3

I the last days I was thinking about possible solutions to protect your users from putting their data into forms on phishing websites and how you could warn them or "educate" them into not doing that.

Following Scenario:
Your work for a popular website with millions of users. Think Amazon, Spotify, Google, Paypal... something like this. Now, as attackers want to get access to user accounts, they send out phishing emails (or sms, letters, WhatsApp messages) with a similar looking link e.g. the real address would be https://www.yourcompany.com/login, and the new address is http://www.yourcompany.com-login.to. If a user clicks on it, he lands on a copied login page of that website (Same html & css, optically indistinguishable).

What could you do on your website - to your users - to protect them from phishing sites?


Ideas I was thinking of:

  • Redesign the login page with a lot of big, graphic warnings on that page (e.g. "watch out for that lock in your browser address bar"), so
    a) the user will get educated every time he is on the login page of the real website
    b) the attacker has to copy that warning elements to still use the original company website design.
    The question is if users really look at that.

  • Warn the user when he registers, that people might try to phish his data.

  • Establish a policy that users should NEVER click on any link to your site but should open it directly via homepage every time. (The newsletter analytics team might kill you for that)

  • Send security related newsletter to users and try to educate them as often as possible at any place on your website.

I am not very happy with any of them, but I tried to find studies or real life examples of counter measures, but could find none.

  • A usual SSL-Certificate ("watch out for that lock") is easy to obtain for a typo domain name. If you want to use Certificates to protect the identity of the site, you need to purchase an extended validation certificate and point the user to the company name in the address bar instead of the lock. – allo Mar 13 '18 at 14:47
4

Technical solutions dubbed "usable phishing protection" usually fail miserably, "education" campaigns only work for a short time before users forget about them and are annoying to your user base. Let's start with some facts about security behaviour and then discuss useful courses of action.

Why phishing is easy

Phishing would be easily avoided if people confirmed the identity of websites they are using. This would require for them to see, and correctly process, passive security indicators, and to correctly identify the URL of the website. Here are some fun facts: - even we security engineers have trouble validating certificates and don't usually do it; a lot of security indicators don't actually reflect on whether the certificate has the correct CN, expiration date, a CA that is not compromised or expired, and a protocol that is not compromised either. This happens because software doesn't get updated and also because of structural difficulties in dealing with revocation in PKIs.

  • good phishing campaigns buy domain names similar to the companies they target, and people might fail to read that the URL is incorrect (1inkedin.com vs linkedin.com)
  • phishing sites sometimes buy certificates (e.g. using stolen credit cards)
  • really good certificates are super expensive, most websites have crappy ones or ones from dubious CAs, or expired ones
  • literally all the certificate warnings you receive in daily use will be false alarms caused by poor certificate management on websites' behalf, unless you're a target population (e.g. China, Iran, users of various proxies and high-value accounts who could get spearhead phishing and active MITM attacks)

Now, does it cost that much to verify the URL and certificate every time? Yes. In fact, it would cost more to the US economy if information workers did that systematically than it costs to let phishing happen. Read So long and no thanks for the externalities for the numbers. The key takeaway is that any solution that requires even a second of attention per website for users is doomed to failed.

Add to this the fact that people get habituated to warnings, and they will soon completely forget to check the website's URL even if you put a big red bold scary warning on your login page. Systematic warnings to rare risks are absolutely useless and actually cause your users to not take you seriously anymore when you really need to warn them. Don't do this.

What to do then?

Firstly you need to take action to make phishing harder to perform and easier to detect, regardless of human behaviour:

  • buy all the domain names that look like yours or are a misspelt version of yours; yes, this is expensive
  • use multi-factor authentication schemes that resist better to phishing, e.g. sending an authentication code to the client's phone (something a phisher would have trouble doing if they don't know your client's phone number)
  • use behavioural metrics to spot and block suspicious login attempts (don't immediately allow connections from a foreign country for a client whom you know has no business there, but understand that this might cause severe disturbance to some of your users and make contingency plans to prevent such disturbance, e.g. manually flag international clients based on behaviour and information you collect at sign-up)
  • protect the high-value clients by campaigning against phishing with those and being more strict with suspicious login attempts
  • be proactive in identifying phishing campaigns against you (by having dummy user accounts that you expose to dubious sites and that will receive the phishing emails / texts, or by helping your users warn you when they are being phished and reacting quickly) in order to send anti-phishing warnings at the right time

About your ideas

  • Big warnings: No.
  • Warning at registration time, and campaigns: Meh. This will be less and less efficient over time. Strategic campaigning is what you need to do.
  • Policy to blame the users if they don't use a specific form of interaction: No. Of course people will click links, in emails and other sites, or on search engines. They can also be fooled by a proxy or ISP and redirected without you knowing, so don't blame them for just acting normally. It's not nice at all.
  • Thank you for your long & detailed answer! Thats what I though, its really hard to do that... Some points: "use multi-factor authentication" yeah, thought about that, but even Amazon or eBay are not using that, there must be some big ux reasons against it (maybe confusing most users?). "buy all the domain names" not possible, if you look at the example domain I posted in my question (com-[any technical term]). "be proactive in identifying phishing campaigns" if we are talking big user numbers, this is happening 24/7... – Robert Jan 14 '16 at 9:14
  • I only agree to a certain extent. Firstly you should realise that you can offer your users choice. No reason to force 2FA. Both sites you mention have it at least in some countries. You can also offer federated auth services like Facebook/Google auth since they don't rely on stealable auth factors. Buying all the domain names isn't possible but you should really buy the obvious ones as these are not easily distinguishable even for the more paranoid users. If you're big you can afford that. – Steve Dodier-Lazaro Jan 14 '16 at 9:49
  • As for campaigns... it does not quite happen 24/7, insofar as I know campaigns usually span over few weeks because the element of surprise is needed for cyber criminals to be able to maintain all their infrastructure long enough to monetize the attack. They need a minimal volume until their sites are spotted and shut down in order to make money. So if you have many fake accounts registered all over the place, can automate phishing email detection, and have a good contingency plan you could avoid some damage. Never been a CISO for a large company so go ask on Security.SE for that. – Steve Dodier-Lazaro Jan 14 '16 at 9:51
0

You could do it like my bank does it (well they used to do it, but they recently redesigned their site and left this out... guessing they will restore it at some point).

This is how registration works:

  1. When registering, after providing basic personal details, and username, then, I am shown a bunch of (small-ish) pictures, of everyday items. Say, a stop sign, a drink-cup, a microwave, a school bus, a flag, etc. I pick one of these pictures as my "login picture".
  2. I am provided a textbox where I type a phrase. Just anything I want to type, but I should be able remember it if I see it (I won't need to type it again, ever).
  3. I choose (create) a password, and type it twice, then submit to complete registration.

At this point, I don't remember if they verified my email address, but you could do that here if you want.

This is how logging in works:

  1. I go to homepage or login page.
  2. I see the login text-field with a login button.
  3. I fill in my username and click the button.

On the next page, I see:

  1. The picture I selected when I registered.
  2. The phrase I created when I registered.
  3. A password field and
  4. A continue/login button.

Now, I recognize the picture, and I recognize the phrase, so I know it's safe for me to provide my password and continue.

If I was misled to a phishing site, they wouldn't know what picture and phrase (which together, should be unique to me) they should display.

If I get to the password page, and I don't recognize the picture or phrase, I know it's not safe to type my password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.