Improving Phishing Countermeasures: An Analysis ofExpert Interviews 2 2 Steve Sheng,' Ponnurangam Kumaraguru.i Alessandro Acquisti;' Lorrie Cranor, 1, and Jason Hong 'Department ofEngineering and Public Policy, Carnegie Mellon University, Pittsburgh PA 15213 USA 2School ofComputer Science, Carnegie Mellon University, Pittsburgh PA 15213 USA 3Heinz School ofPublic Policy, Carnegie Mellon University, Pittsburgh PA 15213 USA In this paper, we present data from 31 semi-structured interviews with anti-phishing experts from academia, law enforcement, and industry. Our analysis led to eight key findings and 18 recommendations to improve phishing countermeasures. Our findings describe the evolving phishing threat, stakeholder incentives to devote resources to anti-phishing efforts, what stakeholders should do to most effectively address the problem, and the role of education and law enforcement. Index Terms-anti-phishing, expert interview, electronic crime. more effectively, and incentives that various stakeholders have I. INTRODUCTION in their fight against phishing. PHISHING is a widespread problem that is impacting both The experts we interviewed agreed that phishing is evolving business and consumers. In November 2007, MessageLabs into a more organized effort. It is becoming part of a larger estimated that 0.41% of the 3.3 billion emails going through crime eco-system, where it is increasingly blended with their system each day were phishing emails [1]. Microsoft malware and used as a gateway for other attacks. Some of the Research recently estimated that 0.4% of email recipients are experts suggested that incentives for fighting phishing may be victimized by phishing attacks [2]. The annual cost to misaligned, in the sense that the stakeholders who are in a consumers and businesses due to phishing in the US alone is position to have the largest impact do not have much incentive estimated to be between $350 million and $2 billion [3]. to devote resources to anti-phishing efforts. In terms of To reduce the damage due to phishing, stakeholders have countermeasures, experts identified improving law implemented their own countermeasures: major web browsers enforcement and shutting down money trails as top priorities. have built-in filters (e.g. [5], [6], [7]), Internet service They also identified operating systems vendors, web providers filter suspicious phishing emails, law enforcement application providers, browsers, and Internet service providers officers fmd and prosecute phishers, and US government as stakeholders with key technology influence on phishing. agencies and corporations now educate consumers on Finally, experts agreed that education is an important factor phishing. that is not emphasized enough; however, they did not agree on Phishing scams have also evolved, sometimes at a faster the extent of the impact that education may have. We present pace than countermeasures. Phishers launch attacks on these fmdings and a set of recommendations to improve specific groups (e.g. users of social networking sites) through countermeasures. multiple channels (e.g. phone, instant messaging), and Although previous reports have studied phishing and issued phishing toolkits and compromised credentials are readily recommendations, to the best ofour knowledge this is the first available for sale at low prices on Internet black markets [8]. study that synthesizes the opinions of experts from different Sophisticated phishing schemes such as man-in-the-middle fields, and examines the incentives of various stakeholders to attacks and malware are becoming more frequent [9]. contribute to anti-phishing efforts. As the battle against phishing continues, many questions remain about where stakeholders should place their efforts to II. RELATED WORK achieve effective prevention, speedy detection, and fast action. In response to the growing phishing problem, government Do stakeholders have sufficient incentives to act? What should agencies, industry groups, and consumer groups have be the top priorities for the anti-phishing community? To conducted studies and issued recommendations [10,11,12,13]. provide insights into these questions we conducted 31 in-depth The Financial Services Technology Consortium's report is interviews with anti-phishing experts between May 2008 and the first report that analyzed how phishing works by May 2009. We selected experts from academia, Computer articulating the life cycle of phishing. It also encouraged Emergency Response Team (CERT) centers, the Anti­ fmancial institutions to assess the costs and risks associated Phishing Working Group (APWG) officers, law enforcement, with phishing, develop better intelligence on phishers through and key industry stakeholders. We sought their expertise on improved sharing, and invest and adopt in better mutual the current and future state of phishing attacks, authentication. However, the report did not issue countermeasures that should be implemented to fight phishing recommendations for non-fmancial institutions who also have high stakes in the phishing problem [10]. Manuscript received June 30, 2009. Corresponding author: Steve Sheng (e­ mail: [email protected]). 978-1-4244-4626-1109/$25.00 ©2009 IEEE Authorized licensed use limited to: Carnegie Mellon Libraries. Downloaded on July 09,2020 at 18:11:40 UTC from IEEE Xplore. Restrictions apply. Table 1: Phishing stakeholders. Primary victims suffer direct losses from phishing. Infrastructure providers have technical capabilities to mitigate the problem. For-Profit protectors sell solutions to primary victims and infrastructure providers. Public protectors include law enforcement officials, computer emergency response teams, and academi enuc researchers. Categories Examples ofkey stakeholders Roles Consumers -- Organizations Military, Universities, Corporations Primary victims Financial Institutions Bank ofAmerica, Citibank, Paypal Merchants Online merchants (eBay, Amazon), offline merchants Registrars and Registries GoDaddy, Verisign Internet Service Providers AT&T, Comcast, AOL, Universities Infrastructure providers Email Providers Gmail, Yahoo!Mail, Hotmail Browsers Internet Explorer, Firefox, Safari Software Vendors Symantec, RSA, MarkMonitor, Cyveillence For-profit protectors Law Enforcement Federal Bureau ofInvestigation (FBI), Secret Service state and local enforcement Computer Emergency CERT-CC, CSIRTs Public Protectors Response Teams Academia The Identity Theft Technology Council report also analyzed compromise of credentials that can be used to steal key different phases of phishing and recommended a set of 21 intellectual property or conduct corporate espionage. Financial technical countermeasures [11]. We selected a subset of institutions lose money from fraud conducted with credentials recommendations from this report as a starting point for acquired through phishing, and merchants lose money because discussion in our expert interviews. However, we updated the these fmancial institutions eventually charge them for the set to address non-technical countermeasures as well as new fraudulent transactions. In general, these entities are most and evolving threats that were not discussed in the report. In impacted by phishing, and have the strongest incentive to addition to discussing the set of recommendations, we also protect against phishing. However, as shown later in the result studied the incentives that stakeholders have to implement section, some of them have limited capabilities to counter them as well as how the incentives can be increased. phishing attacks. In addition to these reports, the Anti-Phishing Working Infrastructure providers: Internet service providers, email Group (APWG) has issued a set of best practices and providers, browsers, domain name registrars, and registries are recommendations for hacked website owners [14], registrars infrastructure providers. In most cases, phishers do not go [15], and ISPs and mailbox service providers [16]. Each of after these providers for their money; instead, they seek to these reports focus narrowly on one particular area. In our gain access to the entities' infrastructures so that phishers may analysis, we analyzed the phishing issue holistically and asked launch their attacks. For example, phishers register fake our experts to prioritize their recommendations based on their domain names with registrars. Phishers use compromised importance and effectiveness. machines from Internet Service Providers as part ofa botnet to launch phishing campaigns, sending emails to end user III. STAKEHOLDERS mailboxes or compromising mail provider accounts to send Phishing involves many stakeholders, including consumers, phishing emails.Thesestakeholdersareimportanttostudy.as fmancial institutions, online merchants, Internet Service they are in a better position than most victims to protect Providers (ISPs), mail client and web browser vendors, and against phishing. However some infrastructure providers do law enforcement. In this paper, we have classified not lose money from phishing, so they may not have sufficient stakeholders into the following categories: primary victims, incentives to devote resources to combating phishing. In our infrastructure providers, for-profit protectors, and public interview study, we asked experts what these stakeholders can protectors. Table 1 describes these stakeholders and their do and examined whether or not they have incentives to do so. roles. We used it to select experts and structure our interviews. For-profit protectors: Certain organizations