Re: Firefox extensions for fighting phishing

["Sean P. DeMerchant" <warnings () envisagement com>]

----- Original Message ----- 
From: "Saqib Ali" <docbook.xml () gmail com>
To: "Mamading Ceesay" <mamading () gmail com>
Cc: <webappsec () securityfocus com>
Sent: Saturday, July 16, 2005 7:26 PM
Subject: Re: Firefox extensions for fighting phishing


couple more:

Spoofstick http://www.corestreet.com/spoofstick/
Netcraft Toolbar http://toolbar.netcraft.com/ (This one is the BEST)

> Outfoxed - http://getoutfoxed.com/
> TrustBar - http://trustbar.mozdev.org/

The Netcraft toolbar is  is next to useless.  The last time I checked it 
could be fooled by a frameset.  So if someone could hack a frameset onto the 
host server, i.e.,

http://www.somewhere.net/only_fools_would_click_on_this_link/login.html

then the frameset in login.html could reframe the entire page to:

http://www.steal_your_info.net/sucker.html

and Netcraft would tell you you were on www.somewhere.net which is
not terribly useful.

Albeit, I ran this test 6-8 weeks ago using IE.  Nonetheless, until such a 
toolbar lists all the source websites or shows a warning when any data comes 
from an external site (adservers included) such tools are virtually useless 
for stopping phishing (they may stop some, but mostly they will give a false 
sense of confidence).

I have not tried the others.

Please note I do like some of the other services Netcraft provides (i.e., 
uptime for shared hosting, ...) so I am not just naysaying.  But the 
Netcraft toolbar the last I looked is not terribly useful for stopping 
phishing completely and it will lie about the source of the content if you 
are in a frameset.

Take a look at:

http://www.abpo.net/rg.html

And note that images are served by abpo.net, yet the HTML with the exception 
of the frameset is served elsewhere.

In short, I think that far more sophistication is needed in anti-phishing 
tools before they will truly be valuable.  Stopping 80% of problems may be 
good enough for government work, but anyone worth dealing with will can you 
for such junk (Microsoft, Sybase, Oracle, IBM, and etcetera would not except 
such slipshot quality from a database, why accept such junk for you 
financial transaction ;o).

my $0.02,

Sean P. DeMerchant