Client-side defenses against web-based identity theft
|
|
|
- Tyrone Richard
- 6 years ago
- Views:
Transcription
1 Client-side defenses against web-based identity theft Students: Robert Ledesma, Blake Ross, Yuka Teraguchi Faculty: Dan Boneh and John Mitchell Stanford University PORTIA Project 1
2 Phishing Attack Spam There is a problem with your ebay account. Information is sent to the bad guy. password? User clicks on link to go to badguy.com. User thinks it is ebay.com, and enters ebay username and password. 2
3 Sample phishing 3
4 Spoof page 4
5 Magnitude of problem Fastest growing crime on the Internet. Primary targets: attacks/month (2004) July June May Jan Citibank US Bank ebay
6 Properties of Spoof Sites Ask for user input, e.g. password. Some ask for CCN, SSN, mother s maiden name, HTML copied from honest site Contain links to the honest site Logos from honest site. Copied jpg/gif file, or link to honest site Can contain revealing mistakes Clever spoof pages contain Javascript to fool user. Short lived Blacklisting spoof sites has limited success. HTTPS uncommon 6
7 Thanks! Robert Rodriguez Chris Von Holt Alissa Cooper Tom Pageler Greg Crabb Many more 7
8 What can we do about phishing? Spam filter: Phishing starts with , so stop it there. Non-trivial: phishing s look like ordinary . Browser-side methods (plug-ins) Detect spoof web site. Warn user. Improve browser password management. This talk: SpoofGuard Server-side methods: Use strong user authentication instead of pwds. User certificates or security tokens. 8
9 Our project at Stanford Two browser plug-ins available for download: SpoofGuard: Alerts user when browser is viewing a spoofed web page. Uses variety of heuristics to identify spoof pages. PwdHash: Simple mechanism for improving password management by the browser. Will SpoofGuard solve the phishing problem? As likely to end phishing as first virus scanner was to end viruses A new type of anomaly detection problem 9
10 SpoofGuard: Detect Phishing Web Sites 10
11 SpoofGuard Browser Plug-in Compute spoof index: Weighted sum of several spoof measures Depends on current page and history Provides two forms of information: Passive stoplight in toolbar: green, yellow, red Active pop-up when necessary Stop outgoing information to malicious web site Challenges: Must be easy for novice users. Detect malicious pages Minimize false alarms 11
12 Stateless Page Evaluation URL Check: Similar to well known site IP address instead of host name Other tricks Use reverse DNS to find domain if IP address Image Check: Is image associated with different domain in imagedomain database 12
13 Stateless Page Evaluation II Link Check: Run URL check on links on the page If significant fraction fail, raise alert Password Check: Pages with password field are more suspicious than the one without HTTPS and certificate validation 13
14 Stateful Page Evaluation History Check: Site is assumed OK if in user s history file Very important for false alarm rate Domain Check: Is current domain similar to a domain in the history list? Check: Suspicious if page is referred by link 14
15 POST Data Evaluation Intercepts and checks POST data Keep hashed <domain, user, password> triples If known user & password are sent to different domain, raise alert level Exception for search engines High alert: warn user and allow to cancel operation POST: user_name=ice&password=cream User Suspicious server 15
16 PwdHash: Improved Pwd Mgmt 16
17 The common pwd problem Web users use the same username/password at many sites. Users use their banking pwd at low security sites. The problem: break-in to low security site reveals banking username/passwords. Ideal solution: strong auth. protocols (SecureID/PKI) Unlike pwd, requires HW or has limited mobility. 17
18 A Simple Solution Browser plug-in that converts a user s pwd into a unique pwd per site. 1. Locate all pwd HTML elements on page: <INPUT TYPE=password NAME=pass> 2. Whenever focus leaves a password field, replace contents of field with HMAC pwd (domain-name) 3. Password hash is sent to web site instead of pwd. Protection against phishing: Spoof site only sees hash of user s pwd. 18
19 Plug-in Challenges Pwd reset after plug-in install Javascript attacks What salt to use in hash? How to encode resulting hash? When to compute hash? Internet Café Dictionary attacks Design goal: transparent to user. 19
20 Try it out! υ Plug-ins continue to evolve and improve: Easier deployment and use. Proxy-based solutions (not browser plug-ins) Strengthen spoof page identification. Deployment through Mozilla and billeo. 20
21 crypto.stanford.edu/spoofguard 21
22 SpoofGuard User Interface SpoofGuard is added to IE tool bar User configuration Traffic light Report green, yellow, red altert level Pop-up as method of last resort 22
23 Pwd Hashing an old idea Hash pwd with realm provided by remote site: HTTP 1.1 Digest Authentication Kerberos 5 Hash pwd with network service name: Gabber, Gibbons, Matyas, Mayer [FC 96]. Proxy. Abadi, Bharat, Marais [PTO 97] Challenge: implementing in a modern browser. 23
24 ebay Spoof Site Sends password to phisher 24
Client-side Defenses for Context-Aware Phishing and Transaction Generator Spyware
Client-side Defenses for Context-Aware Phishing and Transaction Generator Spyware Collin Jackson Dan Boneh John Mitchell Stanford University Web Threats Phishing Spoof website convinces user to log in
Security and Privacy. Xin Liu Computer Science University of California, Davis. Introduction 1-1
Security and Privacy Xin Liu Computer Science University of California, Davis Introduction 1-1 What is network security? Confidentiality: only sender, intended receiver should understand message contents
CS 142 Winter Session Management. Dan Boneh
CS 142 Winter 2009 Session Management Dan Boneh Sessions A sequence of requests and responses from one browser to one (or more) sites Session can be long (Gmail - two weeks) or short without session mgmt:
User Authentication + Other Human Aspects
CSE 484 (Winter 2010) User Authentication + Other Human Aspects Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
PROTECTING YOUR BUSINESS ASSETS
PROTECTING YOUR BUSINESS ASSETS How to Spot Danger Before Your Computer Gets Infected, Your Site Hosts Malware, and Your Credit Card Number Gets Stolen A MyNAMS Presentation by Regina Smola @2012 Regina
Phishing Attacks. Mendel Rosenblum. CS142 Lecture Notes - Phishing Attack
Phishing Attacks Mendel Rosenblum Phishing Basic idea: Get unsuspecting users to visit an evil Web site Convince them that the evil Web site is actually a legitimate site (such as a bank or PayPal) Trick
Custom Plugin A Solution to Phishing and Pharming Attacks
Custom Plugin A Solution to Phishing and Pharming Attacks Omer Mahmood School of Information Technology Charles Darwin University Darwin, NT, Australia Abstract - This paper proposes a new method to detect,
3.5 SECURITY. How can you reduce the risk of getting a virus?
3.5 SECURITY 3.5.4 MALWARE WHAT IS MALWARE? Malware, short for malicious software, is any software used to disrupt the computer s operation, gather sensitive information without your knowledge, or gain
Anti-Phishing Working Group
Phishing Attack Trends Report April, 2004 Phishing attacks use spoofed e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account
Password Rescue: A New Approach to Phishing Prevention
Password Rescue: A New Approach to Phishing Prevention Dinei Florêncio and Cormac Herley Microsoft Research, One Microsoft Way, Redmond, WA July 7, 2006 Abstract A phishing attack exploits both the enormous
PhishFighter: A Hybrid Anti-Phishing Plug-in
PhishFighter: A Hybrid Anti-Phishing Plug-in 1 Beena Kurian, 2 Jasmine Jolly, 3 Beena M V 1 M-Tech Student, 2 M-Tech Student, 3 Professor 1 Department of Computer Science & Engineering, 1 Vidya Academy
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
UTM 5000 WannaCry Technote
UTM 5000 WannaCry Technote The news is full of reports of the massive ransomware infection caused by WannaCry. Although these security threats are pervasive, and ransomware has been around for a decade,
NET 311 INFORMATION SECURITY
NET 311 INFORMATION SECURITY Networks and Communication Department Lec12: Software Security / Vulnerabilities lecture contents: o Vulnerabilities in programs Buffer Overflow Cross-site Scripting (XSS)
Introduction. Logging in. WebMail User Guide
Introduction modusmail s WebMail allows you to access and manage your email, quarantine contents and your mailbox settings through the Internet. This user guide will walk you through each of the tasks
Hash-based password authentication protocol against phishing and pharming attacks
JOURNAL OF INFORMATION SCIENCE AND ENGINEERING XX, XXX-XXX (201X) Hash-based password authentication protocol against phishing and pharming attacks IKSU KIM 1, YONGYUN CHO 2 1 School of Computer Science
CS 361S. Phishing. Vitaly Shmatikov
CS 361S Phishing Vitaly Shmatikov $1,500,000,000 Global losses from phishing in 2012 estimated at $1.5 Billion Source: RSA Fraud Report slide 2 MillerSmiles.co.uk slide 3 A Snapshot of My Mailbox service@paypal.com
SPOOFING. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006
SPOOFING Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Learning Objectives Students should be able to: Determine relevance of
FAQ. Usually appear to be sent from official address
FAQ 1. What is Phishing Email? A form of fraud by which an attacker masquerades as a reputable entity in order to obtain your personal information. Usually appear to be sent from official email address
P2_L12 Web Security Page 1
P2_L12 Web Security Page 1 Reference: Computer Security by Stallings and Brown, Chapter (not specified) The web is an extension of our computing environment, because most of our daily tasks involve interaction
Lecture 3 - Passwords and Authentication
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professor Jaeger Lecture 3 - Passwords and Authentication CSE497b - Spring 2007 Introduction Computer and Network Security Professor
Robust Defenses for Cross-Site Request Forgery
University of Cyprus Department of Computer Science Advanced Security Topics Robust Defenses for Cross-Site Request Forgery Name: Elena Prodromou Instructor: Dr. Elias Athanasopoulos Authors: Adam Barth,
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
Review of Phishing Detection Techniques
Review of Phishing Detection Techniques Swati Gaikwad Computer Engineering, DACOE, Pune, India. swatigaikwad0385@gmail.com Abstract Nowadays phishing attacks are increasing with burgeoning rate which is
PREVENTING FROM PHISHING ATTACK BY IMPLEMENTING URL PATTERN MATCHING TECHNIQUE IN WEB
International Journal of Civil Engineering and Technology (IJCIET) Volume 8, Issue 9, September 2017, pp. 1200 1208, Article ID: IJCIET_08_09_135 Available online at http://http://www.iaeme.com/ijciet/issues.asp?jtype=ijciet&vtype=8&itype=9
Anti-Phishing Security Strategy
Anti-Phishing Security Strategy Angelo P. E. Rosiello angelo@rosiello.org Who am I? Angelo P. E. Rosiello received the B.S. and M.S. degrees in Computer Science Engineering cum laude from Politecnico di
ACS / Computer Security And Privacy. Fall 2018 Mid-Term Review
ACS-3921-001/4921-001 Computer Security And Privacy Fall 2018 Mid-Term Review ACS-3921/4921-001 Slides Used In The Course A note on the use of these slides: These slides has been adopted and/or modified
Part II: Passwords. Ron van der Meyden. (University of New South Wales Sydney, Australia) March 12, R. van der Meyden Part II: Passwords
Part II: Passwords Ron van der Meyden (University of New South Wales Sydney, Australia) March 12, 2013 Passwords An old security mechanism: Soldiers access to camp Secret society handshakes Objective:
<input type="password"> must die!
must die! Daniel R. Sandler and Dan S. Wallach W2SP 2008: Web 2.0 Security & Privacy 2008 May 22, 2008 1 PROBLEM (SOLUTION) This talk is about a big problem. 2 And a small solution.
Lecture 3 - Passwords and Authentication
Lecture 3 - Passwords and Authentication CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12 What is authentication? Reliably verifying
Web Security, Summer Term 2012
IIG University of Freiburg Web Security, Summer Term 2012 Brocken Authentication and Session Management Dr. E. Benoist Sommer Semester Web Security, Summer Term 2012 7 Broken Authentication and Session
Web Security, Summer Term 2012
Table of Contents IIG University of Freiburg Web Security, Summer Term 2012 Brocken Authentication and Session Management Dr. E. Benoist Sommer Semester Introduction Examples of Attacks Brute Force Session
Web Application Security. Philippe Bogaerts
Web Application Security Philippe Bogaerts OWASP TOP 10 3 Aim of the OWASP Top 10 educate developers, designers, architects and organizations about the consequences of the most common web application security
The Rise of Phishing. Dave Brunswick Tumbleweed Communications Anti-Phishing Working Group
The Rise of Phishing Dave Brunswick Tumbleweed Communications Anti-Phishing Working Group 2 The Anti-Phishing Working Group Industry association focused on eliminating identity theft and fraud from the
CSE 484 / CSE M 584: Computer Security and Privacy. Usable Security. Fall Franziska (Franzi) Roesner
CSE 484 / CSE M 584: Computer Security and Privacy Usable Security Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner,
Identity Theft, Phishing and Pharming: Accountability & Responsibilities. OWASP AppSec DC October The OWASP Foundation
Identity Theft, Phishing and Pharming: Accountability & Responsibilities OWASP AppSec DC October 2005 Danny Allan Research Analyst, Watchfire dannya@watchfire.com 781-547-7833 Copyright 2005 - The OWASP
SAFETY NOTICE: TO AVOID DANGER, KEEP PRODUCT AND PACKAGE AWAY FROM BABIES AND CHILDREN. THE PRODUCT IS NOT INTENDED FOR BABIES AND CHILDREN.
www.yoggie.com Legal Notice Legal Notice SAFETY NOTICE: TO AVOID DANGER, KEEP PRODUCT AND PACKAGE AWAY FROM BABIES AND CHILDREN. THE PRODUCT IS NOT INTENDED FOR BABIES AND CHILDREN. Copyright 2006-2008.
FEEDING PHISHERS. A Thesis. Presented to. the Faculty of California Polytechnic State University. San Luis Obispo. In Partial Fulfillment
FEEDING PHISHERS A Thesis Presented to the Faculty of California Polytechnic State University San Luis Obispo In Partial Fulfillment of the Requirements for the Degree Master of Science in Computer Science
CS 155 Final Exam. CS 155: Spring 2011 June 3, 2011
CS 155: Spring 2011 June 3, 2011 CS 155 Final Exam This exam is open books and open notes. You may use course notes and documents that you have stored on a laptop, but you may NOT use the network connection
Author: Tonny Rabjerg Version: Company Presentation WSF 4.0 WSF 4.0
Author: Tonny Rabjerg Version: 20150730 Company Presentation WSF 4.0 WSF 4.0 Cybercrime is a growth industry. The returns are great, and the risks are low. We estimate that the likely annual cost to the
Duo at BU. Our two-factor authentication plan
Duo at BU Our two-factor authentication plan Tom Grundig - Information Security, Boston University Information Security Operations Manager SAP Security & GRC Lead Former Asst. Dir of Internal Audit Duo
Training UNIFIED SECURITY. Signature based packet analysis
Training UNIFIED SECURITY Signature based packet analysis At the core of its scanning technology, Kerio Control integrates a packet analyzer based on Snort. Snort is an open source IDS/IPS system that
Spam Protection Guide
Spam Email Protection Guide Version 1.0 Last Modified 5/29/2014 by Mike Copening Contents Overview of Spam at RTS... 1 Types of Spam... 1 Spam Tricks... 2 Imitation of 3 rd Party Email Template... 2 Spoofed
Webthority can provide single sign-on to web applications using one of the following authentication methods:
Webthority HOW TO Configure Web Single Sign-On Webthority can provide single sign-on to web applications using one of the following authentication methods: HTTP authentication (for example Kerberos, NTLM,
Security Awareness. Presented by OSU Institute of Technology
Security Awareness Presented by OSU Institute of Technology Information Technologies Division Security Awareness Topics Social Engineering Phishing Social Networks Displaying Sensitive Information Wireless
A Lightweight Framework for Detection and Resolution for Phishing, Pharming and Spoofing
A Lightweight Framework for Detection and Resolution for Phishing, Pharming and Email Spoofing Pooja Modi 1, Hardik Upadhyay 2, Ketan Modi 3, Krunal Suthar 4 ME Student, Department of Computer Engineering,
Phishing Activity Trends Report August, 2006
Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account
PROBLEMS IN PRACTICE: THE WEB MICHAEL ROITZSCH
Faculty of Computer Science Institute of Systems Architecture, Operating Systems Group PROBLEMS IN PRACTICE: THE WEB MICHAEL ROITZSCH THE WEB AS A DISTRIBUTED SYSTEM 2 WEB HACKING SESSION 3 3-TIER persistent
SSAC Public Meeting Paris. 24 June 2008
SSAC Public Meeting Paris 1 in Phishing Attacks 2 What is? A phishing attack The attacker impersonates a registrar The phish emails are sent to The registrar's customers (bulk) A particular, targeted customer
Phishing Activity Trends
Phishing Activity Trends Report for the Month of September, 2007 Summarization of September Report Findings The total number of unique phishing reports submitted to APWG in September 2007 was 38,514, an
Pass, No Record: An Android Password Manager
Pass, No Record: An Android Password Manager Alex Konradi, Samuel Yeom December 4, 2015 Abstract Pass, No Record is an Android password manager that allows users to securely retrieve passwords from a server
How to recognize phishing s
Phishing email messages, websites, and phone calls are designed to steal money, steal data and/or destroy information. Cybercriminals can do this by installing malicious software on your computer or stealing
Phishing Activity Trends
Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received rose to 24,853 in, an increase of over 1, from February but still more than
Kerberos and Single Sign On with HTTP
Kerberos and Single Sign On with HTTP Joe Orton Red Hat Overview Introduction The Problem Current Solutions Future Solutions Conclusion Introduction WebDAV: common complaint of poor support for authentication
DenyAll Protect. accelerating. Web Application & Services Firewalls. your applications. DenyAll Protect
DenyAll Protect DenyAll Protect Web Application & Services Firewalls Securing Sécuring & accelerating your applications Corporate or ecommerce website, email, collaborative tools, enterprise application
Lecture 12. Application Layer. Application Layer 1
Lecture 12 Application Layer Application Layer 1 Agenda The Application Layer (continue) Web and HTTP HTTP Cookies Web Caches Simple Introduction to Network Security Various actions by network attackers
Phishing. What do phishing s do?
Phishing We have become all too familiar with phishing emails but if that s the case, why do we as a community still fall victim? In this newsletter our goal is to provide you with some basic information
Phishing. Eugene Davis UAH Information Security Club April 11, 2013
Phishing Eugene Davis UAH Information Security Club April 11, 2013 Overview A social engineering attack in which the attacker impersonates a trusted entity Attacker attempts to retrieve privileged information
Train employees to avoid inadvertent cyber security breaches
Train employees to avoid inadvertent cyber security breaches TRAIN EMPLOYEES TO AVOID INADVERTENT CYBER SECURITY BREACHES PAGE 2 How much do you know about cyber security? Small business owners often lack
Security Course. WebGoat Lab sessions
Security Course WebGoat Lab sessions WebGoat Lab sessions overview Initial Setup Tamper Data Web Goat Lab Session 4 Access Control, session information stealing Lab Session 2 HTTP Basics Sniffing Parameter
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com KASPERSKY FRAUD PREVENTION 1. Ways of Attacking Online Banking The prime motive behind cybercrime is making money and today s sophisticated criminal
Secure web proxy resistant to probing attacks
Technical Disclosure Commons Defensive Publications Series December 04, 2017 Secure web proxy resistant to probing attacks Benjamin Schwartz Follow this and additional works at: http://www.tdcommons.org/dpubs_series
The Highly Insidious Extreme Phishing Attacks
The Highly Insidious Extreme Phishing Attacks Rui Zhao, Samantha John, Stacy Karas, Cara Bussell, Jennifer Roberts, Daniel Six, Brandon Gavett, and Chuan Yue Colorado School of Mines, Golden, CO 80401
06CS051. Server Side Support for SiteWatcher, an Antiphishing Software
Department of Computer Science BSCCS/BSCS Final Year Project Report 2006 2007 06CS051 Server Side Support for SiteWatcher, an Antiphishing Software (Volume 1 of 1 ) Student Name : Man Kin Pong Student
Robust Defenses for Cross-Site Request Forgery
Robust Defenses for Cross-Site Request Forgery Tsampanaki Nikoleta Lilitsis Prodromos Gigis Petros Paper Authors: Adam Barth, Collin Jackson, John C. Mitchell Outline What is CSRF attack? What is a login
ClientNet. Portal Admin Guide
ClientNet Portal Admin Guide Document Revision Date: June 5, 2013 ClientNet Portal Admin Guide i Contents Introduction to the Portal... 1 About the Portal... 1 Logging On and Off the Portal... 1 Language
INTERNET SAFETY IS IMPORTANT
INTERNET SAFETY IS IMPORTANT Internet safety is not just the ability to avoid dangerous websites, scams, or hacking. It s the idea that knowledge of how the internet works is just as important as being
Berner Fachhochschule Haute cole spcialise bernoise Berne University of Applied Sciences 2
Table of Contents Hacking Web Sites Broken Authentication Emmanuel Benoist Spring Term 2018 Introduction Examples of Attacks Brute Force Session Spotting Replay Attack Session Fixation Attack Session Hijacking
Cisco s Appliance-based Content Security: IronPort and Web Security
Cisco s Appliance-based Content Security: IronPort E-mail and Web Security Hrvoje Dogan Consulting Systems Engineer, Security, Emerging Markets East 2010 Cisco and/or its affiliates. All rights reserved.
DoS Attacks Malicious Code Attacks Device Hardening Social Engineering The Network Security Wheel
CCNA4 Chapter 4 * DoS Attacks DoS attacks are the most publicized form of attack and also among the most difficult to eliminate. DoS attacks prevent authorized people from using a service by consuming
Solving for Compromised Credentials Across the Enterprise
Solving for Compromised Credentials Across the Enterprise Boston University s Multi-Factor Authentication Implementation Tom Grundig, Assistant Director, Information Security, Boston University The Boston
Target Breach Overview
Target Breach Overview Q: Media reports are stating that Target experienced a data breach. Can you provide more specifics? A: Yes, Target has confirmed that it experienced unauthorized access to its systems
Selftestengine q
Selftestengine 700-281 49q Number: 700-281 Passing Score: 800 Time Limit: 120 min File Version: 18.5 http://www.gratisexam.com/ 700-281 Web Security for Field Engineers Still Valid in Egypt, Passed today
Base64 The Security Killer
Base64 The Security Killer Kevin Fiscus NWN Corporation Session ID: DAS-203 Session Classification: Intermediate A Short (Made Up) Security Story Helix Pharmaceuticals is concerned about security Industrial
Barracuda Web Application Firewall Foundation - WAF01. Lab Guide
Barracuda Web Application Firewall Foundation - WAF01 Lab Guide Official training material for Barracuda certified trainings and Autorized Training Centers. Edition 2018 Revision 1.0 campus.barracuda.com
Oracle Eloqua Legacy Authenticated Microsites and Contact Users. Configuration Guide
Oracle Eloqua Legacy Authenticated Microsites and Contact Users Configuration Guide 2019 Oracle Corporation. All rights reserved 04-Jan-2019 Contents 1 Authenticated microsites 3 2 Creating authenticated
OpenID Security Analysis and Evaluation
University of British Columbia OpenID Security Analysis and Evaluation San-Tsai Sun, Kirstie Hawkey, Konstantin Beznosov Laboratory for Education and Research in Secure Systems Engineering (LERSSE) University
COMP9321 Web Application Engineering
COMP9321 Web Application Engineering Web Application Security Dr. Basem Suleiman Service Oriented Computing Group, CSE, UNSW Australia Semester 1, 2016, Week 8 http://webapps.cse.unsw.edu.au/webcms2/course/index.php?cid=2442
Computer Security and Privacy
CSE P 590 / CSE M 590 (Spring 2010) Computer Security and Privacy Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
Looking Forward: Challenges in Mobile Security. John Mitchell Stanford University
Looking Forward: Challenges in Mobile Security John Mitchell Stanford University Outline Mobile platform security SessionJuggler Using phone as authentication token SelectiveAuth Protecting resources on
WebGoat Lab session overview
WebGoat Lab session overview Initial Setup Virtual Machine Tamper Data Web Goat Basics HTTP Basics Sniffing Web server attacks SQL Injection XSS INITIAL SETUP Tamper Data Hold alt to reveal the menu in
2 User Guide. Contents
E-mail User Guide 2 E-mail User Guide Contents Logging in to your web mail... 3 Changing your password... 5 Editing your signature... 6 Adding an e-mail account to Outlook 2010/2013/2016... 7 Adding an
BlueCoat BCCPP. Blue Coat Certified Proxy Professional.
BlueCoat BCCPP Blue Coat Certified Proxy Professional https://killexams.com/pass4sure/exam-detail/bccpp Question: 201 Which method of controlling downloads of certain file types works fastest on ProxySG?
Features of a proxy server: - Nowadays, by using TCP/IP within local area networks, the relaying role that the proxy
Que: -Proxy server Introduction: Proxy simply means acting on someone other s behalf. A Proxy acts on behalf of the client or user to provide access to a network service, and it shields each side from
Authentication Security
Authentication Security Hui Zhu Copyright 2005 www.ebizsec.com Agenda Authentication Components Authentication Hacking Consideration for Authentication Security Principle for Authentication Security Case
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 22
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 22 Announcements Project 4 is available on the web: Due Friday April 20th at 11:59 PM Some of today's slides adopted from Dan Boneh
(System) Integrity attacks System Abuse, Malicious File upload, SQL Injection
Pattern Recognition and Applications Lab (System) Integrity attacks System Abuse, Malicious File upload, SQL Injection Igino Corona igino.corona (at) diee.unica.it Computer Security April 9, 2018 Department
PHONEY: Mimicking User Response to Detect Phishing Attacks
PHONEY: Mimicking User to Detect Phishing Attacks Madhusudhanan Chandrasekaran Ramkumar Chinchani Shambhu Upadhyaya Department of Computer Science and Engineering University at Buffalo 201, Bell Hall,
GOING WHERE NO WAFS HAVE GONE BEFORE
GOING WHERE NO WAFS HAVE GONE BEFORE Andy Prow Aura Information Security Sam Pickles Senior Systems Engineer, F5 Networks NZ Agenda: WTF is a WAF? View from the Trenches Example Attacks and Mitigation
Introduction This paper will discuss the best practices for stopping the maximum amount of SPAM arriving in a user's inbox. It will outline simple
Table of Contents Introduction...2 Overview...3 Common techniques to identify SPAM...4 Greylisting...5 Dictionary Attack...5 Catchalls...5 From address...5 HELO / EHLO...6 SPF records...6 Detecting SPAM...6
TIPS TO AVOID PHISHING SCAMS
TIPS TO AVOID PHISHING SCAMS WHAT IS PHISHING? Phishing is the use of fraudulent email, websites, text messages and phone calls to trick people into disclosing personal financial or identity information,
Kaspersky PURE 2.0. Mail Anti-Virus: security levels
Mail Anti-Virus: security levels Content Mail Anti-Virus. Security levels... 2 Operation algorithm of Mail Anti-Virus... 2 Security levels of Mail Anti-Virus... 2 Customizing security level... 4 Creating
Security Awareness. Chapter 2 Personal Security
Security Awareness Chapter 2 Personal Security Objectives After completing this chapter, you should be able to do the following: Define what makes a weak password Describe the attacks against passwords
Introduction. Logging in. WebQuarantine User Guide
Introduction modusgate s WebQuarantine is a web application that allows you to access and manage your email quarantine. This user guide walks you through the tasks of managing your emails using the WebQuarantine
Comodo Comodo Dome Antispam MSP Software Version 2.12
Comodo Comodo Dome Antispam MSP Software Version 2.12 User Guide Guide Version 2.12.111517 Comodo Security Solutions 1255 Broad Street Clifton, NJ, 07013 Table of Contents 1 Introduction to Comodo Dome
Comodo Antispam Gateway Software Version 2.12
Comodo Antispam Gateway Software Version 2.12 User Guide Guide Version 2.12.112017 Comodo Security Solutions 1255 Broad Street Clifton, NJ, 07013 Table of Contents 1 Introduction to Comodo Antispam Gateway...3
Phishing Read Behind The Lines
Phishing Read Behind The Lines Veljko Pejović veljko@cs.ucsb.edu What is Phishing? "Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and
Fighting Phishing I: Get phish or die tryin.
Fighting Phishing I: Get phish or die tryin. Micah Nelson and Max Hyppolite bit.ly/nercomp_sap918 Please, don t forget to submit your feedback for today s session at the above URL. If you use social media
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
APT Protection.
Sangfor NGAF v7.4 Professional APT Protection tech.support@sangfor.com www.sangfor.com What is APT Gartner: Defining Advanced Persistent Threats Page 2 What is APT SANGFOR: APT is Not An Attack, But a