Phishing Rising to the challenge Amy Marasco Microsoft

How Phishing attacks work Branded message that looks like it comes from a familiar business Request you to login in to your account to validate account details URL that points to fake site, even though the text may look real. Fake site, branded to look just like the real one. Phishing site takes your username and password and then uses them to defraud you.

Threats to Online Safety The Internet was built without a way to know who and what you are connecting to Internet services have one-off “workarounds” Inadvertently taught people to be phished Greater use and greater value attract professional international criminal fringe Exploit weaknesses in patchwork Phishing and pharming at 1000% CAGR Missing an “Identity layer” No simplistic solution is realistic Most people re-use username and passwords on multiple sites

Phishing & Phraud New Phishing Sites by Month December 2004 – December 2005 Dec 04 Jan Feb Mar Apr MayJunJul Aug Sep Oct Nov Dec 05 7,197 4,630 4,367 5,242 5,259 4,564 4,280 3,326 2,854 2,870 2,625 2,560 1,707 Source:

Need Layered Defense Stop users clicking on URL’s in phishing Detect phishing sites and when possible prevent users clicking on them Work with the industry to move away from username and passwords as authentication mechanism

Improvements to Outlook 12 Improved junk filters No longer click on URL’s on s in the junk folder

Improvements in IE7 Phishing Filter: comprehensive anti-phishing service Warns if site exhibits suspicious behavior Blocks known phishing sites Instant protection via page scan and online service High Assurance Certs: accountability for secure sites Much higher bar for granting certificates Clear identification that site has stronger certificate Industry-wide initiative

InfoCard Simple user abstraction for digital identity For managing collections of claims For managing keys for sign-in and other uses Grounded in real-world metaphor of physical cards Government ID card, driver’s license, credit card, membership card, etc… Self-issued cards signed by user Managed cards signed by external authority Based on series of WS* specifications Shipping in WinFX Runs on Windows Vista, XP, and Server 2003 Implemented as protected subsystem

Summary This is an industry wide problem which we can only solve together. We need co-operation of all major sites to implement High Assurance Certificates and InfoCard