11:53 AM

3 Signs You're Phishing Bait

Beware, introverts and overconfident people. Phishers love to fool you, email security researchers say.

"I am cautious about making too much of the gender difference because we also found that there were differences between computer science and psychology students in terms of phishing susceptibility," he said, noting that "most psychology students were female and most of the CS students were male." In other words, CS students in general, thanks to their computing expertise -- relative to the rest of society -- might be better at avoiding phishing attacks.

Going forward, the researchers plan to expand their research beyond the tested students -- who were all aged 18 and 27 -- to cover professionals in the workplace. They already conducted related studies of employees of an unnamed government agency, although have yet to analyze the results.

How might these findings be applied? Hong's academic profile notes that the goal of the phishing research project is to develop better "phishing susceptibility profiles and anti-phishing tools."

"Many of the anti-phishing tools that are currently available are not based on research with human users, so we think we can do better in developing an effective tool that can be personalized to meet the needs of individual users," said Mayhorn. Such a training tool might require users to respond to a short survey taking 15 minutes or less that gauges their phishing awareness. Another option might be a system along the lines of Amazon.com's artificial intelligence predictive buying algorithms, only tailored to assess what types of risky behaviors people might exhibit as they handle their email.

Either approach would allow a training tool to build a better profile of individual users and target any risky behavior. "If one person is susceptible due to trust-based issues, but another is susceptible due to attacks that cater to their personality traits, it would be useful to have systems that can address specific needs -- not 'one size fits all' systems ... that attempt to address everything, which may not be necessary," said Mayhorn.

Some information security experts, however, have argued that in general, attempting to train users in security is a waste of time. But given the quantity and severity of phishing attacks -- now a favored tool of today's advanced persistent threat (APT) attackers -- as well as the inability of security tools to block all phishing attacks, might not related training be a necessity?

Mayhorn argued that training and technological defenses must supplement each other. "Unfortunately, technological approaches will not always be responsive to new threats," he said. "Cyber-criminals will continue to come up with new ways to attack and security measures will always be reactive rather than proactive. As long as there is a human in the loop, there is always going to be the potential for security breaches so we need to use both approaches -- training and security approaches -- to combat efforts to exploit computer systems."

2 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/21/2013 | 3:17:42 PM
re: 3 Signs You're Phishing Bait
David, the answer is yes. So far, they're planning follow-on studies with professionals, and have preliminary (though as yet unanalyzed) data from a government agency.
D. Henschen
D. Henschen,
User Rank: Apprentice
8/16/2013 | 2:59:20 PM
re: 3 Signs You're Phishing Bait
I have developed special methodologies for automatically detecting pfishing attempts and am launching a company that is sure to make millions of dollars as a cloud service. I have several investors lined up, but we need a bit more venture capital to complete development. An investment of just $10,000 will secure you a 51% stake in the company and a guaranteed profit stream of hundreds of thousands of dollars per year. If you would just respond with your name and social security number...
David F. Carr
David F. Carr,
User Rank: Apprentice
8/16/2013 | 1:31:56 PM
re: 3 Signs You're Phishing Bait
Do the researchers plan to do a follow up study with a broader pool of people?
User Rank: Apprentice
8/14/2013 | 9:12:18 PM
re: 3 Signs You're Phishing Bait
I wonder how many man hours we all put in advising family members about phishes. I know some of them look quite convincing to my parents, who are not introverted or overconfident. Age surely factored into this study as well.
User Rank: Apprentice
8/14/2013 | 8:10:54 PM
re: 3 Signs You're Phishing Bait
I know an older woman who fell for a phishing scheme and got money taken from a bank account. I had wondered who fell for such things...

A nice lady and more, I think, naive than overconfident. This was several years ago, and I'd say the phishing attempts I've received have gotten MUCH more sophisticated since then. (Her identity also was stolen for a Twitter account recently, but that's another story.)

Jim Donahue
Managing Editor
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
The Top Cybersecurity Risks And How Enterprises Are Responding
The Top Cybersecurity Risks And How Enterprises Are Responding
The information security landscape is a constantly shifting risk environment. Today's IT security department must manage both internal and external threats' ranging from malware to mobile device vulnerabilities, to cloud security and ransomware. Download the Dark Reading 2016 Strategic Security Survey to gain insight into how security professionals view these risks, and how they are addressing them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.