Red Phish, Blue Phish: Improved Phishing Detection Using Perceptual Hashing
summary
Claim: perceptual image hashing — using average hash and difference hash (plus a DCT-style perceptual hash) — reliably flags pages that visually impersonate banks or PayPal by comparing screenshots to a corpus. Implementation: a crawler that screenshots the Alexa top 100,000, ThreatGlass dataset of captures, Postgres/GIST indexing for fast Hamming distance lookups, and a released browser extension. Results: low Hamming distances (e.g., avg=0, diff=7) identify likely clones; code and extension are published for testing.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:35What is Phishing
- 4:43Spam vs Fishing
- 6:14Fishing Stats
- 8:24Advancements
- 10:38Cost of cybercrime
- 12:10Bad modern advice
- 12:59Perimeter defenses
- 13:56Domain names
- 18:03Perceptual hashing
- 20:23Quantize
- 20:58Resize
- 21:32Discrete cosine transform
- 22:33Difference hash
- 23:18Hamming distance
- 24:34Threat Glass
- 27:31Web Rendering
- 28:34Ice Bucket Challenge
- 30:03Image Extraction
- 30:55Known Good Sites
- 31:46Optimizations
related talks
48mRed Phish, Blue Phish: A New Approach to Phishing Simulations
09mBridging the Gap: Developing Accessible Anti-Phishing Solutions
31mAI-Powered Solutions for Cybersecurity
45m Gollum: One anti-phish bot to rule them all
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
51mDeepPhish: Simulating Malicious AI
32mSomething’s Phishy: See the Hook Before the Bait
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness