Fighting phishing at the user interface
نویسنده
چکیده
The problem that this thesis concentrates on is phishing attacks. Phishing attacks use email messages and web sites designed to look as if they come from a known and legitimate organization, in order to deceive users into submitting their personal, financial, or computer account information online at those fake web sites. Phishing is a semantic attack. The fundamental problem of phishing is that when a user submits sensitive information online under an attack, his mental model about this submission is different from the system model that actually performs this submission. Specifically, the system sends the data to a different web site from the one where the user intends to submit the data. The fundamental solution to phishing is to bridge the semantic gap between the user’s mental model and the system model. The user interface is where human users interact with the computer system. It is where a user’s intention transforms into a system operation. It is where the semantic gap happens under phishing attacks. And therefore, it is where the phishing should be solved. There are two major approaches to bridge the semantic gap at the user interface. One approach is to reflect the system model to the user. Anti-phishing toolbars and the browser’s security indicators take this approach. User studies in this thesis show that this approach is not effective at preventing phishing. Users are required to constantly pay attention to the toolbar and are expected to have the expertise to always correctly interpret the toolbar message. Normal users meet neither of these requirements. The other approach is to let users tell the system their intentions when they are submitting data online. The system can then check if the actual submission meets the user’s intention or not. If there is a semantic gap, the system can effectively warn the user about this discrepancy and provide a safe path to the user’s intended site. Web Wallet, designed and implemented as a new anti-phishing solution, takes this approach. It is a dedicated browser sidebar for users to submit their sensitive information online. User studies in this thesis shows that Web Wallet is not only an effective and promising anti-phishing solution but also a usable personal information manager.
منابع مشابه
Alice, what did you do last time? Fighting Phishing Using Past Activity Tests
Phishing attacks are one of the most crucial modern security threats in the current World Wide Web. An adversary may clone a legitimate Web site and lure a user to submit her credentials to the malicious construct. The adversary may then use the stolen credentials to the authentic site. In this paper we present a novel idea to fight phishing using Past Activity Tests (PACTs). In a nutshell, PAC...
متن کاملBayeShield: A Conversational Anti-Phishing User Interface
In this paper we present BayeShield, a novel anti-phishing tool that uses a conversational approach to partner with users in determining whether a website is phishing when the website is suspicious but not blacklisted. We describe the iterative user-centered development of BayeShield's user interface, discussing its evolution and the design principles we followed. In an empirical evaluation, Ba...
متن کاملUniversity of California Riverside Fighting Spam, Phishing and Email Fraud
OF THE THESIS Fighting Spam, Phishing and Email Fraud
متن کاملTowards Multicolored Computing - Compartmented Security to Prevent Phishing Attacks
Identity theft through phishing attacks has fostered to a major concern of Internet users. Classical phishing attacks aim at luring the user to a faked web site to disclose personal information. Various solutions have been proposed against this kind of attack. However, these solutions can hardly counter the new generation of sophisticated malware phishing attacks designed to target certain serv...
متن کاملPhish Phinder: A Game Design Approach to Enhance User Confidence in Mitigating Phishing Attacks
Phishing is an especially challenging cyber security threat as it does not attack computer systems, but targets the user who works on that system by relying on the vulnerability of their decision-making ability. Phishing attacks can be used to gather sensitive information from victims and can have devastating impact if they are successful in deceiving the user. Several anti-phishing tools have ...
متن کامل