Copyright © What The Hell? Security
What the hell is it about phishing that makes it seem so intractable?
First off, let’s talk intractable. An uncontrollable or incurable problem. Computational complexity theory adds a convenient twist: A problem that can be solved, only not fast enough for the solution to be useful. Like with phishing. With me?
I don’t think so. See, the real issue with an intractable problem isn’t always its intractability. Sometimes it’s our frame of reference. It’s how we’re thinking about the problem. Like Relativity Al said, when you create a problem with one kind of thinking, it takes a different kind to solve it. With me now?
I still don’t think so, but let’s find out. To do that you need to momentarily dismiss everything you know about anti-phishing. I’ll stipulate that you know everything that can be known about how phishing works, but I need you to pretend you have no preconceptions about how to stop it. Grade your pretending skills by how strongly you want to argue with me before reading this whole piece through a couple of times.
Law 1: Phishing Is About Commerce
Not visual appearance. Nor ads. Nor search. Nor browsers even. Those things are attack vectors. You can address attack vectors forever without ever getting to the root of the problem.
Take forged email for instance. As phishing attack vectors go, this is the most despicable. Only not for the reason you think. It’s despicable because it is a red herring attack vector. It’s the Mother of All Security Red Herrings, in fact. Why? Because what we call forgery is so integral to our 40-year old email system that it would cease to function without it. Did you get that? Every legitimate email message you have ever sent or received via the Internet had to be forged — using the exact same technique that phishers use — in order to get delivered.
There is only one prime mover of phishing, and it is commerce. In the mid-1990s, we began introducing commerce into pre-existing systems like email and the Web, when they had no accommodation for commerce. And guess what? They still don’t. Not a shred. And before you say SSL, keep reading.
Law 2: Phishing Education Is Irrational
So we’re trying to teach half the human population to not do the one thing that comes naturally on the Web — click on an interesting link — and to do a bunch of things that come unnaturally — like interpreting unicode URLS and ignoring clearance sales. On something like a $1 budget. C’mon.
Law 3: Phishers Win By Playing Our Game, On Our Field, Using Our Players, Following Our Rules
Our game: campaigns. Our field: hypermedia. Our players: hijacked CPUs, storage, bandwidth. Our rules: phishers are always on offense. We’re always on defense, and score only when they fumble.
This doesn’t mean phishers are less guilty of their crimes. But we’re guilty too — of being a little disingenuous.
Law 4: Phishing Is Not Caused By Broken Technology
If you don’t believe me, go read the RFCs. It’s all working as designed.
And dammit, quit blaming Tim and Vint for the sorry state of security. It’s a gross injustice. We should in fact be thanking them for building insecure systems, because adding security to systems that have no foreseeable need for it is a lousy idea. (Note I said foreseeable, not immediate, which is another story entirely.) They set out to solve very pressing problems at hand, which they did, which is why their stuff got so widely adopted. It’s not their fault that we threw the monkey wrench of commerce into the gears of their systems years after the fact. Blaming them for bad security is like blaming Karl Benz for inventing cars that make for poor submarines.
Law 5: Phishing Blacklists Are Not Blacklists
They are, pure and simple, blocklists. Not blacklists. See the important difference?!?
Law 6: SSL Certificate Authorities Increase Phishers’ROI And Reduce Merchants’
SSL was introduced in 1995 to solve two problems: 1) help consumers identify legitimate sites, and 2) encrypt the channel between browser and webserver to protect sensitive information.
The latter is free. The former works so poorly that it actually helps phishers at the expense of merchants. The only reason merchants pay for certs (other than out of check-writing habit) is to prevent people’s browsers from ralphing error messages that Rivest, Shamir and Adelman can barely understand.
SSL didn’t always have this problem. CAs like VeriSign started out with good certificate issuance practices. Later, upon realizing that the market for legitimate certs was bounded on the smallish side, they unbounded it by issuing certs to anybody having the means (fraudulent or not) to pay for them.
Law 7: It’s The Clicks, Stupid
If you learn one thing today, let it be this.
You can’t control content produced by other people. In many cases you can’t even anticipate its delivery to you. But you control what you do with it.
You control whether or not you click on a link. You control whether or not you click on a form’s control to populate it. You control whether or not you click on a form’s submit button. Get it?
And I don’t think for a minute that I mean the clicks that SiteAdvisor invites with its army of green checkmarks. Look closely and you’ll see that it’s a blocklist wearing a clever (and rarely washed) blacklist disguise.
Law 8: Documents Matter, Sites Do Not
A site owner is a site owner. A content publisher is a content publisher. A content author is a content author. A third-party content developer (like those building on Facebook’s platform) is a third-party content developer.
None of these need to be the same, and increasingly with time, they are not. Imagine you’re examining a source page that contains a link to a destination page. The destination contains content from a dozen sources. Just because you know who the destination site owner is, does that really make it safe to click on the link? (Hint: No.)
The whole notion of a site will slowly erode, for no reason other than hypermedia does not require it. Hypertext did just fine without it for 30 years.
Law 9: The Solution Is A Platform
(continued)
Filed under: certificate authorities, hypertext, phishing, security, security soapbox, ssl | Leave a Comment »
