Browsers Defenses Against Phishing, Spoofing and Malware

Web users are increasingly victims of phishing, spoofing and malware attacks. In this article, we discuss existing and proposed defense mechanisms. We highlight the vulnerabilities of current defenses, and the challenges of validating and adopting new defenses

Optimizing Anti-Phishing Solutions Based on User Awareness, Education and the Use of the Latest Web Security Solutions

Phishing has grown significantly in volume over the time, becoming the most usual web threat today. The present economic crisis is an added argument for the great increase in number of attempts to cheat internet users, both businesses and private ones. The present research is aimed at helping the IT environment get a more precise view over the phishing attacks in Romania; in order to achieve this goal we have designed an application able to retrieve and interpret phishing related data from five other trusted web sources and compile them into a meaningful and more targeted report. As a conclusion, besides making available regular reports, we underline the need for a higher degree of awareness related to this issue.Security, Phishing, Ev-SSL, Security Solutions

Proposed Framework for Securing Mobile Banking Applications from Man in the Middle Attacks

Mobile phone banking and payments continues to not only be a popular way of transacting business but it also seems to evolve rapidly. Despite its popularity however there seem to be some very genuine concerns on the security issues revolving around it, particularly in regard to man in the middle attacks. This paper seeks to propose a secure framework for communication between a mobile device and the back end server for protecting mobile banking applications from man-in-the-middle attacks without introducing further threats to the communication channel. Keywords: Defense- in-depth, Security, man in the middle attack, secure framework, bank serve

Puzzle-Based Learning for Cyber Security Education

Puzzle-based learning has proven to result in a better STEM learning environment in mathematics, physics, and computer science. However, no significant work has been done in computer and cyber security, only the idea of using puzzles to teach cyber security has only been introduced very recently. We introduce two different puzzle designs, truth table based and decision tree based. In both cases participants have to make decisions according to their knowledge and scenario. We conducted some informal surveys and believe that such interactive learning will help students to understand complex cyber-attack paths and countermeasures for fraud detection, cybercrime, and advanced persistent threats (APTs). Participants will learn not only to protect a specific system but also an entire class of systems with different hardware/software components and architectures, providing similar service. The survey result shows that the puzzle-based learning method has been beneficial for the students towards their learning

Towards secure web browsing on mobile devices

The Web is increasingly being accessed by portable, multi-touch wireless devices. Despite the popularity of platform-specific (native) mobile apps, a recent study of smartphone usage shows that more people (81%) browse the Web than use native apps (68%) on their phone. Moreover, many popular native apps such as BBC depend on browser-like components (e.g., Webview) for their functionality. The popularity and prevalence of web browsers on modern mobile phones warrants characterizing existing and emerging threats to mobile web browsing, and building solutions for the same. Although a range of studies have focused on the security of native apps on mobile devices, efforts in characterizing the security of web transactions originating at mobile browsers are limited. This dissertation presents three main contributions: First, we show that porting browsers to mobile platforms leads to new vulnerabilities previously not observed in desktop browsers. The solutions to these vulnerabilities require careful balancing between usability and security and might not always be equivalent to those in desktop browsers. Second, we empirically demonstrate that the combination of reduced screen space and an independent selection of security indicators not only make it difficult for experts to determine the security standing of mobile browsers, but actually make mobile browsing more dangerous for average users as they provide a false sense of security. Finally, we experimentally demonstrate the need for mobile specific techniques to detect malicious webpages. We then design and implement kAYO, the first mobile specific static tool to detect malicious webpages in real-time.Ph.D