Scaling and Effectiveness of Email Masquerade Attacks

Abstract

We focus on email-based attacks, a rich field with wellpublicized consequences. We show how current Natural Language Generation (NLG) technology allows an attacker to generate masquerade attacks on scale, and study their effectiveness with a within-subjects study. We also gather insights on what parts of an email do users focus on and how users identify attacks in this realm, by planting signals and also by asking them for their reasoning. We find that: (i) 17% of participants could not identify any of the signals that were inserted in emails, and (ii) Participants were unable to perform better than random guessing on these attacks. The insights gathered and the tools and techniques employed could help defenders in: (i) implementing new, customized anti-phishing solutions for Internet users including training next-generation email filters that go beyond vanilla spam filters and capable of addressing masquerade, (ii) more effectively training and upgrading the skills of email users, and (iii) understanding the dynamics of this novel attack and its ability of tricking humans.

Scam Augmentation and Customization: Identifying Vulnerable Users and Arming Defenders

“…NLG is a challenging research area in which the goal is to generate coherent, human-like text. The Dada engine [11] has been previously used to construct short masquerade emails [5] as well as academic papers on postmodernism [10]. It is a text generation tool based on the recursive transition network (RTN).…”

“…Some of the offers had this sentence "we found your resume on Monster.com," so some participants mentioned why the offer should be sent through LinkedIn while they found the resume on Monster. 5 (3) Some mentioned that the profile picture is unprofessional or has low quality.…”

“…In this paper, we use RTN (a semi automatic text generation technique) to generate phishing emails. The effectiveness of RTN in email masquerade attack has been studied in [5], but here we use it for generating company representative offers which are much longer and more complex. Although RTN requires some human interactions to generate the grammars, it showed promising results and users were not able to distinguish them from human generated email.…”

“…We also consider semi-automatic generation of such attacks using natural language generation techniques (NLG) such as those employed in the Dada tool [10]. This technique previously has been used successfully for masquerade attack [5] but with short emails. With the recent advancement of language modeling techniques using neural networks (NN) [19,50,58], some researchers used NN for generating emails [18,55], but could not generate coherent text.…”

Understanding Phishing Email Processing and Perceived Trustworthiness Through Eye Tracking

“…Whilst there has been research using eye trackers to understand engagement with phishing website there is less research applying this technology to phishing emails (Baki et al, 2017), which are one vector through which targets may be directed to a phishing website in the first instance. There are recommendations made to the public by various organizations around what is likely to denote something as being a phishing email, such as the National Cyber Security Centre advice to look for misspellings, the use of urgency and the use of threatening language (National Cyber Security Centre, 2020), which reflects the typical features of phishing emails identified in the literature (Pfeffel et al, 2019).…”