Phishing Secrets: History, Effects, Countermeasures

This paper presents the results of a study performed over phishing threats and vulnerabilities present in nowadays authentication environments. The main goal of this paper is to present our solution, the anti-phishing model which can be applied to any web environment, and not just to e-banking or the financial sector, without limitations nor additional requirements. We start presenting a brief history of phishing, common solutions, some statistics about phishing attempts, social impact and monetary losses and our patented anti-phishing model. Following is an explanation about how different vulnerabilities have been addressed such as Man-In-The-Middle attacks, phishing, pharming, SQL injection, social engineering, format string attacks, buffer overflow, brute force and many other vulnerabilities. The proposed method has been the basis of a PhD thesis aimed at defining a model for secure operation of an Internet Banking environment, even in the presence of malware on the client side. The authentication model is based on a mutual multi-factor authentication process where both entities must be authenticated with more than one authentication factor. The proposed model has been designed to be easily applicable with minimum impact to the current Internet banking systems. Its goal is to be resistant to the nowadays too frequent phishing and pharming attacks, and also to more classical ones like social engineering or man-in-the-middle attacks. The key point of this model is the need for multi-factor mutual authentication, instead of simply basing the security on the digital certificate of the financial entity, since in many cases users are not able to discern the validity of a certificate, and may not even pay attention to it. Thanks to the rules defined in this proposal, the security level of the Web Banking environment will increase and customers’ trust will be enhanced, thus allowing a more beneficial use of this service. The proposed model has been simulated in order to demonstrate its effectiveness and feasibility.