Phishing attempts, and to deal with them. Education can be effective, especially where training provides direct feedback. One newer Phishing tactic, which uses Phishing e-mails targeted at a specific company, known as Spear Phishing, has been harnessed to train individuals at various locations. deal can take steps to avoid Phishing attempts by slightly modifying their browsing habits.When contacted about an account needing to be verified (or any other topic used by Phishers), it is a raw precaution to contact the company from which the e-mail apparently originates to check that the e-mail is legitimate. Alternatively, the address that the individual knows is the companys genuine website can be typed into the address bar of the browser, rather than trusting any hyperlinks in the suspected Phishing message. just about all legitimate e-mail messages from companies to their customers contain an item of information that is not readily available to Phishers.Some companies, for example PayPal, always address their customers by their username in e-mails, so if an e-mail addresses the recipient in a generic fashion (Dear PayPal customer) it is likely to be an attempt at Phishing. E-mails from banks and credit card companies often include set offial account numbers. However, recent research has shown that the public do not typically distinguish between the first few digits and the last few digits of an account numbera material problem since the first few digits are often the same for all clients of a financial institution.People can be trained to have their suspicion aroused if the message does not contain any specific personal information. Phishing attempts in early 2006, however, used personalized information, which makes it unsafe to assume that the presence of personal information alone guarantees that a message is legitimate. Furthermore, another recent study concluded in scatte r that the presence of personal information does not significantly affect the success rate of Phishing attacks, which suggests that most people do not pay attention to such details.The Anti-Phishing Working Group, an industry and law enforcement association has suggested that customary Phishing techniques could become obsolete in the future as people are increasingly aware of the social engineering techniques used by Phishers. They predict that Pharming and other uses of malware will become more common tools for theft information. TECHNICAL RESPONSES Anti-Phishing measures have been implemented as features embedded in browsers, as extensions or toolbars for browsers, and as get going of website login procedures.The following are some of the main approaches to the problem. Helping to identify legitimate sites Most Phishing websites are secure websites, meaning that SSL with strong cryptography is used for server authentication, where the websites URL is used as identifier. The pro blem is that users often do not know or recognize the URL of the legitimate sites they intend to connect to, so that the authentication becomes meaningless. A condition for substantive server authentication is to have a server identifier that is meaningful to the user.Simply displaying the domain name for the visited website as some some anti-Phishing toolbars do is not sufficient. A better approach is the pet name extension for Firefox which lets users type in their own labels for websites, so they can afterward recognize when they have returned to the site. If the site is not recognized, then the software may either warn the user or block the site outright. This represents user-centric identity management of server identities. Some suggest that a graphic image selected by the user is better than a pet name Browsers alerting users to fraudulent websitesAnother popular approach to fighting Phishing is to maintain a list of known Phishing sites and to check websites against the li st. Microsofts IE7 browser, Mozilla Firefox 2. 0, and Opera all contain this type of anti-Phishing measure. Firefox 2 uses Google anti-Phishing software. Some implementations of this approach send the visited URLs to a central service to be checked, which has raised concerns about concealment. To mitigate the problem of Phishing sites impersonating a victim site by embedding its images (such as logos), several site owners have altered the images to send a message to the visitor that a site may be fraudulent.The image may be moved to a new filename and the original permanently replaced, or a server can detect that the image was not requested as part of normal browsing, and instead send a warning image. Augmenting password logins The Bank of Americas website is one of several that ask users to select a personal image, and display this user-selected image with any forms that request a password. Users of the banks online services are instructed to enter a password only when they see th e image they selected. However, a recent study suggests few users refrain from debut their password when images are absent.In addition, this feature (like other forms of two-factor authentication) is susceptible to other attacks. certificate skins are a related technique that involves overlaying a user-selected image onto the login form as a optical cue that the form is legitimate. Unlike the website-based image schemes, however, the image itself is shared only between the user and the browser, and not between the user and the website. The scheme also relies on a mutual authentication protocol, which makes it less vulnerable to attacks that affect user-only authentication schemes. 1 Eliminating Phishing mailSpecialized spam filters can precipitate the number of Phishing e-mails that reach their addressees inboxes. These approaches rely on machine learning and natural language processing approaches to classify Phishing e-mails. 2 monitor and takedown Several companies offer banks a nd other organizations likely to suffer from Phishing scams round-the-clock services to monitor, analyze and assist in shutting down Phishing websites. Individuals can contribute by reporting Phishing to both volunteer and industry groups, such as PhishTank. LEGAL RESPONSES On January 26, 2004, the U.S. Federal Trade Commission filed the first lawsuit against a suspected Phisher. The defendant, a Californian teenager, allegedly created a webpage designed to look like the America Online website, and used it to steal credit card information. In the United States, Senator Patrick Leahy introduced the Anti-Phishing Act of 2005. Companies have also joined the effort to crack down on Phishing. CHAPTER 6 HOW ANTI-PHISHING SOFTWARE WORKS Anti-phishing software consists of computer programs that attempt to identify phishing content contained in websites and e-mail.It is often integrated with web browsers and email clients as a toolbar that displays the real domain name for the website the v iewer is visiting, in an attempt to prevent fraudulent websites from masquerading as other legitimate web sites. Anti-phishing functionality may also be included as a built-in capability of some web browsers Common phishing play take advantage of a visitor by requesting them to link out to another site, asking that the enter personal information and passwords, or redirecting them to another site completely for registration.The process usually begins by sending out a forged e-mail that looks like it was sent from the company. Some tactics include saying an account has expired and needs to be updated, or has experienced unauthorized use and needs to be verified. Many banking and financial institutions become targets for these types of scams, and they can be a considerable threat to millions of account holders and users. Many leading web browsers and software programs have realized the impact of this trend, and have created programs that can limit the frequency of these types of scams .Micirosoft Windows Internet Explorer 7, Firefox 2. 0, Google Safe Browsing, and Earthlink ScamBlocker are just a few programs that have reduced the risks involved. In Firefox 2. 0, Phishing Protection is always turned on and checks the sites automatically for any potential risks or hazards. The list is reviewed on a regular basis, and can be configured to Firefox Security settings for maximum control. When Phishing Protection in enabled, the sites are downloaded into a list and checked for any anti-phishing services.A warning sign will appear if any suspicious activity is detected. The Netcraft toolbar makes use of a risk rating system, allowing you the option of entering a password (or not). TrustWatch makes the Internet Explorer toolbar, and can help validate a Web site and provide a site report when needed. This option also allows you to review all suspected sites and palpate out which ones use SSL technology. Earthlink Toolbar with ScamBlocker will verify any popup messages th at you may encounter as you visit a site, and can help you find out all the details on current phishing scams.Anti-phishing software is designed to track websites and monitor activity any suspicious behaviour can be automatically reported, and even reviewed as a report after a period of time. Anti-phishing toolbars can help protect your privacy and reduce the risk of landing at a false or insecure URL. Although some people have concerns over how valuabe anti-phishing software and toolbars may be, security threats can be reduced considerably when they are managed by the browser program.Other companies that are trained in computer security are analyse other ways to report phishing issues programs are being designed that can analyze web addresses for fraudulent demeanour through new tactics, and cross-checking domain names for validity. The best and in most using Anti-Phishing packet is Netcraft Anti-Phishing Toolbar Netcraft is an Internet Services Company located in the United Kin gdom and is devoted to tracking online technology. Additionally, Netcraft has actively taken up the sole of patrolling the cyberspace to sniff out phishing emails.The antiphising toolbar from Netcraft not only protects you and your savings from phishing attacks but also lets you check the hosting location and Risk military rating of every site you visit. Once you download and position the toolbar, you join a giant neighbourhood watch scheme whose most alert and most technological members defend everyone in the community against phishing frauds. This antiphishing group working to protect you is one of the finest ways to fight phishing. This could be downloaded through internet pic pic Fig 6. 1 Downloading Netcraft anti-phishing tool barCHAPTER 7 ADVANTAGES AND DISADVANTAGES OF USING ANTI-PHISHING Advantages Protect your savings from Phishing attacks. When a Phishing website or phishing email appears it will informs to the user. Some Anti-Phishing softwares also allows seeing the hosting location and Risk Rating of every site you visit. Anti-phishing software is designed to track websites and monitor activity any suspicious behavior can be automatically reported and even reviewed as a report after a period of time Disadvantages No single technology will completely stop phishing.So Phishing attacks can not be completely stopped Even Anti-Phishing softwares should be upgraded with respect to the Phishing attacks. CHAPTER 8 FEW SNAPSHOTS OF PHISHING WEBSITES pic Fig 8. 1 Phishing Peoples Bank Web site pic pic Fig 8. 2 Phishing US Bank Web site CONCLUSION No single technology will completely stop phishing. However, a combination of good organization and practice, proper application of current technologies, and improvements in security technology has the potential to drastically reduce the prevalence of phishing and the losses suffered from it.In particular High-value targets should follow best practices and keep in touch with chronic evolution of them. Phish ing attacks can be detected rapidly through a combination of customer reportage, reflect monitoring, image use monitoring, honeypots and other techniques. Email authentication technologies such as Sender-ID and cryptographic signing, when widely deployed, have the potential to prevent phishing emails from reaching users.Analysis of imagery is a promising electron orbit of future research to identify phishing emails. Personally identifiable information should be included in all email communications. Systems allowing the user to enter or select customized text and/or imagery are particularly promising. Browser security upgrades, such as distinctive display of potentially deceptive content and providing a warning when a potentially unsafe link is selected, could substantially reduce the efficacy of phishing attacks.Anti-phishing toolbars are promising tools for identifying phishing sites and heightening security when a potential phishing site is detected. Detection of outgoing confid ential information, including password hashing, is a promising area of future work, with some technical challenges. BIBLIOGRAPHY 1 http//en. wikipedia. org/ 2 http//webopedia. com/ 3 http//computerworld. com/ 4 http//www. anti-phishing. info/ 5 http//lorrie. cranor. org/ Not the real address bar Not the proper domain for peoples. com