Bridging the Gap: Developing Accessible Anti-Phishing Solutions

Bridging the Gap: Developing Accessible Anti-Phishing Solutions

Speakers: Lydia Stepanek, Consultant

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=XlzOYh5HPOQ

Overview

In "Bridging the Gap: Developing Accessible Anti-Phishing Solutions," Lydia Stepanek, a seasoned software engineer and consultant, addresses the persistent and evolving threat of phishing, arguing that despite common misconceptions, it remains the most prevalent internet crime. Stepanek introduces her open-source anti-phishing Gmail plugin, Too Phishy, as a novel approach to empower users through education rather than mere invisible filtering. The talk meticulously deconstructs high-profile phishing incidents, including the 2014 Sony hack, the 2016 John Podesta email breach, and the sophisticated 2020 zero-click exploit against Jeff Bezos, demonstrating how even advanced users and IT professionals can fall victim.

The core premise of Stepanek's presentation is that while major email providers like Google and Microsoft have implemented robust authentication mechanisms such as SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), these measures are not foolproof. She highlights that sophisticated social engineering, lookalike domains, and zero-click exploits continue to bypass traditional defenses, allowing a significant number of malicious emails to reach inboxes. Too Phishy aims to bridge this gap by providing an accessible, transparent, and educational tool that scrutinizes email links and domain metadata, offering users actionable insights to identify and avoid phishing attempts.

Stepanek's work is particularly relevant in an era where cyber threats are increasingly complex, yet user awareness often lags. By focusing on making cybersecurity tools less intimidating and fostering a culture where discussing phishing is free of shame, Too Phishy seeks to democratize advanced threat intelligence. The initiative also champions the open-source model, leveraging publicly available APIs to develop cost-effective solutions that can complement, rather than replace, existing enterprise-grade security tools, ultimately strengthening the collective defense against pervasive phishing attacks.

Background

▶ Watch: Introduction and famous hacks illustrating phishing's prevalence (0:00)

The landscape of cybersecurity is constantly shifting, yet phishing consistently ranks as the leading initial attack vector. Lydia Stepanek underscores this by citing FBI statistics, which report phishing as the most common internet crime, occurring five times more frequently than the next closest threat, with this trend continuing through 2023. This reality stands in stark contrast to a common misconception that phishing is a dying art, largely overcome by advancements in email security.

This misconception, Stepanek explains, stems partly from the efforts of major email providers. Google, for instance, began requiring email authentication for large senders in 2022, leading to a reported 75% decrease in unauthenticated emails by 2023. While impressive, this reduction doesn't eliminate the threat. Mechanisms like SPF and DKIM, designed to verify sender identity, can be circumvented. Stepanek illustrates this with an anecdote from the Reply All podcast, where an employee successfully phished their CEO using a lookalike domain (g-i-r-n-l-e-t-media.com instead of gimletmedia.com), exploiting visual similarity in email fonts. Such attacks bypass authentication checks because the email is authenticated for the deceptive domain. Furthermore, even with Google's "amazing" spam filter, a staggering 626 phishing emails per 100,000 still manage to reach user inboxes, demonstrating that even a small number can lead to catastrophic consequences, as evidenced by the high-profile breaches discussed.

Stepanek's personal journey into building Too Phishy is rooted in a deep-seated passion for cybersecurity, fueled by podcasts like Darknet Diaries, and a recognition of the intimidating nature of many existing security tools. She recounts her initial trepidation even using a service like "Have I Been Pwned," highlighting a broader accessibility issue in the security space. As an indie developer operating on a "shoestring budget," her approach to competing with tech giants like Google is to offer a different value proposition: education and transparency over seamless, invisible filtering. Google's spam filter, while effective, often hides potentially malicious emails without explaining why they were flagged. Too Phishy, by contrast, aims to be an educational tool, providing detailed analysis in a user-friendly manner. This open-source strategy also necessitates leveraging free and open-source APIs for domain analysis, leading to a "copyleft route to development" where Too Phishy itself remains open source.

To contextualize the evolving nature of phishing, Stepanek walks through a "spectrum of sophistication" using three well-known hacks:

• John Podesta (2016): The least sophisticated, involving a fake Google password reset email with a Bitly link. Even his IT department mistakenly validated it as legitimate, demonstrating that human error and lack of critical scrutiny remain significant vulnerabilities.
• Sony Pictures Entertainment (2014): A medium-sophistication spear-phishing attack targeting executives with emails containing malware. The malicious link (fancug.com) masqueraded as a legitimate login page, highlighting the need for deeper domain analysis beyond superficial appearance.
• Jeff Bezos (2020): The most advanced, a zero-click exploit delivered via WhatsApp. This attack involved no user interaction, leveraging a vulnerability in WhatsApp's automatic download feature to exfiltrate data. This incident underscores that even the most security-conscious individuals can be victims of nation-state level capabilities, and that phishing extends beyond email.

These examples collectively demonstrate that phishing is far from dead; it is evolving, becoming more targeted and sophisticated, and continues to exploit both technical vulnerabilities and human psychology.

Key Findings

▶ Watch: TooPhishy introduced; preventing basic phishing links (2:40)

The talk reveals several critical insights into the contemporary phishing landscape and effective defensive strategies:

• Phishing's Enduring Dominance: Despite widespread belief that phishing is declining, it remains the leading cybercrime, according to FBI statistics. Even with significant advancements in email authentication like SPF and DKIM, the threat persists and evolves.
• Limitations of Traditional Email Security: While email authentication has reduced unauthenticated emails by 75%, it is not a panacea. Lookalike domains and clever social engineering tactics can bypass these controls, as demonstrated by the Gimlet Media example, where a visually similar domain successfully phished an executive. Gmail's advanced spam filters still permit hundreds of phishing emails per 100,000, illustrating that a single successful breach can have monumental consequences.
• The Spectrum of Phishing Sophistication: Phishing attacks range widely in complexity, from simple, easily identifiable malicious links (e.g., Bitly in the Podesta case) to highly advanced, expensive zero-click exploits (e.g., the Jeff Bezos hack). This diversity necessitates a multi-layered defense strategy that considers both human and technical factors.
• Human Vulnerability Across All Levels: Even individuals with high technical acumen or those with dedicated IT support (like John Podesta) can fall prey to phishing. The Jeff Bezos incident further highlights that even the world's wealthiest and most protected individuals are targets for sophisticated, nation-state-level attacks, underscoring that no one is truly immune.
• The Need for Accessible and Educational Tools: Many cybersecurity tools are intimidating or opaque, hindering user adoption and understanding. There is a clear need for solutions that not only identify threats but also educate users on why something is suspicious. Too Phishy’s approach of providing detailed analysis in a user-friendly pop-up is a direct response to this need.
• Removing the Stigma of Being Phished: A significant barrier to effective defense is the shame associated with falling victim to phishing. Stepanek emphasizes the importance of normalizing the conversation around phishing, recognizing that it can happen to anyone, regardless of their technical proficiency or status. This cultural shift is crucial for encouraging reporting and learning from incidents.

Technical Deep Dive

▶ Watch: Sony hack: malware via spear phishing (3:15)

Too Phishy operates as a Gmail plugin, functioning as an additional layer of analysis on top of Gmail's existing security infrastructure. Written in ES6 (JavaScript), it leverages the browser environment, allowing it to integrate seamlessly with the Gmail interface and utilize existing JavaScript libraries for email parsing. This choice of language and platform is pragmatic for an indie developer, as browser-based analysis heavily relies on JavaScript ecosystems.

The plugin's core functionality revolves around scrutinizing various attributes of an email, particularly its embedded links, to identify common phishing indicators. Stepanek outlines the pseudocode logic behind Too Phishy's detection capabilities across different levels of phishing sophistication:

1. Detecting Least Sophisticated Attacks (e.g., John Podesta):

• Shortened URL Detection: Too Phishy checks for the presence of well-known URL shortening services like Bitly within email links. Such links are frequently used by phishers to obscure the true destination URL. While legitimate uses for URL shorteners exist, their presence in unexpected contexts, especially in password reset or security alert emails, is a significant red flag. The plugin is designed to flag these directly, informing the user about the suspicious nature of such links.

1. Detecting Medium Sophistication Attacks (e.g., Sony Hack):

• Domain Legitimacy and Popularity Check: The plugin analyzes the domain name of embedded links. It cross-references these domains against lists of "top million" most common websites on the internet. If a link points to a domain not found on such a list, especially if it's a newly registered domain (often registered shortly before a hack, as was the case with fancug.com in the Sony hack), Too Phishy flags it as suspicious. This helps identify domains that are unlikely to be associated with legitimate services of large companies like Facebook.
• Domain Geolocation Analysis: Too Phishy attempts to determine the country of registration for domain names. For instance, in the Sony hack example, the malicious fancug.com was registered in South Korea, whereas Facebook's legitimate domains are predominantly registered in the United States. While WHOIS information can often be obfuscated by services like Cloudflare, the country of registration is frequently still available and can serve as a valuable indicator of potential spoofing or malicious intent, especially for global brands with established regional domain registration patterns.
• Registrant Information Scrutiny: Although more challenging due to privacy services, the plugin also aims to analyze registrant details where available, looking for anomalies that might indicate a fraudulent domain.

Too Phishy differentiates itself from Google's native spam filtering by providing explicit, educational feedback. Instead of silently moving an email to spam, the plugin generates a pop-up on the side of the Gmail interface. This pop-up explicitly details the findings, such as "this domain's hosted in South Korea" or "this is a well-known phishing link," empowering users with context and knowledge.

For highly advanced attacks like the zero-click exploit used against Jeff Bezos, a Gmail plugin has inherent limitations. These exploits typically target vulnerabilities in messaging apps or operating systems, not email content itself. However, Stepanek highlights user-side mitigation strategies, such as disabling automatic downloads in applications like WhatsApp, which could prevent the initial payload delivery of such exploits. This acknowledges that while client-side email analysis is powerful, it's not the sole defense against all forms of phishing.

The development strategy for Too Phishy heavily relies on open-source and free APIs. Given Stepanek's "shoestring budget," she could not afford commercial threat intelligence feeds or premium domain analysis services. This constraint led her to seek out publicly available resources for "top million" domain lists, WHOIS data, and other metadata. This reliance on open-source components has, in turn, dictated a copyleft development model, meaning Too Phishy itself is open source, allowing others to inspect its code, contribute, and further enhance its capabilities. This transparency also addresses user concerns about data privacy, allowing users to verify that the plugin does not access or misuse their personal email content.

Looking ahead, Stepanek envisions incorporating AI tools for similarity analysis into Too Phishy. This would allow the plugin to compare new phishing emails against a vast, aggregated corpus of known phishing alerts, providing even more sophisticated detection and context to users.

Demo / Proof of Concept

▶ Watch: Jeff Bezos's zero-click WhatsApp exploit (5:15)

While the talk did not feature a live, interactive demonstration of Too Phishy in action, Lydia Stepanek effectively walked the audience through conceptual "proofs of concept" by applying the plugin's logic to the high-profile phishing incidents discussed. For each case – John Podesta's Bitly link, the Sony hack's fancug.com domain, and the Jeff Bezos zero-click exploit – she explained how Too Phishy would have identified and flagged the malicious elements.

For instance, in the John Podesta scenario, Too Phishy would have immediately recognized the Bitly link as a known indicator of phishing and alerted the user. In the Sony hack, the plugin's analysis would have highlighted that fancug.com was not a "top million" website and that its registration country (South Korea) was inconsistent with a legitimate Facebook login, presenting this information to the user via a pop-up. This method of demonstrating the tool's effectiveness, by retroactively applying its logic to historical events, served to illustrate its practical utility without requiring a live environment. The speaker described Too Phishy as "a pop-up on the side... an educational tool," emphasizing its role in showing users the "why" behind a phishing alert rather than just silently filtering.

Defensive Implications

▶ Watch: Bezos's public stand against extortion, phishing affects everyone (6:40)

The insights presented by Lydia Stepanek offer crucial defensive implications for both individuals and organizations striving to mitigate the pervasive threat of phishing.

For Individuals:

• Adopt Client-Side Analysis Tools: Users should consider installing anti-phishing browser extensions or email plugins like Too Phishy. These tools provide an independent, educational layer of scrutiny that complements, rather than replaces, server-side email security. They empower users by explaining why an email or link is suspicious, fostering critical thinking.
• Scrutinize All Links, Especially Shortened Ones: Never blindly trust links, even in emails that appear legitimate. Be particularly wary of URL shorteners (e.g., Bitly) in unexpected contexts, such as password reset requests or security alerts. Hover over links to reveal their true destination before clicking.
• Verify Domain Authenticity: Develop a habit of examining domain names in links and sender addresses. Look for subtle misspellings, unusual subdomains, or completely unfamiliar domains (like fancug.com instead of facebook.com). Be aware that sophisticated attackers use lookalike domains that are visually similar to legitimate ones.
• Pay Attention to Domain Geolocation: While not always definitive, an unexpected country of domain registration for a globally recognized service (e.g., a "Facebook" link registered in South Korea) should raise a red flag.
• Manage Application Permissions and Downloads: For messaging apps like WhatsApp, disable automatic downloads of media and attachments. This can provide a crucial layer of defense against zero-click exploits that deliver malware through unsolicited files, as seen in the Jeff Bezos case.
• Report Suspicious Emails: Actively report phishing attempts to relevant authorities. In the U.S., this includes the FBI's Internet Crime Complaint Center (IC3), the Anti-Phishing Working Group (APWG), and your email provider. Reporting helps build collective intelligence and improves future detection mechanisms.
• Overcome Phishing Stigma: Recognize that phishing can happen to anyone, regardless of technical expertise or status. Foster an environment where individuals feel comfortable reporting incidents without shame, as this data is vital for collective defense.

For Organizations:

• Reinforce Email Authentication, But Understand Limitations: Ensure robust implementation of SPF, DKIM, and DMARC for all organizational domains. However, educate employees that these protocols are not foolproof against all forms of phishing, particularly lookalike domains and highly sophisticated social engineering.
• Comprehensive User Education and Training: Implement continuous security awareness training that goes beyond basic "don't click" advice. Focus on teaching employees how to identify lookalike domains, recognize social engineering tactics, and understand the metadata associated with suspicious links. Use real-world examples and interactive exercises.
• Encourage and Facilitate Reporting: Establish clear, easy-to-use channels for employees to report suspicious emails. Foster a blame-free culture where reporting is encouraged and rewarded, recognizing that early detection is crucial. Integrate reported incidents into internal threat intelligence.
• Implement Layered Security: Rely on a multi-faceted security strategy that includes email gateway protection, endpoint detection and response (EDR), network intrusion detection, and robust identity and access management. Acknowledge that advanced threats like zero-click exploits require defenses beyond email filtering.
• Monitor Domain Registrations: Proactively monitor for fraudulent domain registrations that mimic your organization's brand. Services exist that scan for typographic errors and visual similarities.
• Consider Supplemental Client-Side Tools: While enterprise solutions are paramount, explore the utility of client-side tools or browser extensions that provide additional, user-facing analysis and educational insights, potentially increasing the human firewall's effectiveness.
• Protect High-Value Targets: Recognize that executives and high-profile individuals are prime targets for highly sophisticated spear-phishing and zero-click attacks. Implement enhanced security protocols, dedicated training, and potentially specialized devices or configurations for these individuals.

Key Takeaways

• Phishing remains the most common internet crime, consistently outranking other cyber threats despite advancements in email security.
• Traditional email authentication (SPF/DKIM) and spam filters are not foolproof; sophisticated social engineering and lookalike domains can bypass them.
• Accessible, educational cybersecurity tools like Too Phishy empower users by providing transparent analysis and context, fostering critical thinking rather than just silent filtering.
• Phishing attacks span a wide spectrum of sophistication, from simple malicious links to expensive, nation-state-level zero-click exploits, impacting everyone from everyday users to top executives.
• Removing the stigma associated with being phished is crucial for encouraging incident reporting and building a more resilient collective defense.
• Open-source development offers a viable and transparent path to building valuable security tools, leveraging free APIs and fostering community contributions.

About the Speaker(s)

Lydia Stepanek is a consultant dedicated to helping companies combat phishing threats. With over a decade of experience as a software engineer, she brings a strong technical background to her cybersecurity work. Her passion for addressing cybersecurity challenges, particularly making security tools more user-friendly and less intimidating, led her to develop Too Phishy. This open-source anti-phishing Gmail plugin was created as part of a "12 Startups Challenge," reflecting her entrepreneurial spirit and commitment to finding accessible solutions to complex problems. Stepanek advocates for transparency in security tools and aims to build an open-source corpus of phishing alerts to enhance global threat intelligence.