A Technical Seminar Report On

PHISHING
Submitted to JNTUK, Kakinada in partial fulfillment of the requirement for award of
the degree of Bachelor Of Technology in department of Computer Science & Engineering

Submitted By K.NIRMALA 07A41A0529

DEPARTMENT OF COMPUTER SCIENCE & ENGINEERING

LOYOLA INSTITUTE OF TECHNOLOGY AND MANAGEMENT

Affiliated JNTUK, Kakinada DHULIPALLA-522 403, Guntur Dist. Academic Year 2010-11

LOYOLA INSTITUTE OF TECHNOLOGY AND MANAGEMENT

(Affiliated JNTUK, Kakinada) Dhulipalla 522 403, Guntur Dist.

Department of Computer Science & Engineering

CERTIFICATE

This is to certify that K.Nirmala(Regd. No.07A41A0529 ) have prepared a technical seminar report entitled PHISHING as a partial fulfillment for the award of the degree of B.Tech in Computer Science & Engineering. He worked for a period of one semester under our supervision.

Sri.Y.Suresh Asst.Professor Technical Seminar Supervisior Computer science and Engineering

Sri K.Ramesh Associate Professor Head of the Department Computer science and Engineering

ABSTRACT
In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic attempting to acquire sensitive information such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication. Phishing is a fraudulent e-mail that attempts to get you to divulge personal data that can then be used for illegitimate purposes. There are many variations on this scheme. It is possible to Phish for other information in additions to usernames and passwords such as credit card numbers, bank account numbers, social security numbers and mothers maiden names. Phishing presents direct risks through the use of stolen credentials and indirect risk to institutions that conduct business on line through erosion of customer confidence. The damage caused by phishing ranges from denial of access to e-mail to substantial financial loss. This report also concerned with anti-phishing techniques. There are several different techniques to combat phishing, including legislation and technology created specifically to protect against phishing. No single technology will completely stop phishing. However a combination of good organization and practice, proper application of current technologies and improvements in security technology has the potential to drastically reduce the prevalence of phishing and the losses suffered from it. Anti-phishing software and computer programs are designed to prevent the occurrence of phishing and trespassing on confidential information. Anti-phishing software is designed to track websites and monitor activity; any suspicious behavior can be automatically reported and even reviewed as a report after a period of time. This also includes detecting phishing attacks, how to prevent and avoid being scammed, how to react when you suspect or reveal a phishing attack and what you can do to help stop phishers.

Contents
1. 2. 3. 4. 5. 6. Introduction Phishing Techniques Phishing Examples Reasons Of Phishing Damages Caused By Phishing Anti-Phishing Techniques 6.1 Social Responses 6.2 Technical Responses 6.3 Legal Responses 7. Defend Against Phishing Attacks 7.1 Preventing A Phishing Attack Before It Begins 7.2 Detecting A Phishing Attack 7.3 Preventing The Delivery Of Phishing Messages 7.3.1 7.3.2 Filtering Authentication 9 1 2 3 5 6 6

7.4 Preventing Deception In Phishing Messages And sites 7.4.1 7.4.2 Signing Personally Identifiable Information

7.5 Counter Measures 7.5.1 7.5.2 7.5.3 8. 9. 10. 11. Interfering With The Call To Action Interfering With Transmission Of Confidential Data Interfering With The Use Of Compromised Information 16 17 19 21

Solution To Cross-Site Scripting Problem Anti-Phishing Software Conclusion References

LIST OF FIGURES

1.1 3.1 3.2 7.1 7.2 7.3

Simplified Flow Of Information In a Phishing Attack Example of Phishing Email Msg Example of Masked Web Address Example of Uploaded Picture of a Canadian Penny Example of Forgery Deceptive Mail Example Of Warning About Unsafe

1 4 4 12 12 13

1. Introduction
In the field of computer security, Phishing is criminally fraudulent process to acquire sensitive information such as passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication. Phishing is a fraudulent e-mail that attempts to get you to divulge personal data that can then be used for illegitimate purposes. There are many variations on this scheme. It is possible to Phish for other information in additions to usernames and passwords such as credit card numbers, bank account numbers, social security numbers and mothers maiden names. Phishing presents direct risks through the use of stolen credentials and indirect risk to institutions that conduct business online through erosion of customer confidence. The damage caused by the Phishing ranges from denial of access to e-mail to substantial financial loss. This report also concerned with antiPhishing techniques. There are

completely stop Phishing. However a combination of good organization and practice, proper application of current technologies & improvements in security technology has the potential to drastically reduce the prevalence of Phishing and the losses suffered from it. Anti-Phishing software and computer programs are designed to prevent the occurrence of Phishing and trespassing on confidential information. Anti-Phishing software is designed to track websites and monitor activity; any suspicious behavior can be automatically reported and even reviewed as a report after a period of time. This includes detecting Phishing attacks, how to prevent and avoid being scammed, how to react when you suspect or reveal a Phishing attack and what you can do to help stop Phishers. The simplified flow of information In a phishing attack is

several different techniques to combat phishing including legislation, technology created specifically to protect against phishing. No single technology will 1
Figure 1.1

1. A deceptive message is sent from the Phishers to the user. 2. A user provides confidential information to a phishing server (Normally after some interaction with the server). 3. The phishers obtains the confidential information from the server. 4. The confidential information is used to impersonate the user. 5. The phishers obtains illicit monetary gain. Steps 3 and 5 are of interest primarily to law enforcement personnel to identify and prosecute Phishers.

points to the "your bank" (i.e. Phishing) section of the example website. An old method of spoofing used links containing the @ symbol, originally intended as a way to include a username and password. For example, http://www. [email protected]/ might deceive a casual observer into believing that it will open a page on www.google.c om,whereas it actually directs the browser to a page on members.tripod.com, using a username of www.google.com: the page open normally, regardless of the

username supplied.

2.2 Filter Evasion

Phishers have used images instead of text to make it harder for antiPhishing filters to detect text commonly used in Phishing e-mails.

2. Phishing Techniques
Phishers use a wide variety of techniques, with one common thread.

2.1 Link Manipulation

Most methods of Phishing use form of technical deception designed to make a link in an e-mail appear to belong to the spoofed organization. Misspelled URLs or the use of sub domains are common tricks used by Phishers. In the following example http://www. your bank .example.com/ It appears as though the URL will take you to the example section of the your bank website; actually this URL

2.3 Website forgery

Once a victim visits the Phishing website the deception is not over. Some Phishing scams use JavaScript commands in order to alter the address bar. This is done either by placing a picture of a legitimate URL over the address bar or by closing the original address bar and opening a new one with the legitimate URL.

2.4 Phone Phishing

Messages that claimed to be from a bank told users to dial a phone number regarding problems with bank accounts. Once the phone number (owned by the Phishers) was dialed, prompts told users to enter their account numbers and pin. Vishing (voice Phishing) sometimes uses fake caller-ID data to give the appearance that calls come from trusted Organization

attack. Warning users of the possibility of phishing attacks, as well as providing links to sites explaining how to avoid or spot such attacks are part of what makes the Phishing email so deceptive. In this example, the Phishing email warns the user that emails from PayPal will never ask for sensitive information. True to its word, it instead invites the user to follow a link to "Verify" their account; this will take them to a further Phishing website, engineered to look like PayPal's website,

3. Phishing Examples
3.1 PayPal Phishing
In an example PayPal phish, spelling mistakes in the e-mail and the presence of an IP address in the link are both clues that this is a Phishing attempt. Another give away is the lack of a personal greeting, although the presence of communication will always greet the user with his or her real name, not just with generic greeting like "Dear Account holder." Other signs that the message is a fraud are misspellings of simple words, bad grammar and threat of consequences such as account suspension if recipient fails to comply with message's requests. Note that many Phishing emails will include,a real email from PayPal would, large warnings about never giving out your password in case of a Phishing 3

and will there ask for their sensitive information.

3.2 Rapid Share Phishing

On the Rapid Share web host, Phishing is common in order to get a premium account, which removes speed caps on downloads, auto-removal of uploads, waits on downloads, and cool down times between the downloads. Phishers will obtain premium accounts for Rapid Share by posting at warez sites with links to files on Rapid Share. However, using link aliases like Tiny URL, they can disguise the real page's URL, which is hosted somewhere else and is a look-a-like of Rapid Shares "free user or premium user" page. If the victim selects free user, the Phishers just

passes them along to the real Rapid Share site. But if they select premium, then the Phishing site records their login before passing them to the download. Thus the Phishers has lifted the premium account information from the victim.

Example of a Phishing e-mail msg which includes a deceptive Web addresses that links to a scam Web site. To make these Phishing e-mail messages look even more legitimate, the scam artists may place a link in them that appears to go to the legitimate Web site (1), but actually takes you to a phony scam site (2) or possibly a pop-up window that looks exactly like the official site. Phishing links that you are urged to click in e-mail messages, on Web sites, or even in instant messages may contain all or part of a real companys name and are usually

3.3 Examples of Phishing E-mails

Phishing e-mail messages take a number of forms. They might appear to come from bank or financial institution, a company you regularly do business with, such as Microsoft, or from your social networking site. The main thing Phishing e-mail messages ask for the personal data, or direct you to Web sites or phone numbers to call where they ask you to provide personal data. The following is an example of what a Phishing scam in an e-mail message might look like.

masked, meaning that the link you see does not take you to that address but somewhere different, usually an

illegitimate Web site. Notice in the following example that resting (but not clicking) the mouse pointer on the link reveals the real Web address, as shown in the box with the yellow background. The string of cryptic numbers looks nothing like company's Web address, which is a suspicious sign. Example of a masked Web address

Figure 3.2 Figure 3.1

4. Reasons of Phishing
Consider some of the reasons people fall victim to Phishing scams.

word in his spiel. Without clues from the verbal and physical realms, our ability to determine the validity of business transactions is diminished. This is a cornerstone of the direct mail advertising business. If a piece of mail resembles some type of official correspondence, you are much more likely to open it. Car dealers send sales flyers in manila envelopes stamped Official Business that look like the envelopes tax refund checks are mailed in. Banks send credit card offers in large cardboard envelopes that are almost indistinguishable from Fed Ex overnight packages. Political advertisements are adorned with all manner of patriotic symbols to help us link the candidate with our nationalistic feelings.

4.1 Trust of Authority

When a Phishing email arrives marked as High Priority that threatens to close our bank account unless we update our data immediately, it engages the same authority response mechanisms that we've obeyed for millennia. In our modern culture, the old markers of authority physical strength, aggressiveeness, and ruthlessness have largely given way to signs of economic power. He's richer than I am, so he must be a better man. If you have to equate market capitalization with GDP then Bank of America is the 28th most powerful country in the world. If you receive a personal email purported to come from BOA questioning the validity of your account data, you will have a strong compulsion to respond, and respond quickly.

4.3 E-mail and web pages can look real

The use of symbols laden with familiarity and repute lends legitimacy (or illusion of legitimacy) to information whether accurate or fraudulent that is placed on the imitating page. Deception is possible because the symbols that represent a trusted company are no more 'real' than the symbols that are

4.2 Textual and Graphic Presentation Lacks Clues of Validity

Most people feel that they can tell an honest man by looking him in the eye. You can spot a professional panhandler before he gets to the fourth 5

reproduced for a fictitious company. Certain elements of dynamic web

content can be difficult to copy directly but are often easy enough to fake, especially when 100% accuracy is not required. Email messages are usually easier to replicate than web pages since their elements are predominately text or static HTML and associated images. Hyperlinks are easily subverted since the visible tag does not have to match the URL that your click will actually redirect your browser to. The link can look like http://bankofamerica.com/login but the URL could actually link to http://bankofcrime.com/got_your_login

may use a person's details to create fake accounts in a victim's name. They can then ruin the victims' credit, or even deny the victims access to their own accounts. It is estimated that between May 2004 and May 2005 approximately 1.2 million computer users in the United States suffered losses caused by

Phishing approximately US$929 million

6. ANTI-PHISHING TECHNIQUES
There are several different techniques to combat Phishing including legislation and technology created to protect against Phishing.

5. DAMAGES CAUSED BY PHISHING

The damage caused by Phishing ranges from denial of access to e-mail to substantial financial loss. This style of identity theft is becoming more popular, because of the readiness with which unsuspecting personal people often to divulge Phishers,

6.1 Social Responses

`One strategy for combating Phishing is to train people to recognize Phishing attempts, and to deal with them. Education can be effective,

especially where training provides direct feedback. One newer Phishing tactic, which uses Phishing e-mails targeted at a specific company, known as Spear Phishing, has been harnessed to train individuals at various locations. People can take steps to avoid Phishing attempts by slightly modifying their browsing habits. When contacted about an account 6

information

including credit card numbers, social security numbers, and mothers' maiden names. There are also fears that identity thieves can add such information to the knowledge they gain simply by

accessing public records. Once this information is acquired, the Phishers

needing to be "verified" (or any other topic used by Phishers), it is a sensible precaution to contact the company from which the e-mail apparently originates to check that the e-mail is legitimate. Alternatively, the address that the

their suspicion aroused if the message does not contain any specific personal information. Phishing attempts in early 2006, however, used personalized

information, which makes it unsafe to assume that the presence of personal information alone guarantees a message, is most legitimate. Furthermore, another recent study concluded in part that the presence of personal information does not significantly affect the success rate of Phishing attacks, which suggests that most people do not pay attention to such details. The Anti-Phishing Working Group, an industry and law enforcement association has suggested conventional Phishing techniques could become

individual knows is the company's genuine website can be typed into the address bar of the browser, rather than trusting any hyperlinks in the suspected Phishing message. Nearly all the legitimate e-mail messages from companies to their customers who contain an item of information that is not readily available to Phishers. Some of the companies, for example PayPal, always address their customers by their username in e-mails, so if an e-mail addresses the recipient in a generic fashion ("Hello Dear PayPal customer") it is likely to be an attempt at Phishing. E-mails from banks and credit card companies often include partial account numbers. However, recent

obsolete in the future as people are increasingly awareness of the social engineering techniques used by Phishers. They predict that Pharming and other uses of malware will become more common tools for stealing information.

6.2 Technical Responses

Anti-Phishing measures have been implemented as features embedded in browsers, as extensions or toolbars for browsers, and as part of website login procedures. The following are some of the main approaches to the problem.

research has shown that the public do not typically distinguish between the first few digits and the last few digits of an account number a significant problem since the first few digits are often the same for all clients of a financial institution. People can be trained to have 7

6.2.1 Helping to Identify Legitimate Sites Most Phishing websites are

websites against the list. Microsoft's IE7 browser, Mozilla Firefox 2.0, and Opera all contain this type of anti-Phishing measure. Firefox 2 uses Google antiPhishing software some implementation of this approach sends the visited URLs to a central service to be checked, which has raised concerns about privacy. To mitigate the problem of Phishing sites impersonating victim site by embedding its images (such as logos), several site owners have altered the images to send a message to the visitor that a site may be fraudulent. The image may be moved to a new filename and the original

secure websites, meaning that SSL with strong cryptography is used for server authentication, where the website's URL is used as identifier. The problem is that users often do not know or recognize the URL of the legitimate sites they intend to connect to, so that the authentication becomes meaningless. A condition for meaningful server authentication is to have a server to identifier the user. that is

meaningful

Simply

displaying the domain name for the visited website as some anti-Phishing toolbars do is not sufficient. A better approach is the pet name extension for Firefox which lets users type in their own labels for websites, so they can later recognize when they have returned to the site. If the site is not recognized, then the software may either warn the user or block the site outright. This represents user-centric identity management of server identities. 6.2.2 Browsers Alerting the Users to Fraudulent Websites Another popular approach to fighting Phishing is to maintain a list of known Phishing sites and to check 8

permanently replaced, or a server can detect that the image was not requested as part of normal browsing, and instead send a warning image. 6.2.3 Augmenting Password Logins The Bank of America's website is one of several that ask users to select a personal image, and display this userselected image with any forms that request a password. Users of the bank's online services are instructed to enter a password only when they see the image they selected. However, a recent study suggests few users refrain from entering their password when images are absent. In addition, this feature (like other forms

of 2 factor authentication) is susceptible to other attacks.Security skins are a related technique involves overlaying a user-selected image onto the login form as visual cue that the form is legitimate. Unlike the website-based image schemes however, the image itself is shared only between the user and the browser, and not between the user and the website. The scheme also relies on a mutual authentication protocol, which makes it less vulnerable to attacks that affect user-only authentication schemes. 6.2.4 Eliminating Phishing Mail Specialized spam filters can

6.3 Legal Responses

On January 26, 2004, the U.S. Federal Trade Commission filed the first lawsuit against a suspected Phisher. The defendant Californian teenager allegedly created a webpage designed to look like the America Online website, and used it to steal credit card information. In the United States, Senator Patrick Leahy introduced the Anti-Phishing Act of 2005. Companies have also joined the effort to crack down on Phishing.

7. Defenses against the Phishing Attacks

7.1 Preventing a phishing Attack before It Attacks
A Phisher must set up a domain to receive phishing data. Preemptive

reduce the number of Phishing e-mails that reach their addresses inboxes. These approaches rely on machine learning and natural language processing approaches to classify Phishing e-mails. 6.2.5. Monitoring and Takedown Several companies offer banks and other organizations likely to suffer from Phishing scams round-the-clock services to monitor, analyze and assist in shutting down Phishing websites. Individuals can contribute by reporting Phishing to both volunteer and industry groups, such as Phish Tank.

domain registration may reduce the availability of deceptively named

domains. Additionally, proposal have been made to institute a holding period for new domain registration during which trademark holders could object to a new registration before it was granted. This might help with the problem of deceptively named domains, but would not address the ability of phishers to impersonate sites. As these most email authentication 9 technologies become

more widespread; email authentication could become a valuable preventive measure by preventing forged or

Knowing when an attack is underway can be valuable, in that it may permit a targeted institution to procedural counter measures, initiate an investigation with law enforcement, and staff up for the attack in a timely manner.

misleading email return addresses. Some services attempt to search the web and identify new phishing sites before they go live, but phishing sites may not be accessible to search spiders, and do not need to be up for long, as most of the revenues are gained in the earliest

7.3 Preventing the Delivery of the Phishing Messages

Once a phishing attack is under way, the first opportunity to prevent a phishing attack is to prevent a phishing message from ever reaching a user. 7.3.1 Filtering Email filters intended to combat spam are often effective in combating phishing as well. Signature-based antispam filters may be configured to identify messages specific and known phishing from

7.2 Detecting a Phishing Attack

Many different technologies may be employed to detect a phishing attack, including: Providing a spoof reporting E-mail address that customers may send spoof emails to. This may both provide feedback to customers on whether communications legitimate and provide warning that an attack is underway. Monitoring bounced email messages. Many Phishers email bulk lists that include nonexistent email addresses, using return addresses belonging to the targeted institution Establishing the honey pots over networks and monitoring for email purporting to be from the institution. There are contractors that will perform many of these services. 10

prevent

them

reaching a user. Statistical or heuristic anti-spam filters may be partially

effective against phishing, but to the extent that a phishing message resembles a legitimate message, there is a danger of erroneously blocking legitimate email if the filter is configured to be sufficiently sensitive to identify phishing email. Phishers depend on being able to make their messages visually appear to be from a trusted sender. One possible countermeasure is to detect unauthorized

imagery in emails. There are many countermeasures that Phishers may

phishing. For the potential value to be realized, Sender-ID a similar technology must become sufficiently widespread that invalid messages can be summarily deleted otherwise treated prejudicially, and security issues surrounding the use of mail forwarders need to be resolved.

employ against a image comparison, including displaying many tiled smaller images as a single larger image, and stacking up transparent images to create a composite image. This means that imagery should be fully rendered before analysis. An area of future research is how to recognize potentially modified trademarks or other registered imagery within a larger image such as a fully rendered email. A similar approach may be fruitful when applied to web sites, when a user has clicked on a link. 7.3.2 Authentication Message authentication techniqu-es such as Sender-ID have considerable promise for anti-phishing applications. Sender-ID prevents return address

7.4

Preventing

Deception

in

Phishing Messages and Sites

There are two different points to thwart phishing presentation deception: at the message, and at the site to which the message points.

7.4.1 Signing
Cryptographic signing of email is a positive incremental step in the short run and an effective measure if it becomes widely deployed in the long run. Signing may be performed either at the client or at the gateway. However, current email clients simply display an indication of whether an email is signed. A typical user is unlikely to notice that an email is unsigned and avoid a phishing attack. Signing could be more effective if the functionality of unsigned emails were reduced, such as by warning when a user attempts to follow a link in unsigned email. However, this would place a burden on unsigned messages, which today constitute the vast majority 11

forgery by checking DNS records to determine whether the IP address of a transmitting mail transfer agent is

authorized to send a message from the senders domain. Yahoo! Domain Keys provides similar authentication, using a Domain-level cryptographic signature that can be verified through DNS records. Some form of lightweight message authentication may be very valuable in the future in combating

of email messages. If critical mass builds up for signed emails, such measures may become feasible.

7.4.2 Personally Identifiable Information The simplest way to reduce the deceptiveness of phishing messages is to include identifiable information with all those legitimate communications. For example, if every email from bank.com begins with the users name, and every email from bank.com educates the user about this practice, then an email that does not include a users name is suspect. While implementing this
Figure 7.1

A subsequent email from Large Bank and Trust Company will include this personalized information. Since Phishers will not know what personalized

information a user has elected; they will not be able to forge deceptive emails.

practice can be complex due to the widespread use of third-party mailing services, it is an effective measure. Personalized imagery may also be used to transmit messages. For ex when a user creates or updates account information, he or she may be allowed (or required) to enter textual and/or graphical information that will be used in subsequent personalized information. In this example, a customer of the Large Bank and Trust Company has typed in the personalized text You were born in Prague and selected or uploaded a picture of a Canadian penny that is used for your identification. 12
Figure 7.2

7.5 Counter Measures

7.5.1 Interfering With The Call To Action A phishing attack using email and a browser asks a user to perform an action, such as clicking on a link. One class of countermeasures focuses on disrupting the initial call to action.

7.5.1.1 Increasing the Information Sharing An area of future work is fighting phishing by increasing information

trust worthy messages in the network. Interfaces between spam filters, email clients and browsers that to allow be

trustworthiness

information

sharing between spam filters email clients, browsers. Important information is often lost in boundaries between a spam filter, an email client and a browser. A spam filter may have classified a message as being possible spam, but as long it scored below the rejection threshold, it is typically

transmitted would enable many new ways to combat phishing. 7.5.1.2 Warning about Unsafe Actions When a user clicks on a link that is a cloaked, obfuscated mapped, or misleadingly named link, a warning message can be presented advising the user of the potential hazards of

rendered by the email client on an equal basis as signed email from Microsoft. Information gleaned while

traversing the link. Information should be presented in a straightforward way, but need not be simplistic. To help the user make an informed decision, data from sources such as reverse DNS and WHOIS lookups could be usefully included: An informative warning has the benefit of allowing legitimate links even if of a suspicious nature, while providing a risk assessment with the information a user needs to determine an appropriate action.

processing messages can help thwart phishing. If an email is known to be suspicious, it can be treated differently than an authenticated message from a sender on the users white list or a member of a bonded sender program. Scripts can be disallowed, links can be shown with their true names, forms can be disallowed, etc. Similarly, once a user clicks on a link in an email message, information about the trustworthiness of the message can help determine whether to allow a traversal. Once a link is traversed, capabilities (scripting, form submissions, display of links, Etc.) Can be restricted for links pointed to in less 13

Figure 7.3

rendering even a protective key logger 7.5.2 Interfering With The Transmiss-ion Of Confidential Information Another point at which phishing attacks may be is when a user attempts to transmit confidential information (step 2 of the phishing information flow). If the information flow can be disrupted or altered to render the confidential ineffective. The long-term viability of outgoing data monitoring as an antiphishing technology is unclear, but presently most phishing attacks do not include effective countermeasures. 7.5.2.2 Data Destination Black Listing Some proposals have been

fielded to block data transmissions to specific IP addresses known to be associated with Phishers. However, this would not prevent information

information unavailable or useless to the phisher, the attack can be thwarted. 7.5.2.1 Outgoing Data Monitoring One class of technology to intercept the transmission of confidential information is the toolbar approach. A browser plug-in such as a toolbar can store hashes of confidential information, and monitor outgoing information to detect confidential information being transmitted. If confidential information is detected, the destination of the information can be checked to ensure that it is not going to an unauthorized location.This approach has a challenging obstacle to overcome. Phishers may scramble outgoing information before transmitting it, so keystrokes must be intercepted at very low level. Moreover, some users enter keystrokes out-of-order for account and password information to avoid compromise by key loggers, 14

transmission in a lasting manner, as information could be transmitted through covert communications channels using the internet Domain Name System (DNS) that is used to translate host names into IP addresses. A simple Example of this in which a Phishers controls the DNS server for phisher.com and wants to transmit credit-card-info is to incur a DNS lookup on credit-card info. phisher.com. The result of the DNS lookup is not important; the data has already been transmitted through the DNS request itself. Blocking DNS lookups for unknown addresses is not feasible, as DNS is a fundamental building block of the internet. Similarly, a blacklist based on hostnames is also

susceptible to circumvention via DNS. Information can be transmitted via DNS even if the Phishers does not control any DNS server whats ever, by using the time-to-live fields in DNS responses from innocent third-party DNS servers. 7.5.2.3 Domain Specific Password And Password Hashing Phishing for passwords only works if the password sent to the phishing site is also useful at a legitimate site. One way to prevent phishers from collecting useful passwords is to encode user passwords according to where they are used, and transmit only an encoded password to a web site. Thus, a user could type in the same password for multiple sites, but each site including a phishing site would receive a differently encoded version of the password. A proposed implementation of this idea is called password hashing. This method hashes password information with the domain name to which it is going, so that the actual transmitted passwords can be used only at the domain receiving the password data. Such hashing could be provided by a browser as a built-in mechanism is automatically performed for password fields. This provides excellent data security for compromised 15

sites as long as passwords are difficult to guess through a dictionary attack, in that stolen password data cannot be applied to any other site. However, the user still types in his or her usual password in a browser to gain account access, and it would be difficult to prevent phishers from simulating password input,

bypassing any hashing, to capture the raw password data. If combined with reserved screen real estate for password entry, password hashing would be rendered less susceptible to attack.

7.6 Interfering with the Use Of Compromised Information

Another technology based approach to combating phishing is to render compromised information less valuable. Apart from technologies to render information irretrievable, such as hashing passwords with domains and a trusted path that encrypts information with public key, additional requirements may be placed on the use of information to mitigate the impact of compromise. 7.6.1 Conventional Two Factor Authentication The most prevalent approach to reducing the impact of data compromise is known as two-factor authentication. This refers to requiring proof of two out

of the following three criteria to permit a transaction to occur: What you are (e.g. biometric data such as fingerprints, retinal scans, etc.) What you have (e.g. a smartcard or dongle) What you know (e.g. an account name and password) Phishing attacks typically

taken root in the United States for typical consumer applications. 7.6.2 Light Weight Two Factor Auth-ention A less costly approach to twofactor authentication is to have a device identifier, such as a checksum of all available machine information, which can authenticate the device. Such a device identifier must be transmitted only to a secure location, or employ other measures to prevent man-in-themiddle attacks. This has the advantage of not requiring additional hardware, and the disadvantage that it does not permit a user to use normal transaction

compromise what a user knows. In a remote computing environment such as the internet, it is difficult to ascertain what the user is, so the usual second factor is to verify something that the user has in addition to account information. In order for this to be effective, twofactor authentication must be required for every transaction. For example, a user must have a USB dongle, or type in a time-sensitive code from a hardware device, or swipe a smart card. This is a highly effective measure, though

authorization procedures when away from an authorized machine.

8. Solution For Cross Site Scripting Problem

Cross-site scripting, in which rather than sending an email, a phisher inserts malicious code into a web page of a targeted institution. Any web page contains externally supplied information such as an auction listing, product review or web-based email message, may be the target of a cross-site scripting attack. Once inserted, a script can modify elements of the host site so that a user believes he or she is communicating 16

expensive in the cost of purchasing and distributing security devices, the

deployment of infrastructure for reading them, inconvenience to customers in using them. Conventional two-factor authentication is appropriate for highvalue targets such as commercial

banking accounts, but so far has not

with the targeted institution, but actually is providing confidential information to a phisher.

scripting whatsoever could occur, or in which particular functionality was

prohibited. The browser could guarantee this behavior, and employing sufficient filtering would be as simple as enclosing areas of user-supplied text, such as search results or auction listings, with appropriate <noscript> and </noscript> tags. To prevent a cross-site script from including a valid </noscript> tag and inserting cross-site scripting, a dynamically generated random key

8.1 Filtering Out Cross Site Scripting

Any user data that is ever displayed on the screen should be filtered for cross site scripting. Malicious parties have mounted cross-site scripting attacks in unexpected areas, such as date fields of web-based email pages. Rather than filtering out forbidden script elements with a keep-out filter, usersupplied data should be parsed with a let-in filter, and only permitted data elements should be allowed through.

should be used that must match in the <no script> and </no script> tags. For example: [Site-supplied HTML and scripts] <no script key=432097u5iowhe> [User-supplied HTML in which

8.2 Browser Security Enhancements to prevent Cross Site Scripting

There are many ways in which cross-site scripting may be introduced. It is difficult, expensive and error-prone to write an adequate filter, and often content that should be filtered is inadvertently overlooked. A browser extension could

scripts/features are disabled] </no script key=432097u5iowhe> [Site-supplied HTML and scripts]

9. How Anti-Phishing Software Works

Anti-phishing software consists of computer programs that attempt to identify phishing content contained in websites and e-mail. It is often

provide protection against cross-site. If a new tag was introduced that could be included in HTML, such as <no script>, regions could be defined in which no 17

integrated with web browsers and email clients as a toolbar that displays the real

domain name for the website the viewer is visiting, in an attempt to prevent fraudulent websites from masquerading as other legitimate web sites. Antiphishing functionality may also be included as a built-in capability of some web browsers Common phishing tactics take advantage of a visitor by requesting them to link out to another site, asking that the enter personal information and passwords, or redirecting them to

Link Scam Blocker are just a few programs that have reduced the risks involved. In Firefox 2.0, Phishing Protection is always turned on and checks the sites automatically for any potential risks or hazards. The list is reviewed on a regular basis, and can be configured to Firefox Security settings for maximum control. When Phishing Protection in enabled, the sites are downloaded into a list and checked for any anti-phishing services. A warning sign will if any suspicious activity is detected. The Net craft toolbar makes use of a risk rating system, allowing you the option of entering a password (or not). Trust Watch makes the Internet Explorer toolbar, and can help validate a Web site and provide a site report when needed. This option also allows you to review all suspected sites and find out which ones use SSL technology.

another site completely for registration. The process usually begins by sending out a forged e-mail that looks like it was sent from the company. Some tactics include saying an account has expired and needs to be updated, or has experienced unauthorized use and needs to be verified. Many banking and financial institutions become targets for these types of scams, and they can be a considerable threat to millions of

account holders and users. Many leading web browsers and software programs have realized the impact of this trend, and have created programs that can limit the frequency of these types of scams. Microsoft

EarthLink Toolbar with Scam Blocker will verify any popup messages that you may encounter as you visit a site, and can help you find out all the details on current phishing scams. Anti-phishing software is designed to track websites and monitor activity; any 18 suspicious behavior can be

Windows Internet Explorer 7, Firefox 2.0, Google Safe Browsing, and Earth

automatically

reported,

and

even

Phishing attacks can be detected rapidly through a combination of customer monitoring, reportage, the bounce use

reviewed as a report after a period of time. Anti-phishing toolbars can help protect your privacy and reduce the risk of landing at a false or insecure URL. Although some people have concerns over how valuable anti-phishing

image

monitoring, honey pots and other techniques. The Email authentication

software and toolbars may be, security threats can be reduced considerably when they are managed by the browser program. Other companies that are trained in computer security to are report

technologies such as Sender-ID and cryptographic signing, when widely deployed, have the

potential to prevent phishing emails from reaching users. Analysis of imagery is a

investigating other

ways

phishing issues; programs are being designed that can analyze web addresses for fraudulent behavior through new tactics, and cross-checking domain

promising area of future research to identify phishing emails. The most personally identifiable information should be included in all email communications. Systems allowing the user to

names for validity.

10. CONCLUSION
No single technology will completely stop phishing. However, a combination of good organization and practice, proper application of current technologies, and improvements in

enter or select customized text and/or imagery are particularly promising. Browser security upgrades, such as the distinctive display of potentially deceptive content and providing a warning when a potentially selected, unsafe could link is

security technology has the potential to drastically reduce the prevalence of phishing and the losses suffered from it. In particular: High-value targets should follow best practices and keep in touch with continuing evolution of them. 19

substantially

reduce the efficacy of phishing attacks.

Information sharing between the components involved in a

two-factor authentication offers the potential for cost savings. Cross-site scripting is a major vulnerability. All user content should be filtered using a let-in filter.

phishing attack spam filters, email clients and browsers could improve the identification of phishing messages and sites, and restrict risky behaviour with suspicious content. The Anti-phishing toolbars are promising tools for identifying phishing sites and heightening security when a potential

phishing site is detected. Detection confidential of the outgoing that

information

including password hashing is a promising area of future work, with some technical challenges. An OS-level trusted path for securing the data entry and transmission has the potential to dramatically reduce leakage of confidential data to unauthorized parties. The two-factor authentication is highly effective against phishing, and is recommended in situations in which a small number of users are involved with a high-value target. Device identifier based

20

11. REFERENCES
[1] http://en.wikipedia.org/ [2] http://webopedia.com/

[3] http://computerworld.com/ [4] http://www.anti-phishing.info/ [5] http://lorrie.cranor.org/

21

22