CNC Offers Free Fake-Site Detection Software to Prevent Phishing
So I installed it.
www.mizuhobank.co.jp is verified, but www.nomura.co.jp is not.
https://direct.btm.co.jp/ is no good either.
Mizuho’s banking site is no good as well. This is useless.
I captured the traffic, but observed no special communications.
It does not appear to authenticate each site upon access.
The instant I click, it says the site is verified. It even does so over HTTP.
→ It does not seem to be examining the SSL certificate.
Even when I access something nonexistent such as https://www.mizuhobank.co.jp/ before an SSL session is established (not that one possibly could be),
it says, “You are accessing a verified site.”
# What on earth is that?
I still have not found a verified SSL site.
Hmm. Does this really protect against pharming?
All right, let’s rewrite hosts!
So I added the following entry to hosts.
192.168.100.100 www.mizuhobank.co.jp
(The address is not a real one!)
Then I set it to no proxy and tried accessing it…
Bingo!
It became a verified site!!! 😀
Take a look at the attached image.
# This is hopeless!!!! :hammer:
Something similar is described in Yuji Hoshizawa’s Notes. Its follow-up says that deleting the whitelist makes registered sites appear unregistered. The specification does not seem to check whether the whitelist has been tampered with. Incidentally, the blacklist is currently empty.
Following the links from Yuji Hoshizawa’s Notes led me to The Wind of Blessing. Mr. Kogure of CNC had posted a comment on that article. He said:
The version released this time,
as stated on our website,
does not include
countermeasures against pharming fraud.A version incorporating countermeasures against pharming fraud
is scheduled for release from version 0.5 onward.
Let’s go take a look at the website. Hmm, no matter how I read it, it certainly sounds as though it supports protection against pharming. Since the page itself could be “tampered with,” I will copy and paste its contents here.
DocWall is software that protects you from new forms of Internet fraud… protecting against phishing sites and pharming activities so that you do not become a victim of fraud.
Phishing is the act of stealing PINs, credit card numbers, and other information by impersonating legitimate emails or websites from financial institutions and the like. The name derives from “fishing,” but it is generally spelled “phishing.” In phishing, the legitimate URL and the URL of the fraudulent site impersonating it are different.
Pharming, on the other hand, is the act of displaying a fraudulent site and stealing PINs, credit card numbers, and other information simply when someone accesses an ordinary Internet site, without any connection to fraudulent email. The principle is to forcibly rewrite the contents of DNS or HOSTS, which convert URLs into IP addresses, thereby displaying a site other than the intended one.
Because planting this mechanism as a “seed” allows personal information to be “harvested” without scattering “bait,” the name derives from “farming,” meaning to cultivate or operate a farm, but it is generally spelled “Pharming.”These techniques are used to obtain not only personal information such as your address, name, and age, but also important account numbers, passwords, and other data.
The software we have developed, DocWall, can prevent these attacks.
For a safer Internet life, please install and make use of DocWall.DocWall’s version is 0.41, and the features included this time are as follows.
1. Browser phishing checks
2. Automatic update feature* Email-checking functionality is planned for addition in subsequent versions.
(Source) http://www.clovernetwork.co.jp/main.html
No matter how you read that, it certainly sounds like it supports protection against pharming, doesn’t it??? More to the point, what kind of anti-phishing measure does not protect against pharming??? (Update: This itself had already been altered. The page before the alteration is here.)
# I am utterly speechless.
Is this just how the world works? I wonder whether CNET and others write articles without testing anything. It makes me sigh.
# I’m off to have a beer :pint:
Related posts
The Threat of Real-Time Phishing That One-Time Passwords Cannot Prevent: The Essence of Passkeys’ Phishing Resistance
In recent years, phishing attacks targeting financial institutions and others have grown increasingly sophisticated. In particular, a method known as “real-time phishing” has become a serious…
The Password Criteria in NIST SP 800-63B-4 2pd Have Been in Place Since 2017—The New Requirement Is Phishing Resistance
Articles and posts such as “Don't Change Them Periodically”: NIST Releases 2nd Public Draft of Password Policy Guidelines have been circulating, creating the impression that prohibiting…
Two-Factor Authentication Using a Bookmark: BeamAuth
One weakness of OpenID is the problem of phishing. With OpenID, users are redirected to an authentication server for authentication. The problem is that, instead of…