12966916 phishing ppt
TRANSCRIPT
PHISHING BASICS
• Pronounced "fishing“• The word has its Origin from two words “Password Harvesting” or fishing
for Passwords• Phishing is an online form of pretexting, a kind of deception in which an
attacker pretends to be someone else in order to obtain sensitive information from the victim
• Also known as "brand spoofing“• Phishers are phishing artists
Dept. of I&CT, MIT, Manipal
COMPARISON TO SPAM
Dept. of I&CT, MIT, Manipal
• The purpose of a phishing message is to acquire sensitive information about a user. For doing so the message needs to deceive the intended recipient.
• So it doesn’t contains any useful information and hence falls under the category of spam.
• A spam message tries to sell a product or service, whereas phishing message needs to look like it is from a legitimate organization.
• Techniques applied to spam message cant be applied naively to phishing messages.
ANATOMY OF PHISHING MESSAGE
Dept. of I&CT, MIT, Manipal
A raw phishing message can be split into two components:
• Content • Headers
ANATOMY OF PHISHING MESSAGE
Dept. of I&CT, MIT, Manipal
Sting
CONTENT
Dept. of I&CT, MIT, Manipal
It is further subdivided into two parts:
• Cover• Sting
HEADERS
Dept. of I&CT, MIT, Manipal
It is further subdivided into two parts:
• Mail clients• Mail relays
WHY PHISHING ATTACK!
Dept. of I&CT, MIT, Manipal
Lack of Knowledge• computer system • security and security indicators• web fraud
Visual Deception• Visually deceptive text• Images masking underlying text
Lack of computer knowledge
www.ebay.com www.ebay-members-security.com
Dept. of I&CT, MIT, Manipal
Lack of knowledge of security and security indicators
Dept. of I&CT, MIT, Manipal
Lack of knowledge of web-fraud
Dept. of I&CT, MIT, Manipal
Visually Deceptive Text
Original website Phishing website
Dept. of I&CT, MIT, Manipal
Image Masking Underlying Text
Dept. of I&CT, MIT, Manipal
MANTRA OF PHISHERS
Dept. of I&CT, MIT, Manipal
Configuration
NeglectDeceit
Legal Response
Dept. of I&CT, MIT, Manipal
• In the United State, Senator Patrick Leahy introduced the Anti-Phishing Act of 2005 in Congress on March 1, 2005.
How to Avoid being a Phishing victim
Dept. of I&CT, MIT, Manipal
1. Never respond to requests for personal information via email. When in doubt, call the institution that claims to have sent you the email.E.g. “Dear Sir or Madam” rather than “Dear Dr. Phatak”
2. If you suspect the message might not be authentic, don't use the links within the email to get to a web page.
3. Never fill out forms in email messages that ask for confidential information
How to Avoid being a Phishing victim…
Dept. of I&CT, MIT, Manipal
How to Avoid being a Phishing victim…
4. Always ensure that you're using a secure website when submitting credit card or other sensitive information via your web browser
• check the beginning of the Web address in your browsers address bar - it should be ‘https://’ rather than just ‘http://’
• look for the locked padlock icon on your browser (i.e.Netscape/Mozilla)
Dept. of I&CT, MIT, Manipal
How to Avoid being a Phishing victim…
5. Regularly check your bank, credit and debit card statements to ensure that all transactions are legitimate and if anything is suspicious, contact your bank and all card issuers immediately
6. Ensure that your browser and OS software is up-to-date and that latest security patches are applied
Dept. of I&CT, MIT, Manipal
How to Avoid being a Phishing victim…
7. Verify the real address of a web site.
• javascript:alert("The actual URL of this site has been verified as: " + location. protocol + "//" + location. hostname +"/");
Dept. of I&CT, MIT, Manipal
ANALYSIS OF A PHISHING DATABASE
The Anti Phishing Working Group maintains a “Phishing Archive” • Certificate (digital certificate, public key certificate)• Certificate Authority (CA)• HTTPS• Secure Sockets Layer (SSL) and Transport Layer Security(TLS)
Dept. of I&CT, MIT, Manipal
MANTRA OF VICTIMS
Dept. of I&CT, MIT, Manipal
Myths
SolutionFact
REFERENCES1. Cannon, J.C. Privacy. Pearson Education, 2005.2. Hilley, Sarah. “Internet war: picking on the finance Sector-survey.” Computer
Fraud & Security, October 2006.3. Bellowing, Steven. “Spamming, Phishing, Authentication and Privacy.” Inside
Risks, December 20044. Mulrean, Jennifer. “Phishing scams: How to avoid Getting hooked.” Dollar Wise.5. Hunter, Philip. “Microsoft declares war on phishers.” Computer Fraud & Security
May 2006: 6. Google. http://www.google.com7. Anti-Phishing Working Group. Phishing Activity Trends Report November 2005 8. Anti-Phishing Working Group Phishing Archive.
http://antiphishing.org/phishing_archive.htm9. Ba, S. & P. Pavlov. Evidence of the Effect of Trust Building Technology in Electronic
Markets: Price Premiums and Buyer Behavior.
Dept. of I&CT, MIT, Manipal
Dept. of ICT, MIT, Manipal
Dept. of I&CT, MIT, Manipal
THANK YOU