An article by Markus Jakobsson and Steve Myers.
A variety of computer networks are vulnerable to so-called stealth attacks. While there are many types of stealth attacks, they all have one thing in common (which is the very reason, of course, for their name) – the attackers are hard to detect. In some cases, it is even hard for a victim to determine that he was attacked – days or weeks may pass before this becomes evident. By then, it may be too late, as in the meantime, the attacker may collect and even modify information that was not intended for him. The attacks can be mounted against both wired and wireless networks, but the relative ease with which they can be used to attack users of wireless networks poses a particular threat within a variety of settings, including public hotspots. Moreover, stealth attacks pose a particular threat in the context of identity theft. A particular type of stealth attack we describe herein is the so-called “doppelganger window attack”. This can either be mounted in a similar fashion as the typical phishing attack is, but poses a greater threat than current phishing attacks. This is so since the doppelganger window attack defeats traditional methods for mutual authentication, which would otherwise have been a meaningful defense against phishing. We describe a new security technique, delayed password disclosure, that provides security against doppelganger window attacks. It can be based on any known method for mutual authentication, and its security can be proven to be the same as that of the underlying method .
Read the full article in the attached file.
ps: there was a picture in the article but I couldnt find it in my HD. ugh! I should have saved the document in PDF, DOC or MHTML format
