Story image

Researchers probe psychology behind phishing attacks

28 Feb 18

What makes the difference between a successful phishing attack and an unsuccessful one?

That is just one of the questions posed by two researchers at Carnegie Mellon University in the US in a study that created an experiment to see exactly which phishing strategies work.

Prashanth Rajivan and Cleotilde Gonzalez conducted the research in a study titled Creative Persuasion: A Study on Adversarial Behaviors and Strategies in Phishing Attacks.

The study states that cybercriminals will attempt to act as a trustworthy third party in social engineering attacks designed to trick people into downloading malicious attachments or to visit fake websites.

The researchers had three questions: What role do incentives play in determining phishing effort and success; does individual creativity predict success in phishing attacks;  what, and how strategies are implemented in successful phishing emails.

They created an experiment in which 105 participants acted as phishing attackers and scored points for successfully deceiving 340 other participants who were the recipients.

The experiment was played in turns and was designed to train and award participants for trying different phishing methods.

“To evade detection participants were encouraged to edit and modify the content of their phishing emails, so that they would explore the effectiveness in each attempt,” researchers explain.

In determining the role incentives play in determining phishing effort and success, they found that participants who received rewards for their efforts early on were more likely to exert more effort.

There was no evidence of individual creativity predicting success in phishing attacks.

However, when researchers analysed what phishing strategies are used and how they are implemented, they discovered substantial findings.

There were several different tactics that could potentially result in phishing success: an authoritative tone, an expression of shared interest, sending notifications, and communicating failure, and pretending to be a friend all proved to be successful tactics.

Phishers used email tactics including deal offers, selling illegal material sales and those that used a positive tone didn’t fare so well.

“Participants who received phishing examples that contained work-related and social communications, were more successful with their attacks,” Rajivan and Gonzalez explain.

They found that attackers who stick to certain strategies may be more likely to persuade victims to respond to emails.

“Attackers who discover effective strategies and who are persistent in their attempts to making them work would be more successful in persuading end-users to respond to their phishing emails. Our results also suggests an effect of phishing inspiration on phishing success,” they continue.

The experiment did not provide consider spear phishing as it did not supply phishers with any specific details about the targets.

The researchers say future work in the field could open up understanding of human behaviour in the context of spear phishing attacks.

“These insights may be used to inform tools and training procedures to detect phishing strategies in emails,” Rajivan and Gonzalez conclude.

Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).