1. Anti-Phishing Technology Chokepoints and Countermeasures Aaron Emigh Radix Labs aaron@radixlabs.com

2. A Typical Phishing Email

3. Phishing Information Flow

4. Step 1: Phish Delivery

5. Authentication

6. Reducing False Positives

7. Reducing False Positives

8. Image Recognition Simple idea: recognize logos

9. Image Recognition Maybe not so simple…

10. Image Recognition Fully render, then retrieve sub-images

11. Patching

12. Secure Patch Distribution

13. Secure Patch Activation

14. Automatic Secure Patch Activation

15. Step 2: User Action

16. Education Why Johnny can’t identify phish…

17. Personally Identifiable Information

19. Unmask Deceptive Links To go to a surprising place via a cloaked URL, click on this link. To go to a surprising place via a cloaked URL with a password, click on this link. To go to a surprising place via an open redirect, click on this link. To go to a surprising place via misleading link, click on http://security.ebay.com.

20. Unmask Deceptive Links To go to a surprising place via a cloaked URL, click on this link. To go to a surprising place via a cloaked URL with a password, click on this link. To go to a surprising place via an open redirect, click on this link. To go to a surprising place via misleading link, click on http://security.ebay.com.

21. Interfere With Navigation

22. Detecting DNS Poisoning

23. Steps 2 and 4: Information Sharing

24. It’s the metadata, stupid!

25. Step 4: Transmitting data

26. Little Brother is Watching

27. Step 4 Variant: Cross-Site Scripting

28. Cross-Site Scripting: Countermeasure

29. Steps 4 and 6: Secure Path

30. Secure Path (That Was Then) Login: aaron Password: ******

31. Secure Path (This Is Now)

33. Step 6: Data Without Value

34. Two-Factor Authentication

36. Password Hashing

37. Policy-based data

38. Aftermath: Ex Post Facto Detection

39. Aftermath: Information Sharing

40. Conclusions

41. Anti-Phishing Technology Chokepoints and Countermeasures Aaron Emigh Radix Labs aaron@radixlabs.com