PORTIA Project 1 Mitigating Online ID Theft: Phishing and Spyware Students:Blake Ross, Collin Jackson, Nick Miyake, Yuka Teraguchi, Robert Ladesma, Andrew.

1

PORTIA Project

Mitigating Online ID Theft:Phishing and Spyware

Students: Blake Ross, Collin Jackson, Nick Miyake,

Yuka Teraguchi, Robert Ladesma,

Andrew Morrison

Faculty: Dan Boneh and John Mitchell

Special thanks to the SF-ECTF and SS.

2

Sample phishing email

3

Sample phishing sitehttp://202.69.39.30/snkee/....

4

Magnitude of problem

Fastest growing crime on the Internet.

Trends: keyloggers from phishing sites.

http://www.antiphishing.org

2004-5 Mar Feb Jan … July Jan

spoofs/ month

2870 2686 2602 … 1634 113

# targets 78 68 64 … 13 7

March, 05:

80% at 8 brands, average uptime 5.8 days, 81% of targets are financial

5

What can we do about phishing?

Spam filter:•Phishing starts with email, so stop it there.•Non-trivial: phishing emails look like ordinary

email.

Client-side methods:•Anti-phishing using browser plug-ins.•Anti-spyware using Virtual Machine Monitors.

Server-side methods:•Personalized web pages.• Improved user authentication (e.g. tokens or certs).

6

PORTIA ID Protection Work

Long term effort to develop online ID protection tools.

SpoofGuard: (NDSS ’04)• Alerts user when browser is viewing a spoofed web page.• Uses variety of heuristics to identify spoof pages.• A new type of anomaly detection problem.

PwdHash: (Usenix Sec ’05)

• Simple mechanism for strengthening password web auth.

SpyBlock: (under development)

• A Virtual Machine (VM) approach to SpyWare defense.

7

PORTIA Project

1. SpoofGuard:Detect Phishing Web Sites

http://crypto.stanford.edu/SpoofGuard

8

SpoofGuard Browser Plug-in

Compute spoof index: •Weighted sum of several spoof measures•Depends on current page and browsing history

Provides two forms of information:•Passive alerts in toolbar.•Active blocking when necessary.

Challenges: •Must be easy for novice users.•Detect malicious pages yet minimize false

alarms.

9

Sample Heuristics

History Check:•Site is assumed OK if in user’s history list.

Domain Check:•Check similarity to domain in history list.

Email Check:•Suspicious if page is reached by following email

link

Impact:• Ebay toolbar, Yahoo! toolbar, WholeSecure

•Multiple requests for Firefox support.

10

Current/future work

SpamAssassin extensions:•Download pages that URL’s in incoming email

point to.•Run SpoofGuard heuristics on downloaded

pages.

Spam archive scanning:•Automatic detection of new phishing sites.•www.spamarchive.org

11

PORTIA Project

2. PwdHash: Improved Pwd Mgmt

http://crypto.stanford.edu/PwdHash

12

Strengthen Web Pwd Auth

Current web auth: cleartext password over SSL• Vulnerable to phishing.• Vulnerable to break-ins at low security sites.

Simple improvement: Browser plug-in that converts a user’s pwd into a unique pwd per site:

1. Locate all pwd HTML elements on page:

2. When form is submitted replace all pwd’s by:PRFpwd(domain-name)

3. Phishing site only sees hash of Ebay password.

The challenge: Extremely hard to implement securelyin a modern browser!

13

PwdHash Challenges

1. Javascript attacks2. Pwd reset after plug-in install

3. Dictionary attacks (sol: EKE or SFE for equality test)

4. What salt to use in hash?

5. How to encode resulting hash?

6. Internet Café

Our design goal: transparent to user.

Impact: 1. Google: PhD intern.2. TIPPI working group: MS, Mozilla,

RSA

14

Javascript attacks

Phishing site can create Javascript to steal user’s unhashed password.

• Record all key-strokes sent to page

• Change target-domain-name on submit

• Mask regular text field as a password field

15

Javascript attacks (cont.)

Defense 1: Password prefix / Password key

•Ask user to start all passwords with “@@”

•Plus-in traps all keyboard events to window.

•When “@@” detected, replace subseq. keys with

‘%’– Browser never sees pwd.

•On ‘BeforeNavigate2’ event, replace ‘%%%’ in POST data with hashed pwd.

•Alert user if “@@” detected in key stream while focus not on pwd field.

16

Pwd Salting – an old idea

Hash pwd with realm provided by remote site:

•HTTP 1.1 Digest Authentication

•Kerberos 5

Hash pwd with network service name:

•Gabber, Gibbons, Mattias, Mayer [FC ’97].

Proxy.•Abadi, Bharat, Marais [PTO ’97]

Challenge: implementing securely in a modernbrowser.

17

PORTIA Project

SpyBlock

Spyware defense tool

Current work

18

SpyBlock design

Proxy VM keeps sensitive user info away from SpyWare.

User hits pwdkey before and after typing sensitive info.

VMWare ACE Server / Xen

Guest OS

Firefox Proxy VM

SpyW

are

apps

https page

PwdKey

KeysJunk

https

junkdata

19

Summary

Long term effort focused on ID protection tools.

Current tools: SpoofGuard, PwdHash,

Current/future work: SpyBlock

Strong focus on technology transfer:• Interns help do tech transfer.•Source code available on PORTIA web site.

Close collaboration with SF-ECTF.