This document discusses using one-time passwords to prevent phishing attacks. Phishing involves attackers setting up fake websites to steal users' confidential information. To address this, the document proposes authenticating users with one-time passwords delivered over a secondary channel rather than static passwords. This would require the attacker to know the user's account, secondary channel identity and password to intercept the OTP, making phishing more difficult to succeed. The document outlines how OTP authentication works and its security advantages over traditional passwords.

1. Using One Time Password How to
Prevent Phishing Attacks
Guided by Presented by
Prof. B.S.Shetty Ritesh Rajesh Sarode
(2012BIT006)

2.  Introduction
 Phishing
 Anti-Phishing Techniques
 One Time Password
 Mechanism
 Security Analysis
 Conclusion
 References

3.  Phishing is a malicious activity whereby an
attacker tries get the confidential information of
target.
It is a serious problem because phisher can get
sensitive information like users’ bank account
details, social security numbers, and credit card
numbers.

4.  To achieve his goal, a phisher first sets up a fake
website that looks almost the same as the
legitimate target website.
 The URL of the fake website is then sent to a
large number of users at random via e-mails or
instant messages.

5.  Phishing is a form of social engineering carried out
by black hats in electronic form. E.g.e-mail, for
gathering sensitive information.
 Phishing emails may also contain links to websites
that are infected with malware.
 Phishing is typically carried out by email spoofing
and instant messaging.

7. List-based
 It maintains a black list or white list, or both.
 Many anti-phishing mechanisms use a black list to
prevent users from accessing phishing sites.
 The effectiveness of black list filtering depends on
the coverage, freshness, and accuracy of the list.

8.  The URLs are collected by web crawlers, and list
maintainers are responsible for verifying that listed URL
contain phishing site or not.
 Though a well maintained black list can filter most well-
known phishing sites, but it cannot filter unanalyzed
URLs.
 No list can guarantee 100% coverage and up-to-date
freshness.

9.  Domain name-
A phishing site may register a similar domain
name to that of the target site.
Eg-paypal.com and paypa1.com
 URL-
This allows a phisher to redirect users to a fake
site using a URL
www.paypal.com@123.123.123.123 and
www.paypal.com

10.  Specific input fields-
Phishing site has some input fields for personal
information, such as passwords, social security
numbers, and credit card numbers.

12.  Phisher obtain the touchy data using fake site and then he can
access our Private credentials.
 To prevent password phishing, we use OTP mechanism.
 To overcome this we have preset password method i.e. OTP
 we need a reliable secondary channel to deliver the
password.

13.  Users can be authenticated with OTP delivered via a secondary
communication channel.
 The user database at the server side matches a user’s login name
with its corresponding identity on another secondary channel.
 When user wants to access a web site then server sends an OTP
to the user through the secondary channel.
 User receives OTP and he can login before OTP expires.

15. Phishing attack can only succeed if the attacker knows :
1) The user’s account name.
2) The identity of the secondary channel through which the
user receives the OTP.
3) The password used to access the secondary channel.

16.  Mutual Authentication.
 Authentication in an untrustworthy environment.
 Man-In-The-Middle attack(MITM).

17.  lot of methods are there to detecting phishing and securing
users from attacks, but not detect all phishing sites.
 In this paper, we propose a solution that tries to reduce the
number of password phishing attacks by authenticating users
with OTP instead of fixed passwords.
 Thus, any website can take advantage of the proposed solution
by installing instant messaging bots at the server side only.

18.  www.sciencedirect.com/cybersecurity
 www.globaldigitalforensics.com
 www.seminarsonly.com
 www.wikipedia.com

20. Any Questions??