Phishing Defense Against IDN Address Spoofing Attacks

Phishing Defense against IDN Address Spoofing Attacks Viktor Krammer 1,2 1 E-Commerce Competence Center 2 Vienna University of Technology Vienna, Austria [email protected] ABSTRACT fake mails sent to potential victims. Phishing has been al- Address spoofing is a common trick used in phishing scams ready discussed one decade ago under the more general term Web spoofing in literature [15]. to confuse unsuspecting users about a Web site’s real ori- 1 gin. With the introduction of Unicode characters into do- A real-world phishing incident was recently reported in main names, also known as Internationalized Domain Names Austria targeting the Bank Austria Web site located at www. (IDN), the risk has significantly increased even for the most ba-ca.com by registering the fake domain ba-cq.com. cautious users. The author explores the various types of While this classic address spoofing attack can be discov- address spoofing attacks focusing on IDN, and presents a ered by carefully looking at the current URL, the recently in- novel client-side Web browser plug-in Quero which imple- troduced concept of Internationalized Domain Names (IDN) ments several techniques—including highlighting—to pro- can be taken advantage of to spoof addresses which are no tect the user against visually undistinguishable address ma- longer visually distinguishable from their legitimate counter- nipulations. parts. Simplified IDN extends the repertoire of registrable characters to (a subset of) Unicode [1] (version 3.2). How- ever, due to compatibility considerations, this is not done Categories and Subject Descriptors by a modification to DNS, but left to a client-side resolver D.2 [Software]: Software Engineering; H.5.2 [Information referred to as IDNA (Internationalizing Domain Names in Systems]: Information Interfaces and Presentation—User Applications), which transparently maps Unicode domain Interfaces labels to ASCII-only, DNS-compatible labels and vice versa. Although the authors of IDNA had security in mind, Ga- brilovich and Gontmakher [16] discovered a possible attack General Terms scenario, called the homograph attack, in which the char- Security, Algorithms, Design acters might be replaced by visually identical ones (homo- graphs)2 found in Unicode. Attempts to show only the Keywords ASCII representation of IDN domains in Web browsers or restrict the use of Unicode characters depending on the top- Internet Security, Phishing, Internationalized Domain Names, level domain have so far enjoyed only moderate success. Unicode, Usability, Web Browsers, Internet Explorer “Users can not reliably parse domain names” [12], a reality we must face given the steadily growing number of inexpe- 1. INTRODUCTION rienced Web users. Phishing has become a widespread problem of today’s In- In this article I focus on IDN address spoofing attacks ternet by tricking unsuspecting users into revealing sensitive and propose techniques to protect the user and help her de- information, such as login credentials, on fake Web sites. tect suspicious characters in domain names by following the The URL displayed in the address bar of the Web browser is recently published Unicode Security Considerations [11]. I for many users a trustworthy reference point for their current have implemented an IDN enabling plug-in for Internet Ex- 3 location in the World Wide Web. Furthermore, the domain plorer, called Quero Toolbar [26], and experimented with name has the potential to indicate the origin of the content, the proposed anti-spoofing techniques. In section 2 I dis- a circumstance that is commonly exploited by “phishers” cuss the different types of address spoofing in more detail, and referred to as address spoofing. followed by a list of requirements that an efficient solution Other techniques typically used in phishing attacks in- should take into account in section 3. Section 4 presents my clude content spoofing and spamming, the former referring solution, implemented in Quero, which is briefly described to their resemblance to original Web sites and the latter to in section 5. Related work is discussed in section 7 and con- cluding remarks are given in section 8. Permission to make digital or hard copies of all or part of this work for 1http://futurezone.orf.at/it/stories/86570/ personal or classroom use is granted without fee provided that copies are 2 not made or distributed for profit or commercial advantage and that copies Unicode defines for example the Latin small letter ‘a’ bear this notice and the full citation on the first page. To copy otherwise, to (U+0061) and the Cyrillic small letter ‘a’ (U+0430) as different code points. republish, to post on servers or to redistribute to lists, requires prior specific 3 permission and/or a fee. Quero Toolbar is freeware and has been downloaded over Copyright Viktor Krammer, May 2006. 10,000 times between 01/2005–01/2006 1 2. TYPES OF ADDRESS SPOOFING Example: http://www.ebay.com:8080@login. ATTACKS dll-from-email-satitle-update-user-information. secure-connection.attackersdomain.com/... Basically, what all address spoofing attacks have in common is that they lead the user to think she is on a legitimate 2.1.3 Confusion by Random Addresses Web site while actually viewing a fake page. This is achieved by crafting a URL that resembles so closely or is even indis- Although this is not really an address spoofing attack, it tinguishable from the real address so that the user does not is often encountered in phishing scams. The attacker either notice the trick. Address spoofing attacks can be classified does not try to disguise the address at all or relies on a into attacks that rely on user confusion and mistakes, vul- serious-sounding address that has nothing in common with nerabilities in either the Web browser or the legitimate Web the legitimate one. site and visual ambiguity between the encoding of the ad- For instance, http://secure-user-survey.com/exec/ dress and its visual representation. The focus in this article obidos/subst/home/ may mislead users into disclosing per- is mainly on the last type of spoofing, involving security is- sonal information. This attack works best if the user does sues that were introduced or aggravated by the adoption of not look at the address at all. Internationalized Domain Names. Attacks based on software 2.2 Vulnerability-based Attacks vulnerabilities or IDN encoding ambiguity are considered to be the most dangerous, because they can also fool the most This type of address spoofing attack relies on security flaws Internet-savvy user. Below I give a summary of the various in either the Web browser (client-side) or the Web applica- types of address spoofing attacks. tion of the victim’s Web site (server-side), and is therefore very dangerous and hard to detect. 2.1 User Confusion-based Attacks 2.2.1 Client-side Vulnerabilities 2.1.1 Confusion by Name Similarity An historic example is for instance the vulnerability doc- The attacker registers a slightly different domain name umented in the Secunia Advisory SA12304 [33], where In- than the real one. For instance, southtrustonlines.com ternet Explorer fails to update the address bar after a se- instead of southtrust.com. This works because registrars quence of actions is performed on a named window. Al- do not manually review each registration and do not perform though marked as unpatched by Secunia, IE 6.0 SV1 is not similarity checks. Additionally, the attacker might use a fake affected by this vulnerability. Quero’s pop-up blocker blocks or stolen identity for the registration. this attack as well. Another client-side vulnerability in IE known as chrome 2.1.2 Confusion by Address Complexity UI spoofing allows an attacker to spoof elements of the browser’s The simplest and most common form found in phishing UI by creating chromeless pop-up windows [5]. Actual phish- scams is a URL with an IP address. According to the phishing attacks use this to overlay the address bar with the origi- ing archive of the Anti-Phishing Working Group4, a real- nal address of the Web site being spoofed. IE 6.0 SV1 limits world attack used for example the following URL: the ability of chrome UI spoofing by restricting the position where such pop-up windows may appear [2]. http://61.129.33.105/secured site/www.skyfi.com/ index.html?MfcISAPICommand=SignInFPP&UsingSSL=1 2.2.2 Server-side Vulnerabilities In these attacks, mainly based on cross-site scripting vul- Often the attacker tries to confuse the user by the sheer nerabilities, malicious content is injected into the victim’s length of the address by adding a cryptic query string and Web site. Strictly speaking, this kind of attack is not an mentioning the original name of the victim’s Web site some- address spoofing attack but the symptoms are the same, where in it to make the address look more familiar. A variant leading the user to believe she is viewing content from the of this attack type is subdomain spoofing, which takes ad- legitimate site when in fact she is not. vantage of the fact that the host name is displayed in least significant label first order. By crafting a sufficiently long 2.3 IDN-based Attacks chain of subdomains the important part of the address, usu- While the former address spoofing attacks are on a word ally the second/third level domain label, may no longer fit or more abstract level, we define IDN-based attacks as being into the visible part of the address field, fooling gullible users on a lower, character-based level, particularly exploiting the into thinking that the domain name is the first part of the encoding subtleties of Unicode. There have been no real- URL.

Load more