期刊
IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING
卷 18, 期 6, 页码 2551-2568出版社
IEEE COMPUTER SOC
DOI: 10.1109/TDSC.2019.2956035
关键词
Phishing; Graphical user interfaces; Cloning; Task analysis; Microsoft Windows; Malware; Android phishing apps; android GUI attacks; android apps
类别
资金
- National Satellite of Excellence in Trustworthy Software System [NRF2018NCR-NSOE003-0001]
- National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity RD Program [NRF2018NCR-NCR005-0001]
- NSFC [61502170]
- Science and Technology Commission of Shanghai Municipality [18511103802]
Mobile phishing attacks using disguise techniques have raised security concerns, with current detection methods potentially vulnerable. A new attack technique, GUI-Squatting attack, can automatically generate phishing apps on the Android platform using deep learning algorithms. Experimental results suggest existing phishing defenses are ineffective against emergent attacks, stimulating the need for more efficient detection techniques.
Mobile phishing attacks, such as mimic mobile browser pages, masquerade as legitimate applications by leveraging repackaging or clone techniques, have caused varied yet significant security concerns. Consequently, detection techniques have been receiving increasing attention. However, many such detection methods are not well tested and may therefore still be vulnerable to new types of phishing attacks. In this article, we propose a new attacking technique, named GUI-Squatting attack, which can generate phishing apps (phapps) automatically and effectively on the Android platform. Our method adopts image processing and deep learning algorithms, to enable powerful and large-scale attacks. We observe that a successful phishing attack requires two conditions, page confusion and logic deception during attacks synthesis. We directly optimize these two conditions to create a practical attack. Our experimental results reveal that existing phishing defenses are less effective against such emergent attacks and may, therefore, stimulate more efficient detection techniques. To further demonstrate that our generated phapps can not only bypass existing detection techniques, but also deceive real users, we conduct a human study and successfully steal users' login information. The human study also shows that different response messages (e.g., Crash and Server failed) after pressing the login button mislead users to regard our phapps as functionality problems instead of security threats. Extensive experiments reveal that such newly proposed attacks still remain mostly undetected, and are worth further exploration.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据