Phishing Attacks: Information Flow and Chokepoints

Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft

Volumn , Issue , 2006, Pages 31-63

  Emigh, Auron ^a  

^a Radix Labs   (United States)

Author keywords

Chokepoints; Deceptive phishing; Information flow; Pharming; Phishing attacks

Indexed keywords

EID: 84889328778     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1002/9780470086100.ch2     Document Type: Chapter

References (29)

1. PassMark Security, Inc. http://www.passmarksecurity.com.
2. Testimony of Kurt Sanford before the US Senate Committee on Commerce, Science and Transportation Hearing on Identity Theft and Data Broker Services, May 10 2005.
3. B. Adida, D. Chau, S. Hohenberger, and R. L. Rivest. Lightweight signatures for email, draft of June 18, 2005; to appear.
4. E. Allman, J. Callas, M. Delany, M. Libbey, J. Fenton, and M. Thomas. DomainKeys identified email (DKIM). Internet Draft, October 2005.
5. C. Anley. Advanced SQL injection in SQL Server applications. Technical report, NGSSoftware Insight Security Research technical report, 2002.
6. M. Bellare and P. Rogaway. The AuthA protocol for password-based authenticated key exchange. Contribution to IEEE PI363.2, March 2000.
7. A. Brusilovsky. Password authenticated diffie-hellman exchange (PAK). Internet Draft, October 2005.
8. N. Chou, R. Ledesma, Y. Teraguchi, and J. Mitchell. Client-side defense against web-based identity theft. In 11th Annual Network and Distributed System Security Symposium (NDSS '04), San Diego, February 2004.
9. M. Delany. Domain-based email authentication using public-keys advertised in the DNS (Do-mainKeys). Internet Draft, September 2005.
10. J. Fenton and M. Thomas. Identified internet mail. Internet Draft, May 2005.
11. E. Gabrilovich and A. Gontmakher. The homograph attack. Communications of the ACM, 45(2): 128, February 2002.
12. Goodmail. CertifiedEmail service, http://www.goodmailsysteras.com/certifiedmail/.
13. B. Hoanca and K. Mock. Screen-oriented technique for reducing the incidence of shoulder surfing. In Security and Management '05. Las Vegas, June 2005.
14. D. P. Jablon. Strong password-only authenticated key exchange. Submission to IEEE P1363.2, September 1996.
15. M. Jakobsson, A. Young, and A. Emigh. Distributed phishing attacks. Manuscript.
16. P. Kay. Eliminating spam and enabling email privacy through the use of programmable email addresses. Technical report, Titan Key Software technical report, August 2004.
17. B. Krebs. Computers seized in data-theft probe. Washington Post, May 19 2005.
18. T. Kwon. Summary of AMP (authentication and key agreement via memorable passwords). Submission to IEEE 1363.2, August 2003.
19. J. Lyon and M. Wong. Sender ID: Authenticating e-mail. Internet Draft, May 2005.
20. P. MacKenzie and R. Swaminathan. Secure network authentication with password identification. Submission to IEEE 1363.2, July 1999.
21. M. Nystrom. The SecurlD? SASL mechanism. IETF RFC 2808, April 2000.
22. G. Ollmann. HTML code injection and cross-site scripting. Technical report, Technicallnfo.
23. A. Rager. Advanced cross-site-scripting with real-time remote attacker. Technical report, Avaya Labs, February 2005.
24. E. Rescorla. Optimal time to patch revisited. RTFM.com working paper.
25. B. Ross, C. Jackson, N. Miyake, D. Boneh, and J. C. Mitchell. Stronger password authentication using browser extensions. In Proceedings of the 14th Usenix Security Symposium, 2005.
26. L. Sobrado and J. C. Birget. Shoulder surfing resistant graphical passwords. http://clam.rutgers.edu/~birget/grPssw/srgp.pdf, Draft of April 2005.
27. M. Wong and W. Schlitt. Sender policy framework (SPF) for authorizing use of domains in e-mail. Internet Draft, June 2005.
28. M. Wu, R. Miller, and S. Garfinkel. Do security toolbars actually present phishing attacks? In Symposium On Usable Privacy and Security 2005.
29. T. Wu. The secure remote password protocol. In Proceedings of the 1998 Internet Society Network and Distributed System Security Symposium, March 1998.