BioSec: DNMar23 - Revision history

Afry: /* List of individual detectors */

2012-03-28T13:50:33Z

List of individual detectors

← Older revision		Revision as of 13:50, 28 March 2012
Line 103:		Line 103:
	* '''Safe browsing sensor'''		* '''Safe browsing sensor'''
	** Does the URL get flagged when submitted to the [http://code.google.com/apis/safebrowsing/ Google Safebrowsing API]?		** Does the URL get flagged when submitted to the [http://code.google.com/apis/safebrowsing/ Google Safebrowsing API]?

			* '''Retrieve the page naturally, and through a proxy'''
			** See if the information retrieved is different from different network "perspectives"

2012-03-27T23:26:27Z

List of individual detectors

@@ Line 54: / Line 54: @@
 = List of individual detectors =
-* image filename check
+* '''Image filename/content sensor'''
-* context / semantic word descriptions --> semantic integrity - verifying message / content integrity based on the content itself - even if it is digitally signed.
+** A fuzzy hash/fingerprinting technique of the images would be another idea.
-* spellcheck
+*** Could hook into something like [http://www.tineye.com/commercial_api TinEye]
-* domain / ip address check
-* certificate check - issuer name, domain name, client name, date of issue, date of expiry
+* '''Cascading Stylesheet sensor''' -- a sort of visual appearance sensor.

2012-03-26T23:53:15Z

List of individual detectors

← Older revision		Revision as of 23:53, 26 March 2012
Line 54:		Line 54:
	= List of individual detectors =		= List of individual detectors =

	image filename check		* image filename check
			* context / semantic word descriptions --> semantic integrity - verifying message / content integrity based on the content itself - even if it is digitally signed.
	context / semantic word descriptions --> semantic integrity - verifying message / content integrity based on the content itself - even if it is digitally signed.		* spellcheck
			* domain / ip address check
	spellcheck		* certificate check - issuer name, domain name, client name, date of issue, date of expiry

	domain / ip address check

	certificate check - issuer name, domain name, client name, date of issue, date of expiry

2012-03-26T23:52:34Z

Possible Security problems

@@ Line 1: / Line 1: @@
-== Possible Security problems ==
+== Design Exercise: Phishing ==
-* misuse of data
+How can we design an anti-phishing strategy that uses a biological approach?
-Problems arise from:
+Some of the problems that arise in phishing are related to:
-* illegitimate email
+* faked email
 * link to site that looks like the bank but isn't the bank
 * credentials being entered in wrong domain, wrong page
-* misappropriated text, images in email, site images
+* misappropriated text and images (both in email, and on the faked website)
 * bad/missing/suspect certificate
 ** certificate/credential combination is suspect
@@ Line 29: / Line 30: @@
 * how would they work? to detect?
 * how should they change system state in the normal case?
 = List of individual detectors =

2012-03-26T15:24:54Z

Possible Security problems

← Older revision		Revision as of 15:24, 26 March 2012
Line 19:		Line 19:
	* bad/missing/suspect certificate		* bad/missing/suspect certificate
	** certificate/credential combination is suspect		** certificate/credential combination is suspect




	Human algorithm:		Human algorithm:
	* is domain same for the one where we normally ~~send credentials~~		* is the domain the same for the one where credentials are normally sent?
	* not normally in response to email request		* not normally in response to email request
	* certificate is the same		* certificate is the same

	Think of individual detectors as autonomous:		Think of individual detectors as autonomous:
	* how would they be useful?		* how would they be useful?
	* how would they work? to detect?		* how would they work? to detect?
	* how should they change system state in the normal case?		* how should they change system state in the normal case?

	= List of individual detectors =		= List of individual detectors =

2012-03-26T15:23:31Z

Possible Security problems

← Older revision		Revision as of 15:23, 26 March 2012
Line 13:		Line 13:

	Problems arise from:		Problems arise from:
			* illegitimate email
			* link to site that looks like the bank but isn't the bank
			* credentials being entered in wrong domain, wrong page
			* misappropriated text, images in email, site images
			* bad/missing/suspect certificate
			** certificate/credential combination is suspect

	* illegitimate email
	* link to site that looks like bank but isn’t
	* credentials being entered in wrong domain, wrong page
	* misappropriated language, images in email, site
	* bad/missing/suspect cert?
	** cert/credential combo suspect

2012-03-26T15:21:56Z

Possible Security problems

← Older revision		Revision as of 15:21, 26 March 2012
Line 11:		Line 11:
	** user types in credentials, potentially gets transparently redirected to real bank site		** user types in credentials, potentially gets transparently redirected to real bank site

	** banking
	** want credentials
	** using email
	** send an email that looks like it comes from the bank
	** link goes to malicious site that looks arbitrarily like the bank (unpack)
	** user types in credentials, potentially gets transparently redirected to real bank site

	Problems arise from:		Problems arise from:

2012-03-26T15:21:32Z

Possible Security problems

← Older revision		Revision as of 15:21, 26 March 2012
Line 4:		Line 4:
	* input validation		* input validation
	* phishing		* phishing
	** banking		** banking
	** want credentials		** want credentials
	** using email		** using email
			** send an email that looks like it comes from the bank
			** link goes to malicious site that looks arbitrarily like the bank (unpack)
			** user types in credentials, potentially gets transparently redirected to real bank site

			** banking
			** want credentials
			** using email
	** send an email that looks like it comes from the bank		** send an email that looks like it comes from the bank
	** link goes to malicious site that looks arbitrarily like the bank (unpack)		** link goes to malicious site that looks arbitrarily like the bank (unpack)

2012-03-26T15:18:08Z

Possible Security problems

@@ Line 1: / Line 1: @@
 == Possible Security problems ==
-- misuse of data
+* misuse of data
-- input validation
+Problems arise from:
   * illegitimate email
   * link to site that looks like bank but isn’t
   * credentials being entered in wrong domain, wrong page
   * misappropriated language, images in email, site
   * bad/missing/suspect cert?
-  - how should they change system state in the normal case?
+Human algorithm:
 = List of individual detectors =

2012-03-26T14:35:48Z

List of individual detectors

← Older revision		Revision as of 14:35, 26 March 2012
Line 58:		Line 58:
	image filename check		image filename check

	context / semantic word descriptions		context / semantic word descriptions --> semantic integrity - verifying message / content integrity based on the content itself - even if it is digitally signed.

	spellcheck		spellcheck