TU Darmstadt / ULB / TUbiblio

Compartmented Security for Browsers

Gajek, Sebastian ; Sadeghi, Ahmad-Reza ; Stüble, Christian ; Winandy, Marcel :
Compartmented Security for Browsers.

[Report], (2007)

Kurzbeschreibung (Abstract)

Identity theft through phishing attacks has become a major concern for Internet users. Typically, phishing attacks aim at luring the user to a faked web site to disclose personal information. Various solutions have been proposed against this kind of attack. However, these solutions can hardly counter the new generation of sophisticated malware phishing attacks, e.g., pharming trojans, designed to target certain services.

This paper aims at making the first steps towards the design and implementation of an open source and interoperable security architecture that prevents both classical and malware phishing attacks. Our approach is based on the ideas of compartmentalization for separating applications domains of different trust level, and a trusted wallet for storing credentials and authenticating sensitive services. Once the wallet has been setup in an initial step, our solution requires no special care from users for identifying the right web sites while the disclosure of credentials is strictly controlled. Moreover, a prototype of the basic platform exists and we briefly describe its implementation.

Typ des Eintrags: Report
Erschienen: 2007
Autor(en): Gajek, Sebastian ; Sadeghi, Ahmad-Reza ; Stüble, Christian ; Winandy, Marcel
Titel: Compartmented Security for Browsers
Sprache: Deutsch
Kurzbeschreibung (Abstract):

Identity theft through phishing attacks has become a major concern for Internet users. Typically, phishing attacks aim at luring the user to a faked web site to disclose personal information. Various solutions have been proposed against this kind of attack. However, these solutions can hardly counter the new generation of sophisticated malware phishing attacks, e.g., pharming trojans, designed to target certain services.

This paper aims at making the first steps towards the design and implementation of an open source and interoperable security architecture that prevents both classical and malware phishing attacks. Our approach is based on the ideas of compartmentalization for separating applications domains of different trust level, and a trusted wallet for storing credentials and authenticating sensitive services. Once the wallet has been setup in an initial step, our solution requires no special care from users for identifying the right web sites while the disclosure of credentials is strictly controlled. Moreover, a prototype of the basic platform exists and we briefly describe its implementation.

(Heft-)Nummer: HGI-TR-2007-001
Freie Schlagworte: Password Wallet, phishing, Security Kernel, TruWallet
Fachbereich(e)/-gebiet(e): 20 Fachbereich Informatik
20 Fachbereich Informatik > Systemsicherheit
Veranstaltungsort: Ruhr-University Bochum
Hinterlegungsdatum: 10 Mär 2016 10:18
ID-Nummer: TUD-CS-2007-0034
Verwandte URLs:
Export:

Optionen (nur für Redakteure)

Eintrag anzeigen Eintrag anzeigen