About Me

Chris Barton

Chris Barton
Having been with "big red" since the Dr Solomons acquisition Chris has seen many come and go but is never content to be ...

Read More

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

McAfee Labs :

Trust is relative. Why would you trust a logo?

Friday, May 18, 2007 at 5:24am by Chris Barton
Chris Barton

If we look at any large brand phish site these days they have “the security logo”, some call it a seal, smart icon or security stamp. You know the ones, they claim to “verify your site in real time” or give”confidence and assurance to trust the identity of your web site“.

The URL both logos link to is the same: :evil: Phish:
https://seal.verisign.com/splash?form_file=fdf/splash.fdf&dn=SCGI.EBAY.COM&lang=en :cool: eBay:
https://seal.verisign.com/splash?form_file=fdf/splash.fdf&dn=SCGI.EBAY.COM&lang=en

You could even try it for yourself here.
I was going to call this post “Trust me, I have a logo” – take your pick ;)

They are pretty easy to copy, even the ones with the custom text on could be faked easily. Their value comes from people associating them with data security and through that perception they inspire confidence. Please remember, They are just logos! Companies use them because they provide reassurance and most importantly they increase sales. (Verisign have a good pdf on profitable usage).

“71 percent of UK online shoppers will only make purchases through sites that include a trust mark.”

I’m not just picking on the SSL guys here, they really do provide you better options than “logos” as VeriSigns’ Tim Callan notes on a recent blog. EV certs are available for $$$$, but for many the logo is good enough:eek:
Oh, while I’m on the subject, the card companies have “nice logos” too :roll:

Please think of these logos as a security reminder, you should express as much caution on sites displaying them as any other site, and if need be re-enter the URL by hand in a new browser window.

Bookmark and Share

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

 

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (2)

  • Chris Barton May 20, 2007 1:20AM

    The sight of the logos makes customers feel safe, no matter what the site ;) I like to deal in real examples and the popup above is just one issue in whole chain of validation. $25 SSL certs have diluted the value of https and the padlock icons for instance.

    But the situation is so complicated to Average-Joe that linking any of the popus could give the indication of security. Even a certificate/seal owners own!

    …Then there is the whole EV argument, why should small business pay $1000 for an EVcert when they just want a simple shop site with paypal as a gateway because the community have been told that the green bar is the new padlock.
    …and that’s broken too IMHO, popup a new window with no toolbars, populate the top most part of the window with a fake green browser strip and load the phish site in a frame. Oh hold on a sec… Phishers did that with the good old SSL padlock years ago!

    Reply
  • Carl May 19, 2007 7:25AM

    Nice catch. You might also note that it was / is possible to completely fake the process and validation. While anyone can copy the seal and point it to their own site, it was / is possible to use Verisign’s own validation popup in order to validate a fake site.

    This was reported to VeriSign a very long time ago, but they are still vulnerable to variations of the same technique (so it will be withheld for the time being).

    Reply