Story image

Researchers probe psychology behind phishing attacks

28 Feb 2018

What makes the difference between a successful phishing attack and an unsuccessful one?

That is just one of the questions posed by two researchers at Carnegie Mellon University in the US in a study that created an experiment to see exactly which phishing strategies work.

Prashanth Rajivan and Cleotilde Gonzalez conducted the research in a study titled Creative Persuasion: A Study on Adversarial Behaviors and Strategies in Phishing Attacks.

The study states that cybercriminals will attempt to act as a trustworthy third party in social engineering attacks designed to trick people into downloading malicious attachments or to visit fake websites.

The researchers had three questions: What role do incentives play in determining phishing effort and success; does individual creativity predict success in phishing attacks;  what, and how strategies are implemented in successful phishing emails.

They created an experiment in which 105 participants acted as phishing attackers and scored points for successfully deceiving 340 other participants who were the recipients.

The experiment was played in turns and was designed to train and award participants for trying different phishing methods.

“To evade detection participants were encouraged to edit and modify the content of their phishing emails, so that they would explore the effectiveness in each attempt,” researchers explain.

In determining the role incentives play in determining phishing effort and success, they found that participants who received rewards for their efforts early on were more likely to exert more effort.

There was no evidence of individual creativity predicting success in phishing attacks.

However, when researchers analysed what phishing strategies are used and how they are implemented, they discovered substantial findings.

There were several different tactics that could potentially result in phishing success: an authoritative tone, an expression of shared interest, sending notifications, and communicating failure, and pretending to be a friend all proved to be successful tactics.

Phishers used email tactics including deal offers, selling illegal material sales and those that used a positive tone didn’t fare so well.

“Participants who received phishing examples that contained work-related and social communications, were more successful with their attacks,” Rajivan and Gonzalez explain.

They found that attackers who stick to certain strategies may be more likely to persuade victims to respond to emails.

“Attackers who discover effective strategies and who are persistent in their attempts to making them work would be more successful in persuading end-users to respond to their phishing emails. Our results also suggests an effect of phishing inspiration on phishing success,” they continue.

The experiment did not provide consider spear phishing as it did not supply phishers with any specific details about the targets.

The researchers say future work in the field could open up understanding of human behaviour in the context of spear phishing attacks.

“These insights may be used to inform tools and training procedures to detect phishing strategies in emails,” Rajivan and Gonzalez conclude.

Forget endpoints—it’s time to secure people instead
Security used to be much simpler: employees would log in to their PC at the beginning of the working day and log off at the end. That PC wasn’t going anywhere, as it was way too heavy to lug around.
DimData: Fear finally setting in amongst vulnerable orgs
New data ranking the ‘cybermaturity’ of organisations reveals the most commonly targeted sectors are also the most prepared to deal with the ever-evolving threat landscape.
IXUP goes "post-quantum" with security tech upgrade
The secure analytics company has also partnered with Deloitte as a reseller, and launched a SaaS offering on Microsoft Azure.
ExtraHop’s new partner program for enterprise security
New accreditations and partner portal enable channel partners to fast-track their expertise and build their security businesses.
Hackers increasingly ‘island hopping’ – so what does it mean?
Carbon Black's Rick McElroy discusses this new trend and what it means for the new age of cybercrime.
Trust without visibility is blind – Avi Networks
Enterprises are wanting to gain the trust of their customers, but are often found blindly defending themselves.
How to avoid becoming a cryptojacking victim - Bitglass
Large-scale cryptojacking is a lucrative business due to the popularity and value of cryptocurrencies like Bitcoin and Ethereum.
Symantec, Ixia combine efforts to secure hybrid networks
Ixia’s CloudLens and Symantec Security Analytics now feature complete integration, which allows Symantec customers to gain real-time visibility into their hybrid cloud environments.