Strong Increase Of Phishing Sites That Use Https

Not only legitimate websites use https more and more, phishing sites also have more and more access to a secure connection. There is even a strong increase in the number of https phishing sites, according to security company PhishLabs . In the third quarter of this year almost 25 percent of the observed phishing sites had a https connection.

A quarter earlier was still about 12 percent, while a year ago less than 3 percent of the phishing sites had a ssl certificate. According to the security company, there are two reasons why there is an increase in https usage among phishing sites. The first reason is that phishing sites are regularly offered via hacked, legitimate websites. When a legitimate website with a ssl certificate is hacked, the phishing page that is offered via the website will also have a secure connection.

The second reason according to PhishLabs is that criminals register domains for their phishing site and then enable https themselves. This then happens via certificate authorities that offer free ssl certificates, such as Let's Encrypt and Comodo. In this way, the phishing site looks more legitimate, says Crane Hassold of PhishLabs. Chrome automatically displays the "Safe" message at https sites. This refers to the secure connection, but end users think the website they are visiting is safe, Hassold notes.

"The misunderstanding about the meaning of https among the general public and the confusing appointment of https websites in browsers are the main reasons why it is a popular preference of phishers in hosting phishing sites," Hassold continues. "Combined with the rapid growth of https among website owners, we expect the number of https phishing sites to grow further."

Major Browsers Support SSL-Free Service Let's Encrypt

A new certificate authority (CA) which aims to encrypt all web traffic on the Internet and therefore will issue free SSL certificates is now supported by all major browsers, as announced the initiators of Let's Encrypt.

With an SSL certificate, websites can encrypt the traffic to and from visitors and identify themselves in front of visitors. Let's Encrypt is an initiative of the Internet Security Research Group (ISRG) and is supported by Mozilla, Akamai, Cisco, the American civil rights movement EFF and various other parties. According to the initiators, there are already parties that offer free certificates for websites, but the installation is still a tricky process, which is a fully encrypted web stands in the way.

Let's therefore Encrypt will automate the installation and issue of certificates. For this purpose has been developed a programming interface (API), as well as client software that makes use of this API. Administrators can use this client software on their own Web server to automatically install a certificate and configure their server so that henceforth use HTTPS.

To avoid warnings in the browser must Let's Encrypt or by the browser as a valid certificate authority are recognized.Something which is now achieved through the intermediate certificates of Let's Encrypt by IdenTrust be signed. All browsers accept IdenTrust and thereby also the certificates of Let's Encrypt. "This is a major milestone because it means that visitors to websites that use Let's Encrypt certificates without special modifications have a secure browsing experience," said Josh Aas of ISRG.