More Like this

1. Knowledge and Capabilities that Non-Expert Users Bring to Phishing Detection

   Wash, Rick ; Nthala, Norbert ; Rader, Emilee ( August 2021 , Symposium on Usable Privacy and Security)

   null (Ed.)

   Phishing emails are scam communications that pretend to be something they are not in order to get people to take actions they otherwise would not. We surveyed a demographically matched sample of 297 people from across the United States and asked them to share their descriptions of a specific experience with a phishing email. Analyzing these experiences, we found that email users' experiences detecting phishing messages have many properties in common with how IT experts identify phishing. We also found that email users bring unique knowledge and valuable capabilities to this identification process that neither technical controls nor IT experts have. We suggest that targeting training toward how to use this uniqueness is likely to improve phishing prevention. 

   more » « less
2. How Non-Experts Try to Detect Phishing Scam Emails

   Nthala, Norbert ; Wash, Rick ( May 2021 , Workshop on Consumer Protection)

   null (Ed.)

   Email remains one of the most widely used methods of communication globally. However, successful phishing email attacks and subsequent costs remain unreasonably high despite technical advances in defenses that limit phishing scams. In this paper, we examine human detection of phishing. We found that non-experts go through four different sensemaking processes to determine if an email is a phishing message; they use different knowledge and skills to become suspicious differently in each process. Additionally, non-experts rely on their social connections as an investigative tool to determine if an email is a phishing scam. We discuss the impact of our findings on phishing training and technology. 

   more » « less
3. Unrealistic Promises and Urgent Wording Differently Affect Suspicion of Phishing and Legitimate Emails

   https://doi.org/10.1177/1071181321651277  

   Tornblad, McKenna K. ; Armstrong, Miriam E. ; Jones, Keith S. ; Siami Namin, Akbar ( September 2021 , Proceedings of the Human Factors and Ergonomics Society Annual Meeting)

   Phishing emails have certain characteristics, including wording related to urgency and unrealistic promises (i.e., “too good to be true”), that attempt to lure victims. To test whether these characteristics affected users’ suspiciousness of emails, users participated in a phishing judgment task in which we manipulated 1) email type (legitimate, phishing), 2) consequence amount (small, medium, large), 3) consequence type (gain, loss), and 4) urgency (present, absent). We predicted users would be most suspicious of phishing emails that were urgent and offered large gains. Results supporting the hypotheses indicate that users were more suspicious of phishing emails with a gain consequence type or large consequence amount. However, urgency was not a significant predictor of suspiciousness for phishing emails, but was for legitimate emails. These results have important cybersecurity-related implications for penetration testing and user training. 

   more » « less
4. Phishing Email Detection Using Robust NLP Techniques

   https://doi.org/10.1109/ICDMW.2018.00009  

   Egozi, Gal ; Verma, Rakesh ( November 2018 , IEEE International Conference on Data Mining Workshops)

   Even with many successful phishing email detectors, phishing emails still cost businesses and individuals millions of dollars per year. Most of these models seem to ignore features like word count, stopword count, and punctuations; they use features like n-grams and part of speech tagging. Previous phishing email research ignores or removes the stopwords, and features relating to punctuation only count as a minor part of the detector. Even with a strong unconventional focus on features like word counts, stopwords, punctuation, and uniqueness factors, an ensemble learning model based on a linear kernel SVM gave a true positive rate of 83% and a true negative rate of 96%. Moreover, these features are robustly detected even in noisy email data. It is much easier to detect our features than correct part-of-speech tags or named entities in emails. 

   more » « less
5. Detecting and Characterizing Lateral Phishing at Scale

   Ho, Grant ; Cidon, Asaf ; Gavish, Lior ; Schweighauser, Marco ; Paxson, Vern ; Savage, Stefan ; Voelker, Geoffrey M. ; Wagner, David ( August 2019 , USENIX Security Symposium)

   We present the first large-scale characterization of lateral phishing attacks, based on a dataset of 113 million employee-sent emails from 92 enterprise organizations. In a lateral phishing attack, adversaries leverage a compromised enterprise account to send phishing emails to other users, benefitting from both the implicit trust and the information in the hijacked user's account. We develop a classifier that finds hundreds of real-world lateral phishing emails, while generating under four false positives per every one-million employeesent emails. Drawing on the attacks we detect, as well as a corpus of user-reported incidents, we quantify the scale of lateral phishing, identify several thematic content and recipient targeting strategies that attackers follow, illuminate two types of sophisticated behaviors that attackers exhibit, and estimate the success rate of these attacks. Collectively, these results expand our mental models of the `enterprise attacker' and shed light on the current state of enterprise phishing attacks 

   more » « less