DOCSLIB.ORG

Utilising the Concept of Human-As-A-Security-Sensor for Detecting Semantic Social Engineering Attacks

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Utilising the Concept of Human-As-A-Security-Sensor for Detecting Semantic Social Engineering Attacks Utilising the concept of Human-as-a-Security-Sensor for detecting semantic social engineering attacks Ryan John Heartfield A thesis submitted in partial fulfilment of the requirements of the University of Greenwich for the Degree of Doctor of Philosophy DOCTOR OF PHILOSOPHY June 2017 Declaration \I certify that the work contained in this thesis, or any part of it, has not been accepted in substance for any previous degree awarded to me, and is not concurrently being submitted for any degree other than that of Doctor of Philosophy being studied at the University of Greenwich. I also declare that this work is the result of my own investigations, except where otherwise identified by references and that the contents are not the outcome of any form of research misconduct." SUPERVISOR: ................................................ ............................... RYAN HEARTFIELD SUPERVISOR: ................................................ ............................... DR. GEORGE LOUKAS SUPERVISOR: ................................................ ............................... DR. DIANE GAN i Abstract Social engineering is used as an umbrella term for a broad spectrum of computer exploitations that employ a variety of attack vectors and strate- gies to psychologically manipulate a user. Semantic attacks are the spe- cific type of social engineering attacks that bypass technical defences by actively manipulating object characteristics, such as platform or system applications, to deceive rather than directly attack the user. Semantic social engineering attacks are a pervasive threat to computer and com- munication systems. By employing deception rather than by exploiting technical vulnerabilities, spear-phishing, obfuscated URLs, drive-by down- loads, spoofed websites, scareware and other attacks are able to circum- vent traditional technical security controls and target the user directly. In this thesis, we begin by defining the terminology of a semantic attack, introducing a historic time-line of attack incidents over the last 17 years to illustrate what is an existential relationship with the user-computer inter- face and it's ever expanding landscape. We then highlight the scale of the semantic attack threat by identifying different individual attacks and dis- cussing recent statistics. Recognising the complexity in understanding the many facets that may form an attack, as well as the depth and breadth of the threat landscape, we construct a taxonomy of semantic attacks which encapsulates attack characteristics into a fixed, parametrised classification criteria that span all stages of a semantic attack. We then supplement the taxonomy of attacks with a survey of applicable defences and con- trast the threat landscape and the associated mitigation techniques in a single comparative matrix; identifying the areas where further research ii can be particularly beneficial. Armed with this knowledge, we then ex- plore the feasibility of predicting user susceptibility to deception-based attacks through attributes that can be measured, ethically, preferably in real-time and in an automated manner. We conduct two experiments, the first on 4333 users recruited on the Internet, allowing us to identify useful high-level features through association rule mining, and the sec- ond on a smaller group of 315 users, allowing us to study these features in more detail. In both experiments, participants were presented with attack and non-attack exhibits and were tested in terms of their ability to distinguish between the two. Using the data collected, we determine predictors of users' susceptibility to different deception vectors. With these, we have produced and evaluated a generalised model for training a dynamic system for proactive user security. Using the model as a base- line, we propose a technical framework that aims to utilise the concept of Human-as-a-Security-Sensor as a dynamic defence mechanism against se- mantic attacks. To test the viability of our framework and to demonstrate the concept of the Human-as-a-Security-Sensor in an empirical context, we employ the framework to develop a prototype Human-as-a-Security- Sensor platform called Cogni-Sense; evaluating its utility in a real-world experiment. Lastly, we conclude with a review of the problem space, summarising our novel contributions towards a dynamic, user-driven de- fence against semantic attacks and identify open problems in our work to discuss future plans and motivation for continuing the development of Human-as-a-Security-Sensor. iii Acknowledgements In all the theses that I have read, all agree that embarking on a PhD is a journey. None were wrong, and like all journeys, there are good times and not so good times. Along the way one experiences many emotions, inspiration, excitement, elation, as well as self-doubt, anxiety and despair where it feels as one is trying to fix an unfixable problem. For me, the journey has been all these things, but the single most important thing I have learned throughout this journey is that without the incredible and unwavering support of my supervisor, colleagues, friends and family, this PhD simply would not have been possible. I am eternally grateful to my supervisor Dr. George Loukas. George is a remarkable human, possessing incredible insight which has helped me to illuminate ways forward when there seemed to be only dead-ends. He is a supervisor any PhD student would wish for - enthusiastic, motivating, providing support in times of need, as well as possessing a great sense of humour! If it was not for George seeing potential in me I would never have undertaken a PhD, and over the past four years his mentorship has guided me to develop a success as a computer science researcher that I never before thought possible. George, thank you for helping me unlock my potential. I give heartfelt thanks Dr. Diane Gan for her continued support and guid- ance as my second supervisor and as my lecturer and mentor through my academic journey from undergraduate to PhD. Your continued enthusiasm and motivation has been both infectious and inspiring. iv I would also like to thank my work colleagues Andy, Sean, Stuart and Zed for their continued support and input and enthusiasm when sharing ideas related to my research, it has helped me to think outside-the-box and improved the quality of this project. A big thank-you also goes to Riley, who helped me turn my unfriendly install process for Cogni-Sense into an automated, user-friendly script! To my beautiful Carla, you have always believed in me, even when I have lost belief in myself. You will never know how much your love and support has driven me to make this PhD possible. v Dedication For my Carla. vi List of Author Publications Manuscripts published • 1. R. Heartfield and G. Loukas. On the feasibility of automated semantic attacks in the cloud. Computer and Information Sciences III. Springer London, 2013, pages 343-351. • 2. R. Heartfield and G. Loukas. A Taxonomy of Attacks and a Survey of De- fence Mechanisms for Semantic Social Engineering Attacks. ACM Computing Surveys (CSUR), 48(3), 2016. • 3. R. Heartfield and G. Loukas. Evaluating the reliability of users as human sensors of social media security threats. Cyber Situational Awareness, Data Analytics And Assessment (CyberSA), 2016 International Conference On. 14 June 2016. IEEE. • 4. R. Heartfield and G. Loukas. Predicting the performance of users as human sensors of security threats in social media. International Journal On Cyber Situational Awareness (IJCSA). 1(1). 2016 • 5. R. Heartfield and G. Loukas, and D. Gan, D. You are probably not the weakest link: Towards practical prediction of susceptibility to semantic social engineering attacks. IEEE Access, 4, 2016, 6910-6928. • 6. R. Heartfield and D. Gan. Social Engineering in the Internet of Everything. Cutter Business Technology Journal. 26(7). 2016, Pages 20-29 vii • 7. R. Heartfield and G. Loukas and D. Gan. An eye for deception: A case study in utilising the Human-As-A-Security-Sensor paradigm to detect zero-day semantic social engineering attacks. Software Engineering Research, Manage- ment and Applications (SERA 2017), 15th ACIS International Conference on. 7 June 2017. IEEE. • 8. S. S. Rahman, R. Heartfield, W. Oliff, G. Loukas, A. Filippoupolitis. Assess- ing the cyber-trustworthiness of human-as-a-sensor reports from mobile devices. Software Engineering Research, Management and Applications (SERA 2017), 15th ACIS International Conference on. 7 June 2017. IEEE. viii Contents 1 Introduction 1 1.1 Outline . .2 1.2 Characterising the threat of semantic attacks . .3 1.2.1 A brief historic overview of social engineering in computer systems3 1.2.2 The extreme diversity of semantic attacks . .7 1.3 The scale of the threat today: recent semantic attack statistics . 10 1.4 Research Aim . 15 2 A taxonomy of attacks and survey of defence mechanisms 17 2.1 Taxonomy of Semantic Attacks . 19 2.1.1 Control Stage 1: Orchestration . 23 2.1.2 Control Stage 2: Exploitation . 27 2.1.3 Control Stage 3: Execution . 32 2.1.4 Taxonomy Examples . 34 2.2 Survey of Semantic Attack Defence Mechanisms . 43 2.2.1 Organisational . 43 2.2.1.1 Policy and Process Control . 43 2.2.1.2 Awareness Training . 45 2.2.2 Technical . 48 2.2.2.1 Sandboxing Mechanisms . 48 2.2.2.2 Authorisation, Authentication and Accounting (AAA) 51 2.2.2.3 Monitoring . 52 2.2.2.4 Integrity checking . 53 ix 2.2.2.5 Machine Learning . 55 2.3 Attack Vs. Defence Matrix . 59 2.4 Discussion: Grand Challenges in Semantic Attack Research . 64 2.4.1 An authoritative semantic attack dataset . 64 2.4.2 Predicting susceptibility to semantic attacks in real-time . 65 2.4.3 Patching the user . 66 2.5 Conclusion . 67 3 Predicting Susceptibility to Semantic Social Engineering Attacks 69 3.1 Predicting Susceptibility . 71 3.1.1 Related Work . 71 3.2 Indicators of susceptibility . 75 3.2.1 Auditable Indicators . 75 3.2.2 Self-Efficacy Indicators . 76 3.3 Methodology .
Load more

Recommended publications
  • A Comparative Analysis of Anti-Phishing Mechanisms: Email Phishing
    Volume 8, No. 3, March – April 2017 ISSN No. 0976-5697 International Journal of Advanced Research in Computer Science REVIEW ARTICLE Available Online at www.ijarcs.info A Comparative Analysis of Anti-Phishing Mechanisms: Email Phishing ShwetaSankhwar and Dhirendra Pandey BabasahebBhimraoAmbedkar University Lucknow, U. P., India Abstract: Phishing has created a serious threat towards internet security. Phish e-mails are used chiefly to deceive confidential information of individual and organizations. Phishing e-mails entice naïve users and organizations to reveal confidential information such as, personal details, passwords, account numbers, credit card pins, etc. Phisher spread spoofed e-mails as coming from legitimate sources, phishers gain access to such sensitive information that eventually results in identity and financial losses.In this research paper,aexhaustive study is done on anti-phishing mechanism from year 2002 to 2014. A comparative analysis report of anti-phishing detection, prevention and protection mechanisms from last decade is listed. This comparativeanalysis reports the anti-phishing mechanism run on server side or client side and which vulnerable area is coverd by it. The vulnerable area is divided into three categories on the basis of email structure. The number of vulnerabilties covered by existing anti-phishing mechanisms are listed to identify the focus or unfocused vulnerability. This research paper could be said as tutorial of a existing anti-phishing research work from decade. The current work examines the effectiveness of the tools and techniques against email phishing. It aims to determine pitfalls and vulnerability of anti-phishing tools and techniques against email phishing. This work could improve the understanding of the security loopholes, the current solution space, and increase the accuracy or performance to counterfeit the phishing attack.
    [Show full text]
  • How to Layer and Sell Security Solutions to Protect Your Clients’ Remote Workers, Data, and Devices
    How to Layer and Sell Security Solutions to Protect Your Clients’ Remote Workers, Data, and Devices PAX8 | PAX8.COM ©2021 Pax8 Inc. All rights reserved. Last updated April 2021. About This Guide This guide offers recommendations to build a layered remote security stack and position it to your clients to keep them productive and secure while working remotely. Introduction Shifting the Security Focus: From the Perimeter to Endpoints 2 Building the Foundation for Remote Security 1. Put Endpoint Security in Place 3 2. Layer on Additional Email Security 4 3. Begin Ongoing End User Security Training 5 Standardizing Your Remote Security Stack: Trending Solutions 6 Fortifying Remote Defenses Other Tools to Secure Remote Work Environments 7 Advancing the Conversation Remote Security Checklist 8 Email Template for Layered Security 9 Education, Enablement & Professional Services Your Expert for Secure Remote Work 10 [email protected] | +1 (855) 884-7298 | pax8.com INTRODUCTION A Shift in Security Focus: While the global spike in remote work in 2020 helped many companies stay productive, it also increased security challenges as employees remotely accessed company networks, of remote workers say files, and data. With more employees working outside their biggest challenge of the safety of perimeter security related to the is collaboration and corporate network and firewalls, IT security focus communication1 shifted to endpoints, email, and end users as the first line of defense. A Wave of COVID-19 Related Cyber Risks: The surge in remote work due to COVID-19 (and the resulting security vulnerabilities) fueled an alarming rise in cybercrime – the FBI reported in August 2020 that cyberattack complaints were up by 400%!2 Microsoft reported that pandemic-themed phishing and social engineering attacks jumped by 10,000 a day, while cybersecurity experts reported that ransomware attacks were up by 800%.
    [Show full text]
  • CHUENCHUJIT-THESIS-2016.Pdf
    c 2016 Thasphon Chuenchujit A TAXONOMY OF PHISHING RESEARCH BY THASPHON CHUENCHUJIT THESIS Submitted in partial fulfillment of the requirements for the degree of Master of Science in Computer Science in the Graduate College of the University of Illinois at Urbana-Champaign, 2016 Urbana, Illinois Adviser: Associate Professor Michael Bailey ABSTRACT Phishing is a widespread threat that has attracted a lot of attention from the security community. A significant amount of research has focused on designing automated mitigation techniques. However, these techniques have largely only proven successful at catching previously witnessed phishing cam- paigns. Characteristics of phishing emails and web pages were thoroughly analyzed, but not enough emphasis was put on exploring alternate attack vectors. Novel education approaches were shown to be effective at teach- ing users to recognize phishing attacks and are adaptable to other kinds of threats. In this thesis, we explore a large amount of existing literature on phishing and present a comprehensive taxonomy of the current state of phish- ing research. With our extensive literature review, we will illuminate both areas of phishing research we believe will prove fruitful and areas that seem to be oversaturated. ii In memory of Nunta Hotrakitya. iii ACKNOWLEDGMENTS I would like to express my deepest gratitute to Professor Michael Bailey for guiding this work from start to finish. I also greatly appreciate the essential assistance given by Joshua Mason and Zane Ma. Finally, I wish to thank my parents for their love and support throughout my life. iv TABLE OF CONTENTS CHAPTER 1 INTRODUCTION . 1 CHAPTER 2 RELATED WORK . 3 CHAPTER 3 ATTACK CHARACTERISTICS .
    [Show full text]
  • Mobile Malware Attacks and Defense Copyright © 2009 by Elsevier, Inc
    Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Elsevier, Inc. “ Syngress: The Definition of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. Unique Passcode 28475016 PUBLISHED BY Syngress Publishing, Inc. Elsevier, Inc. 30 Corporate Drive Burlington, MA 01803 Mobile Malware Attacks and Defense Copyright © 2009 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.
    [Show full text]
  • Cybergenerations Facilitator Guide
    CyberGenerations Workshop Facilitator Guide This document provides instructions to Facilitators on how to effectively deliver a CyberGenerations workshop. It informs Facilitators how to prepare, what to prepare, and what to say and do to facilitate the lessons effectively. About this Workshop Table of Contents Table of Contents .................................................................................................................... 2 About this Workshop .............................................................................................................. 4 Workshop Overview.............................................................................................................. 4 Workshop Outline ................................................................................................................. 5 Preparation Notes for Facilitators ......................................................................................... 6 Advance Preparation for Facilitators .................................................................................... 6 Facilitator Resources ............................................................................................................ 7 Participant Resources........................................................................................................... 7 Facilitation Instructions .......................................................................................................... 8 Topic 1: Welcome (10 min.).................................................................................................
    [Show full text]
  • A Review on Phishing Website Detection Using Machine Learning
    JOURNAL OF CRITICAL REVIEWS ISSN- 2394-5125 VOL 7, ISSUE 19, 2020 A REVIEW ON PHISHING WEBSITE DETECTION USING MACHINE LEARNING Sudha M1, Jaanavi R V2, Blessy Ida Gladys S3, Priyadharshini4 1,2,3,4,School of Information Technology & Engineering,Vellore Institute of Technology - Vellore Campus, India. E mail: [email protected] Received: May 2020 Revised and Accepted: August 2020 ABSTRACT: Fraudulent communication in the internet is an ever growing issue in the cyber world. This article reviews the negative impacts of fraudulent sites referred as Spoofed websites or phishing websites. These spoofed-sites attempts to steal the essential credentials of any individual by means of false websites that appears same as the original website in the cyber space. Any legitimate user in the Internet communication may prompt to use these spoofed-sites by mistyping the web-address. On the other side when an individual attempts to get his site using a browser cache directly instead of typing the site address on own would lead to these type of spoofed web logging. It is severe issue, as it leads to fiscal losses for both industries and individuals. Therefore this article endeavor to investigate the applicability of widely adopted machine learning model for predicting the Spoofed websites. The proposed algorithm is used to identify and characterize the rules and factors required to classify the spoofed websites. Further these classification techniques are used to identify the relationship between rules and factors to correlate them with each other so as to detect the performance, accuracy, number of rules generated and speed. A Divide and conquer approach is applied in this assessment to detect the spoofed websites.
    [Show full text]
  • Session Hijacking. – Stealing of Session ID/Cookies Allows an Attacker to Impersonate an Ongoing Session – Replay of a Session to Repeat Some Important Action
    Computer System- B Security Introduction to Web Security P2 Cookies, session IDs, Phishing (URL obfuscation) Sanjay Rawat HTTP vs HTTPS ● HTTP send request/response in clear text – Information can be sniffed (confidentiality is lost) ● We do not know if we are connected to the right server – Identity/authenticity is not variable. ● HTTPS (secure) solves this by using crypto. – Encryption – Signature – MAC ● Example: SSL/TSL (later in the unit) HTTP is stateless HTTP is stateless ● The notion of a session – encapsulates information about a visitor – Allows user to relate multiple requests HTTP is stateless ● The notion of a session – encapsulates information about a visitor – Allows user to relate multiple requests ● Session information should be considered extremely sensitive HTTP is stateless ● The notion of a session – encapsulates information about a visitor – Allows user to relate multiple requests ● Session information should be considered extremely sensitive ● Thus, a class of attacks known as session hijacking Sessions Using GET or POST Sessions Using GET or POST ● Pass session information to the web server each time the user navigates to a new page using GET or POST requests. Sessions Using GET or POST ● Pass session information to the web server each time the user navigates to a new page using GET or POST requests. ● This method is particularly susceptible to man-in-the- middle attacks, unfortunately, since HTTP requests are unencrypted. Sessions Using GET or POST ● Pass session information to the web server each time the user navigates to a new page using GET or POST requests. ● This method is particularly susceptible to man-in-the- middle attacks, unfortunately, since HTTP requests are unencrypted.
    [Show full text]
  • Web Security
    Web Security 4/6/21 Web Security 1 7.1 The world wide web • WWW is used for banking, shopping, communication, collaborating, and social networking. • Entire new classes of security and privacy concerns has emerged as web security. 4/6/21 Web Security 2 7.1.1 HTTP HTML • A web site contains pages of text and images interpreted by a web browser • A web browser identifies a web site with a uniform resource locator (URL) • The web browser uses Domain Name System (DNS) to determine the IP address of the web server. • The hypertext transfer protocol (HTTP) is used to retrieve the requested web page • The client/web browser makes a TCP connection to a specified port on the web server, by default 80 for HTTP. 4/6/21 Web Security 3 7.1.1 HTTP HTML • HTTP requests typically begin with a request line, usually consisting of a command such as GET or POST. • HTTP responses deliver the content to the browser along with a response header. • The response header includes info about the server such as the type and version number. • Good security practices alter the default server response to not include this info. • Hypertext markup language (HTML) provides a structural description of a document, rendered by web browser 4/6/21 Web Security 4 7.1.1 HTTP HTML • HTML features – Static document description language – Supports linking to other pages and embedding images by reference – User input sent to server via forms – No encryption provided • HTML extensions – Additional media content (e.g., PDF, video) supported through plugins – Embedding programs in supported languages (e.g., JavaScript, Java) provides dynamic content that interacts with the user, modifies the browser user interface, and can access the client computer environment 4/6/21 Web Security 5 HTML Forms • Allow users to provide input to a web site in the form of variables represented by name-value pairs.
    [Show full text]
  • Internet Browser Vulnerabilities
    Web Security 11/17/2010 Web Security 1 HTML • Hypertext markup language (HTML) – Describes the content and formatting of Web pages – Rendered within browser window • HTML features – Static document description language – Supports linking to other pages and embedding images by reference – User input sent to server via forms • HTML extensions – Additional media content (e.g., PDF, video) supported through plugins – Embedding programs in supported languages (e.g., JavaScript, Java) provides dynamic content that interacts with the user, modifies the browser user interface, and can access the client computer environment 11/17/2010 Web Security 2 Phishing • Forged web pages created to fraudulently acquire sensitive information • User typically solicited to access phished page from spam email • Most targeted sites – Financial services (e.g., Citibank) – Payment services (e.g., PayPal) – Auctions (e..g, eBay) • 45K unique phishing sites detected monthly in 2009 [APWG Phishing Trends Reports] • Methods to avoid detection – Misspelled URL – URL obfuscation – Removed or forged address bar 11/17/2010 Web Security 3 Phishing Example http://www.anti-phishing.com 11/17/2010 Web Security 4 URL Obfuscation • Properties of page in previous slide – Actual URL different from spoofed URL displayed in address bar • URL escape character attack – Old versions of Internet Explorer did not display anything past the Esc or null character – Displayed vs. actual site http://trusted.com%01%[email protected] • Unicode attack – Domains names with Unicode characters can
    [Show full text]
  • What Can I Do Regarding a Fraudulent Webshop and How Can I Take It Down? What Can I Do Regarding a Fraudulent Webshop and How Can I Take It Down?
    BRANDIT’s “How to” Guides [Grab your reader’s attention with a great quote from the document or use this space to emphasize a key point. To place this text box anywhere on the page, just drag it.] What can I do regarding a fraudulent webshop and how can I take it down? What can I do regarding a fraudulent webshop and how can I take it down? It’s a beautiful day, you’ve got your favourite coffee from a local café and you’re cracking on with your work, when boom! You find a website that is ripping off your brand, products or that piece of creative work that took you forever to complete! Noooo! What can you do now? Well, before you blow your fuse at the potential infringer, luckily, there are steps you can take. We’ve outlined our top tips on how to spot a fake website and if needed, how to take them down to protect your band. How do infringers spoof your website? You think it couldn’t happen to you? Think again. Unfortunately, creating a fake website is easy for scammers to accomplish. A knowledgeable scammer can steal all of your on-page information and upload it under a fake domain in a matter of minutes. 3 potential ways cybercriminals can imitate your website In a flash, scammers typically make a few small yet significant changes to your content by: • Registering a domain name, adopting a spoofed URL, that may differ only slightly from yours. • Copying your codenames, images and basically everything on your site, but then make slight changes to phone numbers and email addresses.
    [Show full text]
  • Deep Thought: a Cybersecurity Story
    DEEP THOUGHT /////////// A cybersecurity story /////////// Alex Blau, Alexandra Alhadeff, Michael Stern, Scott Stinson, Josh Wright ideas42.org ⁄cyber // about ideas42 IDEAS42 USES INSIGHTS FROM BEHAVIORAL SCIENCE to help solve difficult social problems and make an impact at scale. We grew out of research programs in psychology and economics at top academic institutions and our work draws on decades of experimental scientific research in decision making, along with the most rigorous methods in program and policy evaluation. We work in a number of areas, including consumer finance, economic mobility and opportunity, health, education, energy efficiency, and international development. The conse- quences of the behavioral issues we tackle are often profound. A failure to adhere to medication can be life-threatening. Dropping out of school can prevent a person from achieving her potential. All too often, the reasons for these failures turn out to be small and remediable—but also usually overlooked or dismissed as unimport- ant. Our approach involves carefully diagnosing the behavioral issues that prevent otherwise well-designed programs and products from achieving their goals. We identify subtle but important contextual details that can influence behavior, and design innovative solutions that help to overcome or amplify their effects. Our work involves a lot of observation, plenty of patience, and a willingness to be surprised. Most of all, though, it involves asking the right questions. // acknowledgments THIS PROJECT WOULD NOT HAVE BEEN POSSIBLE without the sup- port of many individuals and institutions. ideas42 would like to thank the William and Flora Hewlett Foundation, whose generous support enabled us to examine crit- ical challenges in cybersecurity through the lens of behavioral science.
    [Show full text]
  • Downloading a Payload
    International Journal of Network Security & Its Applications (IJNSA), Vol.5, No.4, July 2013 EXPLORING HISTORICAL AND EMERGING PHISHING TECHNIQUES AND MITIGATING THE ASSOCIATED SECURITY RISKS Marc A. Rader1 and Syed (Shawon) M. Rahman2, * 1CapellaUniversity, Minneapolis, MN, USA and Associate Faculty, Cochise CollegeAZ, USA [email protected] 2Associate Professor of Computer Science at the University of Hawaii-Hilo, Hawaii, USA and Part-time Faculty at Capella University, Minneapolis, USA *[email protected] ABSTRACT Organizations invest heavily in technical controls for their Information Assurance (IA) infrastructure. These technical controls mitigate and reduce the risk of damage caused by outsider attacks. Most organizations rely on training to mitigate and reduce risk of non-technical attacks such as social engineering. Organizations lump IA training into small modules that personnel typically rush through because the training programs lack enough depth and creativity to keep a trainee engaged. The key to retaining knowledge is making the information memorable. This paper describes common and emerging attack vectors and how to lower and mitigate the associated risks. KEY WORDS Security Risks, Phishing, Social Engineering, Cross Site Scripting, Emerging Attack Vectors, DNS poising. 1. INTRODUCTION Phishing is a social engineering technique that is used to bypass technical controls implemented to mitigate security risks in information systems. People are the weakest link in any security program. Phishing capitalizes on this weakness and exploits human nature in order to gain access to a system or to defraud a person of their assets. The Anti-phishing Work Group (APWG) is an international group focusing on “eliminating the fraud, crime and identity theft that result from phishing, pharming, malware and email spoofing of all types” [1].
    [Show full text]