Play Anti-Phishing Phil And Learn How To Spot Phishing Attacks
Phishing attacks are pretty cleverly designed, because they skip most virus checkpoints altogether and go for the true weak spot in human-computer interaction, the human. Lorrie Faith Cranor, a computer security researcher at Carnegie Mellon University, has been studying phishing attacks to identify new ways to fight them.
Some of the things her research team has learned:
- Users who are simply taught about phishing attacks don't retain the info and keep falling for them, but users who are tricked into falling for a phishing attack first and then taught show far greater retention—it's a "teachable moment" in the researchers' terminology. (Idea: when phishers are caught, their punishment is to have them continue to phish but on behalf of government entities in order to create these "teachable moments.")
- Even when web browsers warned users they were on a phishing site, many ignored the warnings. People who used IE 7 were more likely to ignore warnings than people who used Firefox 2. You might assume this is because Firefox users are generally savvier computer users, but Cranor says the difference can be attributed to the clearer interface design of Firefox, where severe warnings stand out more dramatically than day-to-day warnings, so that users have a better chance of noticing them. (She says IE 8 has taken notice of this and improved its warning presentation.)
- Antiphishing programs that rely on a combination of blacklists and heuristics are dramatically better at catching phishing sites immediately than those that rely on blacklists alone, which is crucial because many phishing sites are extremely short-lived:
We discovered that most of the blacklist programs caught fewer than 20 percent of the phishing sites when we tested them within minutes of receiving the URLs. After five hours, most could detect about 60 percent of the active phishing sites. The programs that used a combination of blacklists and heuristics fared much better, with one detecting almost 90 percent of phishing attacks from the beginning of our test.
"How to Foil "Phishing" Scams" [Scientific American]
RELATED
Anti-Phishing Phil
Post a comment
Comments:
I'd be more interested if Phil had three eyes.
I played a couple rounds of this game, but apparently it's only worthwhile if you have little internet experience or no common sense.
I do appreciate that they encourage people to Google search websites that they are not sure about. If more people researched things that they weren't familiar with before clicking, we would have less instances of what happened with that guy and dvdglobe.tv.
@crazyasianman: As is clear from the article itself, it's really not a question of stupid, it's a question of lacking specific kinds of education, and it is indeed fixable.
It doesn't help that legitimate companies send astonishingly bogus-esque emails (my credit union sends misspelled and badly formatted materials to the wrong name at my address, for instance).
@floraposte:
perhaps carelessness would have been a better choice of words... but stupid still plays a part. a friend of mine has a stepmom who constantly gives out information via stupid clicklinks like "free smiley" ads and the perpetual "congratulations you have won a free xbox 360" type ads. she continues doing so in spite of being warned against it and having had account information stolen more than once.
@Foibles and Weebles: I think I can give this one a shot. Mac owners were smart enough to buy a Mac in the first place, and thus not as easily fooled as the shlub who spent $500 less on a laptop loaded down with "free" trialware and forced to constantly be downloading security updates and removing malware and spyware.
:)
the best piece of advice ever is... if your not sure, call the bank or credit card company or company directly on the phone.
we had a phishing email come in that looked so perfect we could'nt tell - apart from it was charges we never made. we picked up the phone and called the CC Company involved (mastercard) and they were happy to help and verify it was a (at the time brand new) phishing email.
@youbastid:
One could argue that a person stupid enough to buy a Mac would be more likely to fall for these phishing schemes.
Of course, that would be based on nothing but your own personal stereotypes and bias, and I wouldn't want to offend anyone.
It amazes me how otherwise smart people can't grasp phishing emails. I used to work helpdesk at a college, and I had a call from a professor who was angry because our anti-spam software wouldn't release a message from her bank. I told her it was probably a phishing email, and she didn't care and insisted that she needed to read it.
I finally ended up talking to one of our security engineers, who looked at the header of the blocked message and pointed out this professor that it's unlikely that her US-based bank sent her an email from a server located in the Republic of Georgia.
If someone with a PHD in mathmatics can't grasp phishing emails, do you expect your average Joe Six-Pack to?
@Kicken: Obviously you missed the tongue-in-cheek-i-ness of what I said. Probably because you use Windows!
Forwarded to my mother... thanks!
@madanthony: I'd say it might be easier for the average person to understand for one reason: the PHD. Some people [professors especially] get ahold of their PHD in whatever and when you tell them, "This is a fake email." they think they're smarter than you because of their PHD and say, "Well I've got a degree and he's just a moron because I have a PHD." Sometimes the smartest people are also the stupidest people.
That being said, of course not all professors are like this, but we all know of at least one professor that is.
@LeafOnTheWind: Both Safari and Internet Explorer have anti-phishing features built in, as does both the Mac and Windows versions of Firefox. I wonder, however, which works best for recognizing illegitimate websites. I know they're all good at flagging sites that have missing, out of date or bogus SSL certificates.
cue the "buy a Mac" argument in 3...2...1...
Just kidding. Sort of. I don't know that a Mac would even matter in a phishing kind of attack.