Invasive browser sniffing and countermeasures

ABSTRACT

We describe the detrimental effects of browser cache/history sniffing in the context of phishing attacks, and detail an approach that neutralizes the threat by means of URL personalization; we report on an implementation performing such personalization on the fly, and analyze the costs of and security properties of our proposed solution.

REFERENCES

• 1: C. Jackson, A. Bortz, D. Boneh, J. C. Mitchell, "Web Privacy Attacks on a Unified Same-Origin Browser," in submission.
• 2: Edward W. Felten , Michael A. Schneider, Timing attacks on Web privacy, Proceedings of the 7th ACM conference on Computer and communications security, p.25-32, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352606]
• 3: T. Jagatic, N. Johnson, M. Jakobsson, F. Menczer: Social Phishing. 2006
• 4: M. Jakobsson, T. Jagatic, S. Stamm, "Phishing for Clues," tt www.browser-recon.info
• 5: M. Jakobsson "Modeling and Preventing Phishing Attacks." Phishing Panel in Financial Cryptography '05. 2005.
• 6: B. Grow, "Spear-Phishers are Sneaking in." BusinessWeek, July 11 2005. No. 3942, P. 13
• 7: M. Jakobsson and S. Myers, "Phishing and Counter-Measures: Understanding the Increasing Problem of Electronic Identity Theft." Wiley-Interscience (July 7, 2006), ISBN 0-4717-8245-9.
• 8: www.securiteam.com/securityreviews/5GP020A6LG.html
• 9: www.robotstxt.org/

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications
          Subjects: Information browsers

General Terms:
Human Factors, Security

Keywords:
browser cache, cascading style sheets, personalization, phishing, sniffing