Story image

Researchers probe psychology behind phishing attacks

28 Feb 18

What makes the difference between a successful phishing attack and an unsuccessful one?

That is just one of the questions posed by two researchers at Carnegie Mellon University in the US in a study that created an experiment to see exactly which phishing strategies work.

Prashanth Rajivan and Cleotilde Gonzalez conducted the research in a study titled Creative Persuasion: A Study on Adversarial Behaviors and Strategies in Phishing Attacks.

The study states that cybercriminals will attempt to act as a trustworthy third party in social engineering attacks designed to trick people into downloading malicious attachments or to visit fake websites.

The researchers had three questions: What role do incentives play in determining phishing effort and success; does individual creativity predict success in phishing attacks;  what, and how strategies are implemented in successful phishing emails.

They created an experiment in which 105 participants acted as phishing attackers and scored points for successfully deceiving 340 other participants who were the recipients.

The experiment was played in turns and was designed to train and award participants for trying different phishing methods.

“To evade detection participants were encouraged to edit and modify the content of their phishing emails, so that they would explore the effectiveness in each attempt,” researchers explain.

In determining the role incentives play in determining phishing effort and success, they found that participants who received rewards for their efforts early on were more likely to exert more effort.

There was no evidence of individual creativity predicting success in phishing attacks.

However, when researchers analysed what phishing strategies are used and how they are implemented, they discovered substantial findings.

There were several different tactics that could potentially result in phishing success: an authoritative tone, an expression of shared interest, sending notifications, and communicating failure, and pretending to be a friend all proved to be successful tactics.

Phishers used email tactics including deal offers, selling illegal material sales and those that used a positive tone didn’t fare so well.

“Participants who received phishing examples that contained work-related and social communications, were more successful with their attacks,” Rajivan and Gonzalez explain.

They found that attackers who stick to certain strategies may be more likely to persuade victims to respond to emails.

“Attackers who discover effective strategies and who are persistent in their attempts to making them work would be more successful in persuading end-users to respond to their phishing emails. Our results also suggests an effect of phishing inspiration on phishing success,” they continue.

The experiment did not provide consider spear phishing as it did not supply phishers with any specific details about the targets.

The researchers say future work in the field could open up understanding of human behaviour in the context of spear phishing attacks.

“These insights may be used to inform tools and training procedures to detect phishing strategies in emails,” Rajivan and Gonzalez conclude.

McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
Forcepoint and Chillisoft - “a powerful combination”
Following Chillisoft’s portfolio expansion by signing on Forcepoint, the companies’ execs explain how this is a match made in cybersecurity heaven.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.
Using blockchain to ensure regulatory compliance
“Data privacy regulations such as the GDPR require you to put better safeguards in place to protect customer data, and to prove you’ve done it."
A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.