1 / 32

Phoolproof Phishing Prevention

Phoolproof Phishing Prevention. Bryan Parno, Cynthia Kuo, Adrian Perrig Carnegie Mellon University. A Recent Email…. Images from Anti-Phishing Working Group’s Phishing Archive. Images from Anti-Phishing Working Group’s Phishing Archive. The next page requests:. Name Address Telephone

alicia
Download Presentation

Phoolproof Phishing Prevention

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Phoolproof Phishing Prevention Bryan Parno, Cynthia Kuo, Adrian Perrig Carnegie Mellon University

  2. A Recent Email… Images from Anti-Phishing Working Group’s Phishing Archive

  3. Images from Anti-Phishing Working Group’s Phishing Archive

  4. The next page requests: • Name • Address • Telephone • Credit Card Number, Expiration Date, Security Code • PIN • Account Number • Personal ID • Password

  5. Images from Anti-Phishing Working Group’s Phishing Archive

  6. But wait… WHOIS 210.104.211.21: Location: Korea, Republic Of Even bigger problem: I don’t have an account with US Bank! Images from Anti-Phishing Working Group’s Phishing Archive

  7. Phishing: A Growing Problem • Over 16,000 unique phishing attacks reported in Nov. 2005, about double the number from 2004 • Estimates suggest phishing affected 1.2 million US citizens and cost businesses billions of dollars in 2004 • Additional losses due to consumer fears [Anti-Phishing Working Group, Phishing Activity Trends Report, Dec. 2005]

  8. Outline • Introduction • Current Antiphishing Approaches • Goals & Design Principles • Phoolproof Phishing Prevention • Security Analysis • Implementation

  9. Outline • Introduction • Current Antiphishing Approaches • Heuristics • Modified Passwords • Origin Authentication • Goals & Design Principles • Phoolproof Phishing Prevention • Security Analysis • Implementation

  10. Current Approaches • Heuristics • Spoofguard [Chou et al. 2004], TrustBar [HerzGbar 2004], eBay toolbar, SpoofStick • Recent studies indicate users ignore toolbar warnings [Wu et al. 2005]

  11. username, one-time password username, one-time password Current Approaches • Modified Passwords • Single Sign-On • Requires users to trust one institution with all of their passwords • Still faces an authentication problem • PwdHash [Ross et al. 2005] • Promising approach, but vulnerable to pharming, DNS spoofing, and dictionary attacks • One-time passwords (e.g., scratch cards, RSA SecurID) • Vulnerable to active MitM attacks (already seen in the wild) Withdraw $$$$$

  12. Current Approaches • Origin Authentication • Dynamic Security Skins [DhamTyga 2004], Passmark, and the Petname project • All rely on user diligence – a single mistake will result in a compromised account

  13. Key Insight • Security must not depend entirely on fallible users • System must be secure by default • Design must be robust to user error

  14. Outline • Introduction • Phishing Techniques • Current Antiphishing Approaches • Goals & Design Principles • Phoolproof Phishing Prevention • Security Analysis • Implementation

  15. Phishing Prevention Goals • Ideal: User’s data only reaches intended recipient • Practical: Prevent a phisher from viewing or modifying a user’s accounts • Reduce the power of attacks to that of pre-Internet scams • E.g., an attacker can still subvert a company insider

  16. Contributions • Plan for human errors by guarding users’ accounts even when they make mistakes • Use a mobile device to establish an authenticator the user cannot readily disclose • Protect against active Man-in-the-Middle attacks • Defend against keyloggers • Develop a prototype implementation

  17. Design Principles • Sidestep the arms race • Incremental solutions provoke adaptations • Provide mutual authentication • Phishing exploits two authentication failures: Server to User and User to Server • Reduce reliance on users • Users are unsuited to authenticating others or themselves to others • We cannot rely on perfect user behavior • Avoid dependence on browser interface • Readily spoofed and distrusted by users

  18. Outline • Introduction • Phishing Techniques • Current Antiphishing Approaches • Goals & Design Principles • Phoolproof Phishing Prevention • Security Analysis • Implementation

  19. Phoolproof Prevention Overview • Mobile device creates a public key pair for each site • Transmits public key to the server • To access the site, the mobile device uses the private key to authenticate to the server • Assists browser in establishing SSL/TLS session • Server refuses access unless client can provide user’s password and the mobile device authenticates properly

  20. User Experience • Setup • Login to the institution’s website • Select Phoolproof Phishing Setup • Confirm installation on device • Use • Select secure bookmark on device • Login to the website

  21. Establish SSL Connection User Information PubKS <!-- ACCOUNT_CREATE --> Domain, Site Name PubKj PubKj Basic Phoolproof Setup

  22. Advanced Phoolproof Setup • For additional security, establish a shared secret via a trusted side-channel • Mail a nonce (or barcode) to address on file • Display a barcode at an ATM • Setup in person • Trusted financial institutions could provide setup for companies without a storefront • The problem of properly identifying new customers predates the Internet • Existing research can help secure setup

  23. URL S T A N D A R D S S L Hello Messages DHs, SigS(DHs) PubKS PubKS PubKj PubKj h = H(MS || prev msgs) SigPrivKj(h) DHc, SigPrivKj(h) Phoolproof Connection Establishment

  24. Outline • Introduction • Phishing Techniques • Current Antiphishing Approaches • Goals & Design Principles • Phoolproof Phishing Prevention • Security Analysis • Implementation

  25. Security Analysis • Hijacking account setup • Users must authenticate site and vice versa (only once/site) • Users are at their most alert • Advanced setup precludes most attacks • Theft (or loss) of the mobile device • Thief still needs the user’s password • Device may require pin or biometric verification • Users can call companies to revoke their keys (like credit cards) • Malware on the mobile device • Standard security solutions (e.g., antivirus, firewalls) • Trusted hardware (e.g., TPMs) • Mutual software attestation

  26. Security Analysis • Malware on the computer • Standard keylogger fails, since it only obtains password • Compromise of the browser or the operating system is still a problem • Attacks on the network • Our system is immune to Man-in-the-Middle attacks, pharming attacks, and domain hijacking • Local attacks on Bluetooth • Phishing relies on large-scale attacks, not local attacks • Attacker still lacks user’s password, so account is secure • Existing research [McCune et al. 2005] demonstrates how to establish a secure channel

  27. Outline • Introduction • Phishing Techniques • Current Antiphishing Approaches • Goals & Design Principles • Phoolproof Phishing Prevention • Security Analysis • Implementation

  28. Implementation: Minimal infrastructure • Mobile device: Nokia Smartphone • Coded in Java for portability to other cellphones, PDAs, etc. • Small patch to Firefox • Detects account setup tag • Modifies SSL establishment • Server changes are minimal for IIS, Apache and Apache-SSL • For Apache 2.0: SSLVerifyClient none SSLOptions • Plus two short perl scripts

  29. Implementation: Performance 20 Trials

  30. Conclusions • Phishing is a growing problem, and attacks will only become more sophisticated • We should avoid relying on perfect user behavior • Instead, we use cryptographic techniques to protect even fallible users • Our implementation demonstrates the feasibility of phoolproof phishing prevention

  31. Thank you! parno@cmu.edu

More Related