Spear Phishing Research Articles

A framework to assist email users in the identification of phishing attacks

Purpose – The purpose of this paper is to propose a framework to address the problem that email users are not well-informed or assisted by their email clients in identifying possible phishing attacks, thereby putting their personal information at risk. This paper therefore addresses the human weakness (i.e. the user’s lack of knowledge of phishing attacks which causes them to fall victim to such attacks) as well as the software related issue of email clients not visually assisting and guiding the users through the user interface. Design/methodology/approach – A literature study was conducted in the main field of information security with a specific focus on understanding phishing attacks and a modelling technique was used to represent the proposed framework. This paper argues that the framework can be suitably implemented for email clients to raise awareness about phishing attacks. To validate the framework as a plausible mechanism, it was reviewed by a focus group within the School of Information and Communication Technology (ICT) at the Nelson Mandela Metropolitan University (NMMU). The focus group consisted of academics and research students in the field of information security. Findings – This paper argues that email clients should make use of feedback mechanisms to present security related aspects to their users, so as to make them aware of the characteristics pertaining to phishing attacks. To support this argument, it presents a framework to assist email users in the identification of phishing attacks. Research limitations/implications – Future research would yield interesting results if the proposed framework were implemented into an existing email client to determine the effect of the framework on the user’s level of awareness of phishing attacks. Furthermore, the list of characteristics could be expanded to include all phishing types (such as clone phishing, smishing, vishing and pharming). This would make the framework more dynamic in that it could then address all forms of phishing attacks. Practical implications – The proposed framework could enable email clients to provide assistance through the user interface. Visibly relaying the security level to the users of the email client, and providing short descriptions as to why a certain email is considered suspicious, could result in raising the awareness of the average email user with regard to phishing attacks. Originality/value – This research presents a framework that email clients can use to identify common forms of normal and spear phishing attacks. The proposed framework addresses the problem that the average Internet user lacks a baseline level of online security awareness. It argues that the email client is the ideal place to raise the awareness of users regarding phishing attacks.

Optimal Personalized Filtering Against Spear-Phishing Attacks

To penetrate sensitive computer networks, attackers can use spear phishing to sidestep technical security mechanisms by exploiting the privileges of careless users. In order to maximize their success probability, attackers have to target the users that constitute the weakest links of the system. The optimal selection of these target users takes into account both the damage that can be caused by a user and the probability of a malicious e-mail being delivered to and opened by a user. Since attackers select their targets in a strategic way, the optimal mitigation of these attacks requires the defender to also personalize the e-mail filters by taking into account the users' properties. In this paper, we assume that a learned classifier is given and propose strategic per-user filtering thresholds for mitigating spear-phishing attacks. We formulate the problem of filtering targeted and non-targeted malicious e-mails as a Stackelberg security game. We characterize the optimal filtering strategies and show how to compute them in practice. Finally, we evaluate our results using two real-world datasets and demonstrate that the proposed thresholds lead to lower losses than non-strategic thresholds.

Trusted Security Policies for Tackling Advanced Persistent Threat via Spear Phishing in BYOD Environment

Abstract With the advent of pervasive and ubiquitous mobile devices, Bring Your Own Device (BYOD) trend is steadily gaining traction amongst many corporations, in allowing the extensive utilization of mobile devices in handling work-related data. However, there are several drawbacks to this approach, one of which is the risks resulted from the occurrence of Advanced Persistent Threat (APT). The goal of APT is to exfiltrate and leak important and sensitive corporate information through exploitation of vulnerabilities within BYOD environment. This paper addresses the APT issue via spear phishing attacks within BYOD environment, through the mediation provided by security policies. The devising of Mandatory Access Control (MAC) security policies using ACPT includes the implementation of environment attributes along with the specification of proposed policy rules for organizations is proven to be the most suitable policy mechanism for BYOD environment. Guidelines in mitigating APT via spear phishing are briefly discussed as well.

Network Security Situation Awareness Based on Phishing Detection

In this paper, we introduce a statistical machine learning classifier and a LSH page similarity detector as the network security situation awareness mechanism to detect the spear phishing that has been widely used in the Advanced Persistent Threats. Then, a number of comprehensive experiments show that our proposed method achieves high accuracy over a balanced dataset. The accuracy is no less than 92% while the recall is more than 97%.

Spam and Criminal Activity

The Internet is a decentralised structure that offers fast communication with a global reach, but also provides anonymity, a characteristic invaluable for committing illegal activities. Cybercrime has rapidly evolved in parallel with the spread of the Internet and e-commerce but attacks via e-mail (spam) remain one of the major vectors for the dissemination of malware and is a predicate to many forms of cybercrime. Spam epitomises one of the earliest on-line criminal partnerships between malware authors and e-mail spammers and it remains one of the most popular ‘social engineered’ means for spreading and injecting malware on computers and other digital devices. Unlike cybercrime that targets ‘low volume, high value’ victims such as banks and requires advanced hacking capability, spam enables malware to reach ‘high volume, low value’ targets, which are less likely to have effective anti-virus or other countermeasures in place. A typical example is the spread of malicious e-mails, containing content that entices the recipient to click on a Uniform Resource Locator (URL) link to a malicious web site or download a malicious attachment. Deception achieved through ‘social engineered’ e-mail messages are relatively well understood but less is known about advanced methods like ‘spear phishing,’ and whether different forms of social engineering are related to different types of malware and crime. Cloaking methods designed to disguise malicious executable files as fairly harmless documents, such as Microsoft Word files, PDF or text file are now common. These include manipulating the encoding method, applying fake double extensions in compressed form, mimicking “URL shortening” services amongst others as means to mask malicious files and links ensuring their spread through the web. Understanding the nature of spam activity and the threat posed by malicious spam e-mails, especially the prevalence, frequency, duration and severity of these common forms of cybercrime are the key to prevention. Noting that states alone lack the capability to suppress spam and must rely on mutual interest and a host of non-state actors to perform tasks usually the province of law enforcement agencies. This research used ‘real world’ data sets from the Australian Communication Media Authority (ACMA) Spam Intelligence Database (SID) to describe the nature and trends in spam borne malware. We processed 13,450,555 spam e-mails: of the 492,978 found with attachments 21.4 percent were malicious, and of the 6,230,274 that contained a URL, 22.3 percent of the web links proved malicious. We argue that because the focus of IT security on perimeter-protection is becoming increasingly ineffective, there is a need to refocus crime prevention activities on the modus operandi of offenders and victim vulnerabilities.

Behind Identity Theft and Fraud in Cyberspace: The Current Landscape of Phishing Vectors

Increased consumer anti-phishing awareness and improved anti-spam technologies has gradually reduced the impact of traditional phishing spams in recent years. To keep up their game in a multi-billion dollar cybercrime industry, hackers have been continuously innovative in developing polymorphic phishing vectors. Spear phishing, malware, search engines poisoning, use of rogue Secure Socket Layer (SSL) certificates, mobile and social media attacks are among the modern and prominent vectors for phishing attacks today. This paper examines today’s most adopted phishing vectors by cybercriminals as observed by security vendors, security analysts and anti-phishing campaigners. Learning the current landscape of these vectors is a key step in developing effective technological, social and legal devices to mitigate the impacts of these threats across the globe. The paper concludes that almost of all today’s phishing attacks begin with spear phishing. Phishers focus more their attacks towards small and medium enterprises. Malware toolkits are the key player in all major attacks. Mobile and social media attacks have rapidly grown recently and promise to be the future of phishing.

Going Spear Phishing: Exploring Embedded Training and Awareness

To explore the effectiveness of embedded training, researchers conducted a large-scale experiment that tracked workers' reactions to a series of carefully crafted spear phishing emails and a variety of immediate training and awareness activities. Based on behavioral science findings, the experiment included four different training conditions, each of which used a different type of message framing. The results from three trials showed that framing had no significant effect on the likelihood that a participant would click a subsequent spear phishing email and that many participants either clicked all links or none regardless of whether they received training. The study was unable to determine whether the embedded training materials created framing changes on susceptibility to spear phishing attacks because employees failed to read the training materials.

스피어 피싱 대응을 위한 관리적 보안대책에 의한 접근

최근 정보보호 기술의 발전으로 사이버 공격의 패러다임이 변화하고 있다. 조직의 시스템이나 네트워크에 대한 보호 대책이 강화되면서 최종 사용자를 대상으로 사회공학적 기법을 이용하는 사이버 공격이 증가하고 있다. 기업이나 정부기관을 대상으로 중요한 기밀 데이터를 절취하거나 중요 서비스를 무력화하는 지능형지속위협(APT, Advanced Persistent Threat) 공격의 약 91%가 스피어 피싱 이메일을 사용하는 것으로 알려졌다. 본 논문에서는 스피어 피싱 공격의 특성과 보안 위협을 자세히 분석하여 기술적인 통제항목만으로 스피어 피싱 공격에 대응하는 것에 한계가 있음을 설명하고 이를 보완할 수 있는 스피어 피싱 공격에 대한 관리적 대응방안을 제안하였다. Recently the paradigm of cyber attacks is changing due to the information security technology improvement. The cyber attack that uses the social engineering and targets the end users has been increasing as the organization's systems and networks security controls have been tightened. The 91% of APT(Advanced Persistent Threat) which targets an enterprise or a government agency to get the important data and disable the critical service starts with the spear phishing email. In this paper, we analysed the security threats and characteristics of the spear phishing in detail and explained why the technical solutions are not enough to prevent spear phishing attacks. Therefore, we proposed the administrative prevention methods for the spear phishing attack.

CYBER SECURITY FOR AIRPORTS

In today’s information age, government organizations and business enterprises are heavily relying on interconnected computer systems to manage a variety of public services including energy, transportation, water, etc. While this increased connectivity has many operational advantages benefitting the public, they have also become vulnerable to cyber attacks such as Corporate Security Breaches, Spear Phishing, and Social Media Fraud. The aviation sector is one the critical infrastructure systems that is not only vulnerable to physical threats, but also cyber threats, especially with the increased use of Bring Your Own Device (BYOD) at airports. It has been recognized that there is currently no cyber security standards established for airports in the United States as the existing standards have mainly focused on aircraft Control System (CS). This paper summarizes the need, background, ongoing developments and research efforts with respect to the establishment of cyber-security standards and best practices at U.S. airports with special emphasis on cyber security education and literacy.

Anti-social networking: crowdsourcing and the cyber defence of national critical infrastructures

We identify four roles that social networking plays in the ‘attribution problem’, which obscures whether or not cyber-attacks were state-sponsored. First, social networks motivate individuals to participate in Distributed Denial of Service attacks by providing malware and identifying potential targets. Second, attackers use an individual's social network to focus attacks, through spear phishing. Recipients are more likely to open infected attachments when they come from a trusted source. Third, social networking infrastructures create disposable architectures to coordinate attacks through command and control servers. The ubiquitous nature of these architectures makes it difficult to determine who owns and operates the servers. Finally, governments recruit anti-social criminal networks to launch attacks on third-party infrastructures using botnets. The closing sections identify a roadmap to increase resilience against the ‘dark side’ of social networking.

Spearing High Net Wealth Individuals

Every day dangerous criminals are targeting high net wealth members of our community as they venture onto the internet. Statements from twenty-nine community organizations and mature age internet users were analyzed using structured coding techniques in order to identify the major criminal risks and threats, and key protective safeguards. The study warns that mature users, particularly those with high net wealth, are critically vulnerable to internet fraud, and personal data and identification theft through spear phishing email and remote access trojan malicious software attacks. The major implication for countries with aging populations, and rising numbers of mature internet users, is the urgent need for ongoing development and resourcing of internet security skills and awareness programs; consumer protection laws and law enforcement assistance; affordable protective internet technologies and complementary support schemes; and the strengthening of online business codes and standards, particularly in dealings with older people.

Research Article Phishing Susceptibility: An Investigation Into the Processing of a Targeted Spear Phishing Email

Research problem: Phishing is an email-based scam where a perpetrator camouflages emails to appear as a legitimate request for personal and sensitive information. Research question: How do individuals process a phishing email, and determine whether to respond to it? Specifically, this study examines how users' attention to “visual triggers” and “phishing deception indicators” influence their decision-making processes and consequently their decisions. Literature review: This paper draws upon the theory of deception and the literature on mediated cognition and learning, including the critical role of attention and elaboration in deception detection. From this literature, we developed a research model to suggest that overall cognitive effort expended in email processing decreases with attention to visual triggers and phishing deception indicators. The likelihood to respond to phishing emails increases with attention to visceral cues, but decreases with attention to phishing deception indicators and cognitive effort. Knowledge of email-based scams increases attention to phishing deception indicators, and directly decreases response likelihood. It also moderates the impact of attention to visceral triggers and that of phishing deception indicators on likelihood to respond. Methodology: Using a real phishing email as a stimulus, a survey of 321 members of a public university community in the Northeast US, who were intended victims of a spear phishing attack that took place, was conducted. The survey used validated measures developed in prior literature for the most part and tested results using the partial least-squares regression. Results and discussion: Our research model and hypotheses were supported by the data except that we did not find that cognitive effort significantly affects response likelihood. The implication of the study is that attention to visceral triggers, attention to phishing deception indicators, and phishing knowledge play critical roles in phishing detection. The limitations of the study were that the data were drawn from students, and the study explored one phishing attack, relied on some single-item measures, cognitive effort measure, and a one-round survey. Future research would examine the impact of a varying degree of urgency and a varying level of phishing deception indicators, and actual victims of phishing attacks.

Computer security threats faced by small businesses in Australia

In this paper, an overview is provided of computer security threats faced by small businesses. Having identified the threats, the implications for small business owners are described, along with countermeasures that can be adopted to prevent incidents from occurring. The results of the Australian Business Assessment of Computer User Security (ABACUS) survey, commissioned by the Australian Institute of Criminology (AIC), are drawn upon to identify key risks (Challice 2009; Richards 2009). Additional emerging threats relating to wireless internet, cloud computing and spear phishing are also outlined, as well as the risks relating to online fraud.