Scam Pandemic: How Attackers Exploit Public Fear through Phishing

Bitaab, Marzieh; Cho, Haehyun; Oest, Adam; Zhang, Penghui; Sun, Zhibo; Pourmohamad, Rana; Kim, Doowon; Bao, Tiffany; Wang, Ruoyu; Shoshitaishvili, Yan; Doupé, Adam; Ahn, Gail-Joon

doi:10.48550/arxiv.2103.12843

Cited by 1 publication

(1 citation statement)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Phishing websites. Researchers have extensively addressed phishing attacks by: (1) studying several techniques used by the attackers [24,28,32,34,42,46,47,66,100], (2) determining how phishing detection measures fare against these attacks [26,35,45,61,76,81,85,88,94,103,106,110], and, 3) investigating a myriad of obfuscation strategies used by the attackers to prevent detection by these prevention tools. For detecting phishing websites, researchers have proposed mechanisms that rely on URL blocklists [23,27,70,75,95,99,101] , and machine learning [48,80,82,88,108].…”

Section: Related Workmentioning

confidence: 99%

Cybersecurity Misinformation Detection on Social Media: Case Studies on Phishing Reports and Zoom's Threats

Mohit¹,

Nihal²,

Kinhekar³

et al. 2021

Preprint

View full text Add to dashboard Cite

Recently, threat intelligence and security tools have been augmented to use the timely and relevant security information extracted from social media. However, both ordinary users and malicious actors may spread misinformation, which can misguide not only the end-users but also the threat intelligence tools. In this work, for the first time, we study the prevalence of cybersecurity and privacy misinformation on social media, focusing on two different topics: phishing websites and Zoom's security & privacy. We collected Twitter posts that were warning users about phishing websites and tried to verify these claims. We found about 22% of these tweets to be not valid claims. We then investigated posts about Zoom's security and privacy on multiple platforms, including Instagram, Reddit, Twitter, and Facebook. To detect misinformation related to Zoom, we first created a groundtruth dataset and a taxonomy of misinformation and identified the textual and contextual features to be used for training classifiers to detect posts that discuss the security and privacy of Zoom and detect misinformation. Our classifiers showed great performance, e.g., Reddit and Facebook misinformation classifier reached an accuracy of 99% while Twitter and Instagram reached an accuracy of 98%. Employing these classifiers on the posts from Instagram, Facebook, Reddit, and Twitter, we found that respectively about 3%, 10%, 4% and 0.4% of Zoom's security and privacy posts as misinformation. This highlights the need for social media platforms to dedicate resources to curb the spread of misinformation, and for data-driven security tools to propose methods to minimize the impact of such misinformation on their performance.

show abstract