Slashdot Log In
10 Anti-Phishing Firefox Extensions
Posted by
CowboyNeal
on Fri Jun 01, 2007 12:12 AM
from the lock-the-windows dept.
from the lock-the-windows dept.
An anonymous reader writes "A list of 10 anti-phishing Firefox extensions was published at Security-Hacks: 'For most Internet users, defending against phishing attacks is a top priority. One popular way to combat phishing attacks is to maintain a list of known phishing sites and to check web sites against the list.'"
Related Stories
[+]
Firefox Quickies 245 comments
First, Gypsy2012 writes with a highly critical security flaw involving both Firefox 2.0 and Internet Explorer, which could allow a malicious attacker to gain remote control of a user's system. It exploits the "firefoxurl://" URI handler. ... Next, reader dsinc sends word that the beta for Firefox 3 has slipped by 6 weeks. The new target date is September 18 at the earliest. The article wonders whether the final release will slip into 2008. ... Finally, reader jktowns points out new anti-phishing features in the latest nightly build of Firefox 3. One of them was added into the code base by the guy who developed the LocationBar2 extension.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
if only (Score:5, Insightful)
unfortunately it isnt, a lot of people ignore security measures designed to protect them from phishing. case in point, banks that used images/etc to show the authenticity of the website their customers use was largely ignored, few noticed it and similar studies show few have such security as one of their concerns. these extensions might have done good if people listened to them but the real fix for phishing is to educate people on ways to avoid going to the sites in the first place. typing in addresses instead of following links, paying attention to what comes after the tld and disabling javascript for starters.
Re: (Score:2)
and that is why they also tested people's observational skills- researchers observed people's interaction on a set up computer that would direct people to a site that had some significant difference compared to the real site and few refused to continue doing business as usual... the bigg
Re: (Score:3, Insightful)
Second, it completely stops passive attack like are common with eBay pishing sites -- you can't just simulate the login page, say "Bad Password" and the redirect to the real page, you have to cus
And the top #1... (Score:5, Insightful)
Re:And the top #1... (Score:5, Interesting)
I have never seen a phising attempt that was convincing enough that I would actually think it was a website done by a bank. I have seen some that were close, but they always fell down visually somewhere. I also have never given my bank my email address so I would be very surprised if they sent me an email.
On another point I used to ring up my friends and put on a silly voice and see if the could figure out is was me. On one occasion my mates girlfriend answered the phone so I pretended to be from mastercard. To my suprise not only did she not realise who it was, I also managed to get her credit card number out of her. I owned up and told her who I was before she finished giving me the number but it made me realise how many people fall for this far too easily.
Phising is nothing new, its just that now its easier to trawl looking for daft people in a more automated fashion.
Parent
Clicking (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
For that matter... (Score:2)
I mean, think about it. If it's your bank, you already know it's URL anyway, you probably even have it bookmarked. Why on Earth would anyone need to follow a link from some dodgy email to go log in to their bank? No, bloody seriously.
Let's try to think like the most clueless user for a moment, and actually believe that my bank wants me to log in to verify I still exist. Well, ok. I already have a bookmark to the bank, I'll go log in there.
Ah, but m
Re: (Score:2)
The point is that there are people out there who are just to stupid to think about phishing. The problem is getting them to install an anti-phishing tool. In some case one can do that for them, which might be helpfull. There is where such a thing is needed.
priorities (Score:2, Insightful)
No, I disagree, I don't think it is a top priority for most users. Try pr0n.
Seriously though, it should be on the list... but let's be realistic.
Firefox 2 (Score:4, Informative)
Re: (Score:2)
I know this can be disabled, but how many people even know how to change the defaults?
Re: (Score:2, Interesting)
I don't need or want voice control, widgets, or built-in mail/irc clients. Plus, I find Opera's interface a little annoying.
Re: (Score:2, Insightful)
The primary reason I don't use Opera is because you goddamn zealots turn me off of it.
Seriously people, every single story we see about any sort of anything that even vaguely relates to web browsers, you can bank on several comments that basically just say "Use Opera!"
It used to be the same with Linux stories and Gentoo. These days, it's rapidly becoming Linux stories and Ubuntu. Opera zealotry, however, has shown remarkab
Re:Firefox 2 (Score:4, Informative)
Parent
Just a summary... (Score:2, Informative)
Eh? (Score:3, Insightful)
I think 'most' users would say "what the hell is phishing?" Only way to prevent phishing is to bring up a "Welcome to the internet, here are a few things you should know about before you go on: ... " splash screen when they open up their browser for the very first time.
Followed by another splash screen that says "If you ignored the previous information, you are now entering with the risk of doing something extremely stupid, would you like to bring up the Welcome screen again? [Yes] [Yes]"
Re: (Score:2, Insightful)
Or you can just use OpenDNS (Score:3, Informative)
Re: (Score:2)
We fix typos in the URLs you enter whenever we can. For example, if you're using OpenDNS craigslist.og will lead directly to craigslist.org.
When you try to go to a website that won't load, instead of a browser error we show you OpenDNS Guide and help you get to where you want to go.
How about not breaking shit and returning a notfound?
Re: (Score:2)
Why is OpenDNS smarter?
We fix typos in the URLs you enter whenever we can. For example, if you're using OpenDNS craigslist.og will lead directly to craigslist.org.
When you try to go to a website that won't load, instead of a browser error we show you OpenDNS Guide and help you get to where you want to go.
How about not breaking shit and returning a notfound?
The semi spyware/pyramid scheme/web 2.0 abuser/search engine abuser toolbar you advertise via referral on your signature could be a good starting point not to "break the shit".
Re: (Score:2)
I think that is main reason why phishtank was started by openDNS.
As phishtank verifier I think the good old days of checking status bar, viewing browser address bar are soon over if not already. I have even seen couple of cr
Blacklists don't work any more. (Score:5, Interesting)
Blacklists aren't really working any more. As with spam, where each spam message is now different, and as with viruses, where the smarter ones are different for each copy, the more advanced phishing sites now generate multiple sites, not just one site.
PhishTank is fooled by this. It assumes that a "phish site" is a unique URL. The phishing sites are now wise to that trick; many sites generate a new URL for each user, and some even generate a new domain. Current domains in PhishTank [phishtank.com] include "session-97701.nationalcity.com.userpro.io", "session-300962.nationalcity.com.userpro.io", "session-5489554.nationalcity.com.userpro.tw", "session-2721837.nationalcity.com.directories.io", etc. There are presumably many, many more that no user has reported yet. So the blacklist defense is failing.
It's thus too late for approaches based on manual detection. In the early days of spam, we all reported spam sites to SpamCop, which then blocked them. That stopped working years ago. The same has now happened for phishing sites.
The hard line approach is to implement something that prevents putting in credit card or bank information into forms unless the target page has a solid SSL certificate. (And not one those "Instant SSL - Domain Control Only Validated" cheapo certs that mean nothing, either.) It's getting harder to make even that work, with more and more Javascript processing going on in the browser. The browser may not be able to detect that the user is filling in a form.
We (SiteTruth [sitetruth.com]), of course, are trying to promote the idea that you don't want to deal with a website unless the business behind the website can be clearly identified, so we do have a bias here. Nor do we have all the answers. But from the amount of activity in this area of security in the last month, it's becoming clear that some major tightening-up on business legitimacy on the web is needed.
"On the Internet, no one knows if you're a dog" just isn't good enough any more.
Re: (Score:3, Interesting)
It seems the blacklist would work perfectly if nationalcity.com.userpro.io, or just userpro.io was blocked.
Notice that they're using "userpro.tw" and "directories.io" as well. And "prouserbase.tw", "udll.tw", "usersetup.io", "kloot.hk", and more. That phish operation has a domain farm with hundreds of domains known, and probably many more that haven't been reported yet.
CastleCops identifies this as a botnet. [castlecops.com] One that buys domains with stolen credit card numbers.
Coming soon: metalists! (Score:5, Funny)
Helpful article or payola scam? (Score:5, Interesting)
I'm often too skeptical for my own britches, but that also why I do in fact pay attention to my bank's "sitekey" and why I don't these products to avoid phishing attacks. All but the last one just seem to be trading one form of ignorance - of phishing - for another - of capitalism.
The problem is the authentication mechanism! (Score:3, Informative)
The "fix" against phising is a better authentication method.
For some reason, many banks and payment providers in the US only use username/password (one-factor) authentication. In Europe most banks use at least a 2-factor security system, where the logon information is combined with either a physical security token (RSA or similar), an encryption key file, a supplemental 6 digit PIN sent by SMS to the user, etc.
The whole approach attempting to eliminate phising by filtering webpages, making fancy browser plugings or stuff a lot of security-bloatware on the computers is essentially wrong. The only reason simple phising attacks work is because the authentication mechanism is way too simple.
Adding another factor of security to the systems is a trivial task in terms of programming and implementation. And it works - the European home banking systems are the proof of that.
Phising gets a lot more difficult when SMS messages, encryption keys or physical tokens are involved in the logon procedure. Since all these methods have been well explained and documented in books ranging back to the early 80's, I really don't understand why these simple methods are so largely ignored...
Re: (Score:2)
no! the best authentication method in the world can not protect against this: http://it.slashdot.org/article.pl?sid=07/05/15/22
Re: (Score:2)
What about a Mozilla Firefox extension that provides you the ability to digitally sign HTTP requests, even those generated via AJAX calls [mozdev.org]?
Re: (Score:2)
Besides, the explanation to developers on mozdev isn't necessarily the one I'd give to grandma, but I hoped it wouldn't be necessary to say this.
For any technical comments about enigform, you are more than welcome to address the comments on the site, not to a random slashdotter.
Re: (Score:2)
Since it's still at a very early phase of development, I'd say that there's plenty of time (or none at all, if we think of the original problem) to make it work, and then make it friendly. Though it's possible that, without being somewhat friendly, it will not work -as in be useful and used- at all.
Re: (Score:2)
As long as the phishers haven't hijacked your dns settings, this method is safe. And if someone managed to either compromise your hosts file/dns servers, you have other things to worry about...
Re: (Score:2)
Pointless (Score:5, Insightful)
All of these anti-phishing tools are a waste of time. The real problem is educating users about safe computing practices.
People simply need to learn that you just don't click on a link in an unsolicited email supposedly from your bank, any more than you would deposit your paycheck into a newly opened bank branch in the nasty part of town, with shoddily painted signage and shifty-looking tellers.
98% of people can learn principles of safe computing. The remaining 2% are a lost cause. Instead of coddling people's ignorance, we should focus on education. Crooks are always going to be out there trying to take advantage of people. This problem is not going to go away or be solved by technological safeguards. It is counterproductive to devise and improve ways for people to continue ignorant, careless behaviour, "La la la, click on whatever links I see," download and run this, that and the next thing, rather than teaching them how to be careful about what code they run and where they type their password.
Re: (Score:2)
grow a brain? (Score:3, Insightful)
More pointless 'security solutions' (Score:2)
Phishing is really easy to prevent.
1. Don't submit information on non-encrypted pages
2. Check certificate to make sure it's for the company you want to send the information to.
Amazingly this is really simple, protects better than any 'anti-phishing' list and has been part of the default functionality of web browsers for many years.
The PERFECT PHISHING (Score:2, Informative)
I guess ZoneAlarm registered customers may be surprised in finding how their own original login page [zonealarm.com] works.
Even if you're not a registered user, just follow the link above and enter fake credentials.
The game becomes spicier if you have auto-completion enabled for that form...
Have fun with those antiphishing toys ;)
Original proof of concept courtesy of Elio [wilderssecurity.com], original XSS courtesy of .mario [ckers.org].
If only (Score:2)
NJ Transit [nynj.net] , PATH train [nynj.net] schedules online
Nope (Score:2)
- Banks don't send out security warnings by email with a handy link in so you can 'confirm your details'.
- Banks never ask for all of your security details even when you are logging on to their actual site - they ask for part of them only.
- And of course, you should get a teeny bit suspicious when you receive tens of 'security warnings' or similar from banks in a day, especially when you don't have account there.
The top pri
Logic, a killer feature of brain v1.0. (Score:3, Funny)
My brain features the Logic subroutine, which prevents me from falling for scams like phishing. This is a killer application; everyone should install it!
red herrings taste bad (Score:3, Insightful)
I cannnot read past this bullshit red herring line.
Not a single user I know, even understands the word "phishing".
I'm sure some Firefox proponents... (Score:3, Insightful)
My favourite: SpoofStick (Score:2)
Why do you need a Firefox extension? (Score:2)
It's simple enough: NEVER, EVER respond to an e-mail purporting to be from a bank. If your bank really need to contact you, they will find a way. If there's really a problem with your account, you will have to visit a branch to sort it out anyway. You NEVER have to "confirm your details". Barring special circumstances, there are only two valid reasons for ever visiting a bank; paying in money through the HITW machine, and
Re: (Score:3, Funny)
Re: (Score:2)
grr, wanted to say this (Score:2)