sb-nz logo
Story image

Researchers probe psychology behind phishing attacks

28 Feb 2018

What makes the difference between a successful phishing attack and an unsuccessful one?

That is just one of the questions posed by two researchers at Carnegie Mellon University in the US in a study that created an experiment to see exactly which phishing strategies work.

Prashanth Rajivan and Cleotilde Gonzalez conducted the research in a study titled Creative Persuasion: A Study on Adversarial Behaviors and Strategies in Phishing Attacks.

The study states that cybercriminals will attempt to act as a trustworthy third party in social engineering attacks designed to trick people into downloading malicious attachments or to visit fake websites.

The researchers had three questions: What role do incentives play in determining phishing effort and success; does individual creativity predict success in phishing attacks;  what, and how strategies are implemented in successful phishing emails.

They created an experiment in which 105 participants acted as phishing attackers and scored points for successfully deceiving 340 other participants who were the recipients.

The experiment was played in turns and was designed to train and award participants for trying different phishing methods.

“To evade detection participants were encouraged to edit and modify the content of their phishing emails, so that they would explore the effectiveness in each attempt,” researchers explain.

In determining the role incentives play in determining phishing effort and success, they found that participants who received rewards for their efforts early on were more likely to exert more effort.

There was no evidence of individual creativity predicting success in phishing attacks.

However, when researchers analysed what phishing strategies are used and how they are implemented, they discovered substantial findings.

There were several different tactics that could potentially result in phishing success: an authoritative tone, an expression of shared interest, sending notifications, and communicating failure, and pretending to be a friend all proved to be successful tactics.

Phishers used email tactics including deal offers, selling illegal material sales and those that used a positive tone didn’t fare so well.

“Participants who received phishing examples that contained work-related and social communications, were more successful with their attacks,” Rajivan and Gonzalez explain.

They found that attackers who stick to certain strategies may be more likely to persuade victims to respond to emails.

“Attackers who discover effective strategies and who are persistent in their attempts to making them work would be more successful in persuading end-users to respond to their phishing emails. Our results also suggests an effect of phishing inspiration on phishing success,” they continue.

The experiment did not provide consider spear phishing as it did not supply phishers with any specific details about the targets.

The researchers say future work in the field could open up understanding of human behaviour in the context of spear phishing attacks.

“These insights may be used to inform tools and training procedures to detect phishing strategies in emails,” Rajivan and Gonzalez conclude.

Story image
Video: 10 Minute IT Jams – A glimpse inside a ransomware cell
This is our second IT Jam with SonicWall senior manager of product marketing Brook Chelmo, and in this video Brook walks us through his one-on-one experience with a member of a ransomware cell. More
Link image
The importance of data resilience in the current cybersecurity climate
Protecting an organisation's data is one of the most crucial functions of any CISO. Strategies should be in place where data is stored securely and cost-effectively.More
Story image
Zoom to begin rolling out end-to-end encryption
Available starting from next week, it represents the first phase out of four of the company’s greater E2EE offering, which was announced in May following backlash that the company was lax on its security and privacy.More
Story image
Research: Younger cybersecurity pros more fearful of being replaced by AI
According to the findings, 53% of respondents under 45 years old either agreed or strongly agreed that AI and ML are a threat to their job security, despite 89% of this demographic believing that it would improve their jobs.More
Story image
Microsoft is most imitated brand for phishing attacks in Q3
Popular phishing tactics using the Microsoft brand used email campaigns to steal credentials of Microsoft accounts, luring victims to click on malicious links which redirect them to a fraudulent Microsoft login page. More
Story image
BlackBerry, Microsoft enter partnership for Teams integration
"Integrating BlackBerry AtHoc will ensure that any organisation managing critical events using Teams is able to contact, alert, and account for everyone within the organisation directly."More