Story image

Researchers probe psychology behind phishing attacks

28 Feb 18

What makes the difference between a successful phishing attack and an unsuccessful one?

That is just one of the questions posed by two researchers at Carnegie Mellon University in the US in a study that created an experiment to see exactly which phishing strategies work.

Prashanth Rajivan and Cleotilde Gonzalez conducted the research in a study titled Creative Persuasion: A Study on Adversarial Behaviors and Strategies in Phishing Attacks.

The study states that cybercriminals will attempt to act as a trustworthy third party in social engineering attacks designed to trick people into downloading malicious attachments or to visit fake websites.

The researchers had three questions: What role do incentives play in determining phishing effort and success; does individual creativity predict success in phishing attacks;  what, and how strategies are implemented in successful phishing emails.

They created an experiment in which 105 participants acted as phishing attackers and scored points for successfully deceiving 340 other participants who were the recipients.

The experiment was played in turns and was designed to train and award participants for trying different phishing methods.

“To evade detection participants were encouraged to edit and modify the content of their phishing emails, so that they would explore the effectiveness in each attempt,” researchers explain.

In determining the role incentives play in determining phishing effort and success, they found that participants who received rewards for their efforts early on were more likely to exert more effort.

There was no evidence of individual creativity predicting success in phishing attacks.

However, when researchers analysed what phishing strategies are used and how they are implemented, they discovered substantial findings.

There were several different tactics that could potentially result in phishing success: an authoritative tone, an expression of shared interest, sending notifications, and communicating failure, and pretending to be a friend all proved to be successful tactics.

Phishers used email tactics including deal offers, selling illegal material sales and those that used a positive tone didn’t fare so well.

“Participants who received phishing examples that contained work-related and social communications, were more successful with their attacks,” Rajivan and Gonzalez explain.

They found that attackers who stick to certain strategies may be more likely to persuade victims to respond to emails.

“Attackers who discover effective strategies and who are persistent in their attempts to making them work would be more successful in persuading end-users to respond to their phishing emails. Our results also suggests an effect of phishing inspiration on phishing success,” they continue.

The experiment did not provide consider spear phishing as it did not supply phishers with any specific details about the targets.

The researchers say future work in the field could open up understanding of human behaviour in the context of spear phishing attacks.

“These insights may be used to inform tools and training procedures to detect phishing strategies in emails,” Rajivan and Gonzalez conclude.

ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).
'DerpTrolling’ faces jail time for Sony DoS attacks
A United States federal court has charged a 23-year-old man for the hacks on Sony Online Entertainment and other major companies back in 2014.
It's time to rethink your back-up and recovery strategy
"It is becoming apparent that legacy approaches to backup and recovery may no longer be sufficient for most organisations."
Dropbox strengthens security with raft of new partnerships
Integrations will keep customer content protected and secure with tools for controlling identity access, governing data, and managing devices.
Companies swamped by critical vulnerabilities – Tenable
Research has found enterprises identify 870 unique vulnerabilities on internal systems every day, on average, with over 100 of them being critical.
Don’t let your network outgrow your IT team
"IT professionals spend less than half of their time at work optimising their networks and beefing it up against future security threats."
Three access management trends making waves in APAC
Consumer identity proofing, authentication, and authorisation will top the $37 billion value mark by 2023.