TRAWL: Protection against rogue sites for the masses

The number of smartphones reached 3.4 billion in the third quarter of 2016 [1]. These devices facilitate our daily lives and have become the primary way of accessing the web. Although all desktop browsers filter rogue websites, their mobile counterparts often do not filter them at all, exposing their users to websites serving malware or hosting phishing attacks. In this paper we revisit the anti-phishing filtering mechanism which is offered in the most popular web browsers of Android, iOS and Windows Phone. Our results show that mobile users are still unprotected against phishing attacks, as most of the browsers are unable to filter phishing URLs. Thus, we implement and evaluate TRAWL (TRAnsparent Web protection for alL), as a cost effective security control that provides DNS and URL filtering using several blacklists.

[1]  Niels Provos,et al.  The Ghost in the Browser: Analysis of Web-based Malware , 2007, HotBots.

[2]  Kang Li,et al.  Measuring and Detecting Malware Downloads in Live Network Traffic , 2013, ESORICS.

[3]  Daoyuan Wu,et al.  Analyzing Android Browser Apps for file: // Vulnerabilities , 2014, ISC.

[4]  Adrienne Porter Felt,et al.  Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness , 2013, USENIX Security Symposium.

[5]  Dimitris Gritzalis,et al.  Mobile devices: A phisher's paradise , 2014, 2014 11th International Conference on Security and Cryptography (SECRYPT).

[6]  Shafique Ahmad Chaudhry,et al.  Phishing Attacks and Defenses , 2016 .

[7]  G. Barish,et al.  World Wide Web caching: trends and techniques , 2000, IEEE Commun. Mag..

[8]  Roberto Perdisci,et al.  Scalable fine-grained behavioral clustering of HTTP-based malware , 2013, Comput. Networks.

[9]  Marti A. Hearst,et al.  Why phishing works , 2006, CHI.

[10]  Niels Provos,et al.  All Your iFRAMEs Point to Us , 2008, USENIX Security Symposium.

[11]  Wenke Lee,et al.  Detecting Malware Domains at the Upper DNS Hierarchy , 2011, USENIX Security Symposium.

[12]  Daniele Sgandurra,et al.  A Survey on Security for Mobile Devices , 2013, IEEE Communications Surveys & Tutorials.

[13]  Christopher Krügel,et al.  Protecting users against phishing attacks with AntiPhish , 2005, 29th Annual International Computer Software and Applications Conference (COMPSAC'05).

[14]  Dimitris Gritzalis,et al.  Security Busters: Web browser security vs. rogue sites , 2015, Comput. Secur..

[15]  Jason Hong,et al.  The state of phishing attacks , 2012, Commun. ACM.

[16]  Benjamin Livshits,et al.  ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection , 2011, USENIX Security Symposium.

[17]  Dimitris Gritzalis,et al.  Evaluating the Manageability of Web Browsers Controls , 2013, STM.

[18]  Patrick Traynor,et al.  An Empirical Evaluation of Security Indicators in Mobile Web Browsers , 2015, IEEE Transactions on Mobile Computing.