phoolproof phishing prevention bryan parno, cynthia kuo, adrian perrig carnegie mellon university
TRANSCRIPT
Phoolproof Phishing PreventionPhoolproof Phishing Prevention
Bryan Parno, Cynthia Kuo, Adrian Perrig
Carnegie Mellon University
A Recent Email…
Images from Anti-Phishing Working Group’s Phishing Archive
Images from Anti-Phishing Working Group’s Phishing Archive
The next page requests:
• Name• Address• Telephone• Credit Card Number, Expiration Date,
Security Code• PIN• Account Number• Personal ID• Password
Images from Anti-Phishing Working Group’s Phishing Archive
But wait…
WHOIS 210.104.211.21:
Location: Korea, Republic Of
Even bigger problem:
I don’t have an account with US Bank!
Images from Anti-Phishing Working Group’s Phishing Archive
Phishing: A Growing Problem
• Over 16,000 unique phishing attacks reported in Nov. 2005, about double the number from 2004
• Estimates suggest phishing affected 1.2 million US citizens and cost businesses billions of dollars in 2004
• Additional losses due to consumer fears
[Anti-Phishing Working Group, Phishing Activity Trends Report, Dec. 2005]
Outline
• Introduction
• Current Antiphishing Approaches
• Goals & Design Principles
• Phoolproof Phishing Prevention
• Security Analysis
• Implementation
Outline• Introduction• Current Antiphishing Approaches
– Heuristics– Modified Passwords– Origin Authentication
• Goals & Design Principles• Phoolproof Phishing Prevention• Security Analysis• Implementation
Current Approaches• Heuristics
– Spoofguard [Chou et al.], TrustBar [HerzGbar], eBay toolbar, SpoofStick
– Recent studies indicate users ignore toolbar warnings [Wu et al.]
Current Approaches• Modified Passwords
– Single Sign-On• Requires users to trust one institution with all of their passwords• Still faces an authentication problem
– PwdHash [Ross et al.]• Promising approach, but vulnerable to pharming, DNS spoofing, and
dictionary attacks– One-time passwords (e.g., scratch cards, RSA SecurID)
• Vulnerable to active MitM attacks (already seen in the wild)
username, one-time password
username, one-time password
Withdraw
$$$$$
Current Approaches• Origin Authentication
– Dynamic Security Skins [DhamTygar ], Passmark, and the Petname project
– All rely on user diligence – a single mistake will result in a compromised account
Key Insight
• Security must not depend entirely on fallible users
• System must be secure by default
• Design must be robust to user error
Outline
• Introduction
• Phishing Techniques
• Current Antiphishing Approaches
• Goals & Design Principles
• Phoolproof Phishing Prevention
• Security Analysis
• Implementation
Phishing Prevention Goals
• Ideal: User’s data only reaches intended recipient
• Practical: Prevent a phisher from viewing or modifying a user’s accounts– Reduce the power of attacks to that of pre-
Internet scams• E.g., an attacker can still subvert a company insider
Contributions• Plan for human errors by guarding users’
accounts even when they make mistakes• Use a mobile device to establish an authenticator
the user cannot readily disclose• Protect against active Man-in-the-Middle attacks• Defend against keyloggers• Develop a prototype implementation
Design Principles• Sidestep the arms race
– Incremental solutions provoke adaptations
• Provide mutual authentication– Phishing exploits two authentication failures:
Server to User and User to Server
• Reduce reliance on users– Users are unsuited to authenticating others or
themselves to others– We cannot rely on perfect user behavior
• Avoid dependence on browser interface– Readily spoofed and distrusted by users
Outline
• Introduction
• Phishing Techniques
• Current Antiphishing Approaches
• Goals & Design Principles
• Phoolproof Phishing Prevention
• Security Analysis
• Implementation
Phoolproof Prevention Overview
• Mobile device creates a public key pair for each site– Transmits public key to the server
• To access the site, the mobile device uses the private key to authenticate to the server– Assists browser in establishing SSL/TLS session
• Server refuses access unless client can provide user’s password and the mobile device authenticates properly
User Experience
• Setup– Login to the institution’s website– Select Phoolproof Phishing Setup– Confirm installation on device
• Use– Select secure bookmark on device– Login to the website
Basic Phoolproof Setup
Establish SSL Connection
User Information
<!-- ACCOUNT_CREATE -->
PubKSDomain, Site Name
PubKj
PubKj
Advanced Phoolproof Setup
• For additional security, establish a shared secret via a trusted side-channel– Mail a nonce (or barcode) to address on file– Display a barcode at an ATM– Setup in person
• Trusted financial institutions could provide setup for companies without a storefront
• The problem of properly identifying new customers predates the Internet
• Existing research can help secure setup
URL
Phoolproof Connection Establishment
Hello Messages
h = H(MS || prev msgs)
SigPrivKj(h)
PubKS
DHs, SigS(DHs)PubKS
DHc, SigPrivKj(h)PubKj
PubKj
STANDARD SSL
Outline
• Introduction
• Phishing Techniques
• Current Antiphishing Approaches
• Goals & Design Principles
• Phoolproof Phishing Prevention
• Security Analysis
• Implementation
Security Analysis• Hijacking account setup
– Users must authenticate site and vice versa (only once/site)
– Users are at their most alert– Advanced setup precludes most attacks
• Theft (or loss) of the mobile device– Thief still needs the user’s password– Device may require pin or biometric verification– Users can call companies to revoke their keys
(like credit cards)• Malware on the mobile device
– Standard security solutions (e.g., antivirus, firewalls)– Trusted hardware (e.g., TPMs)– Mutual software attestation
Security Analysis• Malware on the computer
– Standard keylogger fails, since it only obtains password– Compromise of the browser or the operating system is still a
problem
• Attacks on the network– Our system is immune to Man-in-the-Middle attacks, pharming
attacks, and domain hijacking
• Local attacks on Bluetooth– Phishing relies on large-scale attacks, not local attacks– Attacker still lacks user’s password, so account is secure– Existing research [McCune et al. 2005] demonstrates how to
establish a secure channel
Outline
• Introduction
• Phishing Techniques
• Current Antiphishing Approaches
• Goals & Design Principles
• Phoolproof Phishing Prevention
• Security Analysis
• Implementation
Implementation: Minimal infrastructure
• Mobile device: Nokia Smartphone– Coded in Java for portability to other cellphones,
PDAs, etc.• Small patch to Firefox
– Detects account setup tag– Modifies SSL establishment
• Server changes are minimal for IIS, Apache and Apache-SSL
– Plus two short perl scripts
SSLVerifyClient none
SSLOptions
– For Apache 2.0:
Implementation: Performance
Average
Time (s)
[Min, Max] (s)
Key Creation (offline)
75.0 [29, 168]
Account Creation 0.4 [0.3,0.5]
Site Navigation 0.2 [0.1,0.2]
SSL/TLS Establishment
1.7 [1.6,1.9]
20 Trials
Conclusions
• Phishing is a growing problem, and attacks will only become more sophisticated
• We should avoid relying on perfect user behavior• Instead, we use cryptographic techniques to
protect even fallible users• Our implementation demonstrates the feasibility of
phoolproof phishing prevention
