Difference between revisions of "BioSec: DNMar23"
Jump to navigation
Jump to search
| Line 57: | Line 57: | ||
image filename check | image filename check | ||
context / semantic word descriptions | context / semantic word descriptions | ||
spellcheck | spellcheck | ||
domain ip address check | |||
certificate check | domain / ip address check | ||
certificate check - issuer name, domain name, client name, date of issue, date of expiry | |||
Revision as of 10:44, 23 March 2012
Possible Security problems
- misuse of data
- input validation
- phishing
- banking
- want credentials
- using email
- send an email that looks like it comes from the bank
- link goes to malicious site that looks arbitrarily like the bank (unpack)
- user types in credentials, potentially gets transparently redirected to real bank site
problem arises from:
* illegitimate email
* link to site that looks like bank but isn’t
* credentials being entered in wrong domain, wrong page
* misappropriated language, images in email, site
* bad/missing/suspect cert?
- cert/credential combo suspect
Human algorithm
is domain same for the one where we normally send credentials
not normally in response to email request
cert is the same
Think of individual detectors as autonomous
- how would they be useful?
- how would they work? to detect?
- how should they change system state in the normal case?
List of individual detectors
image filename check
context / semantic word descriptions
spellcheck
domain / ip address check
certificate check - issuer name, domain name, client name, date of issue, date of expiry