Abstract

Our goal is proactive detection of phishing websites with neither the delay of blacklist identification nor the strict constraints of whitelists. Our approach is to list known phishing targets, index the content at their correct sites, then look for this content to appear at incorrect sites to signal a phishing site. While prior work has visually compared good website layouts with potential phishing sites [4], we focus on the content itself. Our insight is that cryptographic hashing of page contents allows efficient bulk identification of content reuse at phishing sites.
Our contribution is to build a system to detect phish by comparing hashes of visited websites to the hashes of the original, known good, legitimate website. We implement our approach in the form of a browser extension in Google Chrome, and show that our algorithms detect a majority of phish, even with minimal countermeasures to page obfuscation. A small number of alpha users have been using the browser extension without issues, and we have released our extension and source code at http://www. isi. edu/ant/software/phish.

Date

2015

Authors

Calvin Ardi, John Heidemann

Journal

USC/Information Sciences Institute, Tech. Rep. ISI-TR-2015-698