Customer Involvement in Phishing Defence

Customer Involvement in Phishing Defence
Jordan Schroeder, CEH
June 21, 2011
Abstract
Phishing is a major source of e-commerce insecurity, and human behaviour is a larger factor in preventing
security breaches than technology is. Phishing can defeat highly secure technologies by using unsophisti-
cated technology with highly sophisticated psychological techniques. From the e-commerce vendor or service
provider’s perspective, the solution is to employ the latest secure technology in conjunction with educating
and training their customers and users on how to protect themselves.
Introduction
Phishing is the greatest threat that online bank-
ing currently faces. One hundred years ago, outlaws
would break into bank vaults to steal cash, but in the
Web 2.0 era, ‘Information Highwaymen’ break into
individual customer accounts as they go about their
day-to-day business. Just as bankers of old would in-
stall better safes, current bankers seek to solve this
threat to their customer’s accounts and to their own
reputation by implementing new technology. This ap-
proach is important and necessary, but the banking
industry needs to be aware that it is only a founda-
tional step that alone will not provide the security
they seek.
Attacks are carried out using technology, but
phishing is completed by the victims themselves.
Unlike hacking attacks that can steal without the
need for an authorized party to be actively involved,
what makes phishing so effective is that the victim
is the crucial element used to bypass security. In
other words, traditional attacks require overwhelm-
ing force, but phishing is a con game. Sufficiently ad-
vanced technology can block traditional brute-force
attacks, but to stop phishing effectively requires that
the potential victims play an active role in the defen-
sive process, which requires two elements: education
and behavioural modification. This paper will look
at how an e-commerce organization can instil knowl-
edge and skills in its customers in order to protect
both parties.
Phishing as an Attractive Crim-
inal Enterprise
There are a number of statistics that show how at-
tractive phishing is to criminal organizations:
• The number of phishing emails an average indi-
vidual receives has increased from one or two a
week to more than 70 every day(1)
• More than 420,000 scam emails are sent every
hour in the United Kingdom(2)
• 55 percent of phishing scams are fake bank
emails(2)
1

Customer Involvement in Phishing Defence Jordan Schroeder
• A quarter of British citizens admitted to falling
for phishing emails, losing on average £285(2)
• Online banking fraud has surged by 132% during
the last year(2)
• Phishing web sites created by automated tool
kits doubled with an increase of 123% from May
2010 to August 2010(2)
• One criminal automatic phishing kit was down-
loaded over 200,000 times, according to its cre-
ator(3)
In the words of Tracy Kitten of Bank Info Security,
”clearly, cybercriminals see value in phishing”(1)
.
What makes phishing an attractive criminal
medium? Phishing is easy, free, bypasses firewalls,
bypasses spam filters, bypasses anti-phishing filters,
and can result in very lucrative payouts(4–9)
. No mat-
ter how sophisticated the technological defences are,
phishing takes advantage of the access that an au-
thorized person has, either by getting the user to
disclose their username and password or by piggy-
backing on a connection to a secure website. Once an
attacker has this access, funds are often transferred
to bank accounts in countries that have poor banking
fraud laws(10)
, which further limits the risk of the act.
To make things worse, phishing techniques are evolv-
ing quickly(1,2,10,11)
. Phishing is so effective that it
is used for a variety of purposes and is the primary
method used by hackers to gain access to secure net-
works, instead of using the traditional sophisticated
hacking of firewalls and servers(12)
. This means that
devising a defence against this devastating, continu-
ous, and persistent threat is an imperative.
There are two basic approaches to phishing; drag-
net, and spear fishing. Dragnet phishing sends emails
to great numbers of people, hoping to get a few to
fall for the trap(11,12)
. Spear phishing seeks to gain
the confidence of a few potential victims, or even
just one(1)
. By focusing on a select few potential vic-
tims, the attacker can craft emails in such a way as
to increase their legitimate appearance to the recipi-
ent, and thereby increase the chances that the attack
will succeed. With the amount of information avail-
able online from corporate websites and social net-
works, it is a simple thing to craft a personal-sounding
email(12–14)
. No matter the intended target, phishing
has proven to be simple and easy to execute, and
shockingly effective for their purpose.
Technological Defence
The response to phishing threats has been to de-
velop increasingly sophisticated technology, but the
widespread approach, so far, has only been to ad-
dress the individual symptoms of an attack. Effec-
tive phishing websites have URLs that are close in
appearance to legitimate bank URLs and are kept
online for as long as possible, while supporting mul-
tiple phishing campaigns. The defensive response is
to maintain lists of these malicious URLs and block
access to them. Phishers respond by generating dis-
posable websites that can be replaced as soon as the
existing site is blocked or taken down by the author-
ities. As a result of this approach, phishers have dis-
covered that a website does not need to exist for a
long period of time because 90% of people who re-
spond to a phishing email do so within ten hours of
receiving the email(15)
. Defenders develop algorithms
to inspect URLs to determine if it was designed to
mimic legitimate URLs, but this approach does not
work if the URL is not intended to mimic a legitimate
one, and even less effective if a legitimate web server
has been hacked to be used as a host of the phishing
site(14)
.
One of the easier ways to defend against phishing
is to look at the content of emails and block those
that use commonly used phishing phrases, but at-
tackers circumvent this approach by using sparsely
worded emails with the phishing message in a file as
2 of 8

an attachment(7)
. The standard response to this ap-
proach is to block all or certain attachment types,
but as long as attachments of any type are allowed,
which is true for most organizations, the threat re-
mains. Along the same line of thinking, spam filters
analyze the metadata of an email to determine the
likelihood that the email is or is not spam, based on
common spam characteristics. This approach is effec-
tive in blocking the dragnet method of phishing, but
not if the email comes from a previously approved
source that has been hacked, or if the email is tar-
geted, as is the case in spear phishing(8)
.
Kaspersky Lab, a leader in digital security prod-
ucts, applied for a patent in June 2011 for a new
defensive approach. Kaspersky Lab seeks to create a
tunnel of trusted identity between the bank’s physi-
cal web servers and the customer’s physical computer,
where both ends are verified to be the legitimate en-
tity(16)
. This will have an effect on phishing methods
that rely on illegitimate URLs and look-a-like web-
sites, but it will only work if the customer uses this
verified tunnel to engage in banking activities. Many
banking customers (52% in one survey) engage in per-
sonal banking activities at work and other public ar-
eas, which circumvents such dedicated tunnels(1)
.
Another defensive approach is to use ‘two-factor’
authentication, which is gaining in popularity. This
approach requires that a user have two forms of au-
thentication, one of which is physical, before being
allowed to access the bank’s website. This is a very
powerful approach to preventing attackers’ access to
accounts, because although the attacker my acquire
the login credentials, they will not be able to log in
without the second physical authentication device.
In response to this method, phishers have developed
malware, like Zeus and SpyEye, that prevents a user
from logging off of the bank’s website, and passes
the customer’s web session to the attacker who then
transfers funds from the customers’ accounts(17)
. Ex-
cept for the unusual activity, there is no technological
defence that a bank can develop to prevent this type
of attack(10)
.
Human Behaviour
Phishing is popular with attackers because it is easy
to perform, effective, and the technological methods
to achieve success are simple. But these benefits hinge
on the effectiveness of tricking people to do something
they might not otherwise do. To accomplish that,
phishers become manipulators of human behaviour.
One of the common ways to get a user to act is
to instil a sense of urgency. When the Epsilon data
breach occurred in April 2011, phishers took advan-
tage of the worldwide flood of news of the breach and
sent emails to potential victims (emails that they had
stolen) and told them that as a result of the breach,
bank customers were at risk of having their bank ac-
counts broken into. The emails included a fake link to
a login page where the customers could supply their
current credentials. The urgent tone of the email com-
bined with the pre-existing urgency of the news in
general proved to be effective(8)
. This type of manu-
factured urgency is further compounded by a natural
urgency that web users feel when they read email. A
multi-university study conducted in early 2011 found
that active Internet users were especially susceptible
to phishing because they do not take to time to eval-
uate every communication that they receive(18)
. This
natural sense of urgency contributes to the statistic
that half of the respondents to phishing emails visit
the illegitimate website within an hour of the emails
being sent(15)
.
Besides urgency, notification of changes in com-
pany benefits(11)
, fear, trust, desire, greed, and cu-
riosity(4)
can all be used to successfully manipulate
users. One study found that the imposition of respon-
sibility that appears to come from a higher authority
is the biggest human driver, being 28% more effective
than greed, which was thought to be the most suc-
3 of 8

cessful manipulation technique(19)
. The authoritative
approach is particularly effective in industries that
are highly regulated or in companies that normally
operate with a strict authoritative hierarchy(14)
.
Strangely, those who hold authority are the easiest
group of people to phish, even though they should
be immune to impositions of responsibility. Company
executives can feel that security policies should not
apply to them and are quick to complain when they
feel that security policies are too restrictive. IT de-
partment personnel tend to make allowances for such
requests by executives(20)
. In the same way, CIO’s
tend to be early adopters of new technology and will
bring a new device into the office before it has been
properly tested for security. This opens up unknown
security holes that attackers can exploit by breaking
into the device with a phishing email that contains
code designed to take over certain devices. When the
CIO uses his new device to read the email, attach-
ment, or link, the device becomes compromised and
can be used to send emails using the CIO’s account
or for a staging point for breaking into the secure net-
work(20)
. This vulnerability shows the importance of
having a security policy and the importance of follow-
ing it, no matter who the member of the organization
is, as well as showing how otherwise effective technol-
ogy can be effortlessly subverted by the very people
it is supposed to protect.
Effective Remedies
Since technology is not effective in and of itself, the
solution to protecting an organization or enterprise is,
in the words of the security consultant Jason Street,
to “patch the human problem”(20)
. The focus on peo-
ple being the solution to phishing is growing in the
IT Security and Banking industries(13,14,21)
. There
are two methods to employ: providing information to
empower customers, and instigating a change in cus-
tomers’ behaviour.
The first step to ‘patching the human problem’ is
to provide the basic information necessary to identify
the hallmarks of a phishing email. Banks and other
e-commerce vendors can set up regular newsletters,
informational websites, and social networking venues
to communicate security tips and warnings(22)
. Even
simple Twitter messages of “Remember: we will never
send you an email with a link to log on to your ac-
count” can be effective in raising the general aware-
ness of the average user, which in mid-2011 is very
low(22)
. As phishing techniques continue to evolve, a
bank or vendor who already has a following of cus-
tomers who listen to their tips will be able to more
quickly inform their customers of the changing threat
landscape. Another important consideration is to pro-
vide a standard and consistent channel of communi-
cation for recent security events and alerts of active
threats. If consumers have a trusted source of infor-
mation apart from emails, they can start to depend
on it to verify suspicious-looking communications(23)
.
The second step in devising a more complete so-
lution to phishing is to engage in active education
designed to change the behaviour of the recipient.
Knowing the theory behind phishing will only go so
far unless the user has a chance to put that knowl-
edge into practice in an instructive environment. This
involves the bank or vendor actively trying to phish
its own customers. If customers fall for the bait, they
are directed to a safe landing page that outlines the
error they made and how they could avoid falling
for a similar trap in the future. This process con-
tinues while gradually increasing the complexity of
the phishing types. Phishing one’s own customers and
employees has been shown to be a very successful ap-
proach, with one vendor seeing a reduction in users
falling for the bait by 50-70%(13)
. PhishMe, a phish-
ing training provider, shows that 58% of participants
fall for the first phishing email in their program, but
that number drops to around 5% by the fourth round
of training emails. These numbers from PhishMe are
4 of 8

significant, and this type of training is gaining the
attention of government departments like the US De-
partment of Energy(19)
.
To maintain the effectiveness of ‘ethical phishing’,
training needs to be ongoing. Having the presence of
mind to weigh the impact of random emails requires
the constant vigilance of the user. That level of aware-
ness needs to be supported by constant information
and training opportunities, and that cannot be ac-
complished with a once a year program(19)
. Just as
security technology and personnel are required to stay
current, so must the recipients of phishing emails.
Conclusion
Phishing is easy to perform, simple in design, highly
effective, and disastrously profitable. By focusing on
tricking a person to take action on behalf of an at-
tacker, no complex technology is required to bypass
the layers of defence erected to protect users. Phish-
ing only works when a user takes action as a result
of receiving a malicious email. Technology can be put
in place to limit the number of phishing emails and
to potentially limit the success of certain types of at-
tacks, but ultimately, it is the user that is the crucial
agent in the attack.
Setting up alternative and consistent channels of
communication for security news, tips, and alerts
can be an effective way to arm customers with rel-
evant information without relying on emails. Testing
their knowledge and instilling the skills to identify
and avoid phishing emails is currently the most ef-
fective method of protecting users, but this solution
requires that testing and training be on-going in order
to maintain effectiveness.
With a combination of up-to-date technology and
continuous training and support, a phisher’s success
can be reduced a significant amount, and indeed,
without the implementation of these elements of pro-
tection, phishing will continue to be a substantial
threat to all banks, e-commerce vendors, and service
providers.
5 of 8

Appendix
This paper uses the very latest material available at
the time of writing, pulling together the most re-
cent news, reports, analyses, and responses from the
IT Security community, as well as the most recent
techniques discovered and advertised to be in use by
criminal organizations. All available peer-reviewed re-
search and academic studies were too old to be of
use for this paper. As one banking IT Security ex-
pert said, “The cybercriminal of 2011 has long ago
bypassed and surpassed the techniques of 2005”(10)
.
References
[1] Kitten, Tracy. (18 Jan 2011). “ ‘Spear-
Phishing,’ Risky Behavior and Poor Protections
To Blame”. Bank Info Security.
http://blogs.bankinfosecurity.com/
posts.php?postID=855 (Accessed 21 June
2011)
[2] Skinner, Carrie-ann. (16 Jun 2010). “3.7 billion
phishing emails were sent in the last 12 months”.
Network World.
http://www.networkworld.com/news/2010/
061610-37-billion-phishing-emails-were.
html (Accessed 21 June 2011)
[3] Brewster, Tom. (23 Jul 2010). “Hackers give
birth to phish that never dies”. IT Pro.
http://www.itpro.co.uk/625453/hackers-
give-birth-to-phish-that-never-dies
(Accessed 21 June 2011)
[4] Vasudevan, N. Thanuja, B M. (15 Aug 2010).
“Cyber goons phish beyond ﬁnancial transac-
tions”. Financial Chronicle.
http://www.mydigitalfc.com/knowledge/
cyber-goons-phish-beyond-financial-
transactions-420 (Accessed 21 June 2011)
[5] Jackson, Jeromie. (17 Dec 2010). “Top 5 Social
Engineering and Penetration Testing Tools”.
Credit Union Information Security Practitioner.
http://itknowledgeexchange.techtarget.
com/security-assessment/top-5-social-
engineering-penetration-testing-tools/
[6] Goodchild, Joan. (11 Jan 2010). “Social Engi-
neering: The Basics”. CSO.
http://www.csoonline.com/article/
514063/social-engineering-the-basics
[7] Kitten, Tracy. (22 Mar 2011). “Low-Tech Scam
Uses Attachments to Fool Spam Filters”. Bank
6 of 8

Info Security.
http://www.bankinfosecurity.com/
articles.php?art_id=3455 (Accessed 21
June 2011)
[8] Rashid, Fahmida Y. (7 April 2011). “Chase
Bank Phish Emails May Be First Post-Epsilon
Scam”. eWeek.
http://www.eweek.com/c/a/Security/
Chase-Bank-Phish-Emails-May-Be-First-
PostEpsilon-Scam-851226/ (Accessed 21 June
2011)
[9] Zetter, Kim. (7 June 2011). “Bank Not Re-
sponsible for Letting Hackers Steal $300K From
Customer”. Wired.
http://www.wired.com/threatlevel/2011/
06/bank-ach-theft/ (Accessed 21 June 2011)
[10] Krebs, Brian. (8 June 2011). “Court: Passwords
+ Secret Questions = ‘Reasonable’ eBanking
Security”. KrebsOnSecurity.com.
http://krebsonsecurity.com/2011/06/
court-passwords-secret-questions-
reasonable-ebanking-security/ (Accessed
21 June 2011)
[11] Vijayan, Jaikumar. (20 Apr 2011). “Phishing
emerges as major corporate security threat”.
Network World.
042011-phishing-emerges-as-major-
corporate.html (Accessed 21 June 2011)
[12] Vijayan, Jaikumar. (9 May 2011). “Phishing
Becomes More Sophisticated”. Network World.
050911-phishing-becomes-more.html
[13] Musthaler, Linda. (12 May 2011). “Don’t
open that email! How to reduce the threat of
phishing”. Network World.
http://www.networkworld.com/
newsletters/techexec/2011/
051311bestpractices.html (Accessed 21
June 2011)
[14] Helms, Karla Jo. (23 May 2011). “Cybercrime
Statistics Expose Five Industries Most Suscep-
tible to Phishing Attacks”. PR Newswire.
http://www.prnewswire.com/news-
releases/cybercrime-statistics-expose-
five-industries-most-susceptible-to-
phishing-attacks-122436438.html (Accessed
21 June 2011)
[15] Leyden, John. (3 Dec 2010). “Half of phish
marks respond to scams within one ‘golden
hour’”. The Register.
http://www.theregister.co.uk/2010/12/
03/phishing_response_survey/ (Accessed 21
June 2011)
[16] Press Release. (3 June 2011). “Kaspersky Lab
has been granted a patent for new anti-phishing
technology”. Kapersky Lab.
http://newsroom.kaspersky.eu/en/texts/
detail/article/kaspersky-lab-has-been-
granted-a-patent-for-new-anti-phishing-
technology (Accessed 21 June 2011)
[17] Neale, Gavin. (9 Dec 2010). “Which Bank would
you like with that Phish?”. M86 Security Labs.
http://labs.m86security.com/2010/12/
which-bank-would-you-like-with-that-
phish/ (Accessed 21 June 2011)
[18] Greene, Tim. (7 April 2011). “Phishing scams
dupe the most active online users”. Network
World.
040711-phishing-research.html (Accessed
21 June 2011)
[19] Jackson, William. (8 Jun 2011). “To defeat
phishing, Energy learns to phish”. Government
Computer News.
7 of 8

http://gcn.com/articles/2011/06/13/doe-
phishing-test.aspx (Accessed 21 June 2011)
[20] Goodchild, Joan. (14 July 2010). “Why execu-
tives are the easiest social engineering targets”.
Network World.
071410-why-executives-are-the-easiest.
html (Accessed 21 June 2011)
[21] Cohen, Reuven. (15 JAN 2010). “GoogleHack
Proves People are Easier to Hack then Net-
works”. Cloud Computing Journal.
http://cloudcomputing.sys-con.com/node/
1248613/ (Accessed 21 June 2011)
[22] Field, Tom. (June 3, 2011). “Fraud Prevention:
The Examiner’s View”. Bank Info Security.
http://www.bankinfosecurity.com/
podcasts.php?podcastID=1151&rf=2011-
06-03-eb (Accessed 21 June 2011)
[23] Unknown. (26 May 2011). “How banks use
Twitter to combat fraud”. Net Security.
http://www.net-security.org/secworld.
php?id=11078 (Accessed 21 June 2011)
[24] Gates, Chris. (16 Dec 2010). “Conducting a
Phishing Campaign in Metasploit Pro”. Attack
Research.
http://carnal0wnage.attackresearch.com/
2010/12/conducting-phishing-campaign-
in.html (Accessed 21 June 2011)
[25] Kennedy, David. (13 Sep 2010). “Social Engi-
neer Toolkit (SET)”. Social-Engineer.org.
http://www.social-engineer.org/
framework/Computer_Based_Social_
Engineering_Tools:_Social_Engineer_
Toolkit_(SET)#Tabnabbing_Attack_Method
[26] Piscitello, Dave. (3 Jun 2011). “APWG Web
Vulnerabilities Survey: June 2011”. Anti-
Phishing Working Group.
http://www.antiphishing.org/reports/
apwg_web_vulberabilities_survey_june_
2011.pdf (Accessed 21 June 2011)
8 of 8

Customer Involvement in Phishing Defence

Recommended

Recommended

More Related Content

What's hot

What's hot (17)

Viewers also liked

Viewers also liked (9)

Similar to Customer Involvement in Phishing Defence

Similar to Customer Involvement in Phishing Defence (20)

Customer Involvement in Phishing Defence