Difference between revisions of "BioSec: DNMar23"
Jump to navigation
Jump to search
| Line 4: | Line 4: | ||
* input validation | * input validation | ||
* phishing | * phishing | ||
** banking | |||
** want credentials | |||
** using email | |||
** send an email that looks like it comes from the bank | |||
** link goes to malicious site that looks arbitrarily like the bank (unpack) | |||
** user types in credentials, potentially gets transparently redirected to real bank site | |||
** banking | |||
** want credentials | |||
** using email | |||
** send an email that looks like it comes from the bank | ** send an email that looks like it comes from the bank | ||
** link goes to malicious site that looks arbitrarily like the bank (unpack) | ** link goes to malicious site that looks arbitrarily like the bank (unpack) | ||
Revision as of 11:21, 26 March 2012
Possible Security problems
- misuse of data
- input validation
- phishing
- banking
- want credentials
- using email
- send an email that looks like it comes from the bank
- link goes to malicious site that looks arbitrarily like the bank (unpack)
- user types in credentials, potentially gets transparently redirected to real bank site
- banking
- want credentials
- using email
** send an email that looks like it comes from the bank ** link goes to malicious site that looks arbitrarily like the bank (unpack) ** user types in credentials, potentially gets transparently redirected to real bank site
Problems arise from:
* illegitimate email * link to site that looks like bank but isn’t * credentials being entered in wrong domain, wrong page * misappropriated language, images in email, site * bad/missing/suspect cert? ** cert/credential combo suspect
Human algorithm:
* is domain same for the one where we normally send credentials * not normally in response to email request * certificate is the same
Think of individual detectors as autonomous:
* how would they be useful? * how would they work? to detect? * how should they change system state in the normal case?
List of individual detectors
image filename check
context / semantic word descriptions --> semantic integrity - verifying message / content integrity based on the content itself - even if it is digitally signed.
spellcheck
domain / ip address check
certificate check - issuer name, domain name, client name, date of issue, date of expiry