Applying Machine Learning to Prevent Inception Bar Phishing Attacks

James Fisher recently wrote about a simple "inception bar" phishing attack he created for mobile users of Chrome: scrolling down in the Chrome app on a mobile device hides the URL bar to maximize screen space. Fisher demonstrated how an attacker can simply insert an image of a faux Chrome URL bar with whatever domain they're trying to impersonate, and--with a little CSS and JavaScript magic--they can fool the user into thinking they're on a legitimate site like hsbc.com instead of SomePhishingSite.com. As Fisher points out in his proof-of-concept blog post, there are various user-interface changes Google could make to prevent or at least mitigate this phishing technique--but as a thought experiment, let's imagine some ways machine learning (ML) could be leveraged to detect and prevent this sort of attack. One effective countermeasure may be to use computer vision techniques to classify individual images. In particular, when dealing with images, the most obvious modeling approaches entail using convolutional neural networks.