5 ms·
Web-based phishing has become a game of speed. Domains are not expected to survive more than an hour (and few do), even with all kinds of countermeasures in pla
by heipei 7y ago
Web-based phishing has become a game of speed. Domains are not expected to survive more than an hour (and few do), even with all kinds of countermeasures in place (browser / geo detection, destroy-after-first-use links, etc). Yet it's still economically viable to do. Companies offering blocking products like Google Safe Browsing have been forced to increase the frequency of their blacklist, up to the point where Google had to resort to checking suspicious URLs against their online database rather than a cached local index.
This is a classical arms-race and will only intensify. With domains that look generic enough and only serve malicious traffic when hit with the right URL, parameters, user-agent and geographical location, blocking will have to rely on sourcing these URLs directly from the targeted endpoints (e.g. SMS/WhatsApp/Email), rather than "crawling" or relying on users to report these. Another approach is to do some of the blocking locally, which of course means pushing the detection logic to the client and thus exposing the classification mechanism. Neither approach is sustainable long-term in my opinion.
- solarkraft 7y agoIt seems to me that a list of known good domains provided by a large browser vendor (Google) with extra treatment in the browser might be the most effective against phishing and other scams. This could be sold as an add-on for a certificate, or something like that, with a just high enough barrier for proving authenticity. Known-good domains could then additional treatment, like a blue padlock or one with a star (ok, I'm not an icon designer). Of course you can argue against it on a freedom basis, but I think for protecting vulnerable web users it'd be pretty useful.
- Spivak 7y agoYour idea isn’t that weird. If you do it right you’re basically inventing the Web of Trust. As long as you put the user in control of what entitles they trust to validate sites it would actually be a super useful feature. The problem is always the political one. What does, say, Microsoft vouching for a site actually mean?
- heipei 7y agoYou're not that far off. If you took the Alexa Top 100k sites and display some kind of indication whenever a page isn't on that list you would be able to stop the most obvious phishing attempts. Google has a Safe Browsing Extension which, as its first steps, checks the 15k most common sites or so. If you tailor these lists to specific countries I'd wager you can get away with even fewer entries. There's other tricks that scammers pull though, like compromising legitimate domains with a certain reputation and then adding their scammy subdomains, but that's a lot harder to pull off than just registering 100 free domains everyday and hoping one sticks.
- lonelappde 7y agoSecurity measures like that becomes "Google abuses its monopoly to suppress competition" complaints that are frontpaged here every week.
- imtringued 7y ago>Domains are not expected to survive more than an hour (and few do), So if they have solved the problem why are we still complaining about it? All you need to do is show a big warning message for domains that are younger than 1-2 days.
- dane-pgp 7y agoUnfortunately the malicious domain could be registered for days or weeks before being used in a campaign. The time that the domain is in stealth mode doesn't incur any extra cost to the spammer, and nor does it give any clues to the blacklisters that the domain is about to host something malicious. If there were some way of bootstrapping new domains with some sort of positive trust signal (e.g. links from domains that have been in use for a long time?) then it might be possible to preemptively blacklist domains, as you say, but there are potential anti-trust issues with any such system that dissuades people from accessing the websites of new companies, for example.