Susceptibility to URL-based Internet attacks: Facebook vs. email

Benenson, Zinaida; Girard, Anna; Hintz, Nadina; Luder, Andreas

doi:10.1109/percomw.2014.6815275

Cited by 9 publications

(8 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The social scaffolding attack (using LinkedIn) that we introduced in this study is a new type of attack on social networks. Previous studies have analyzed the effect of using Facebook as a medium for delivering the attack messages [35], [36] but their finding contradicts each other. Researchers in [35] found fraudulent messages delivery by email more successful in fooling users to click on a link embedded in the message, while authors in [36] found messages delivered by Facebook more convincing.…”

Section: Related Workmentioning

confidence: 93%

Less is More: Exploiting Social Trust to Increase the Effectiveness of a Deception Attack

Baki,

Verma,

Mukherjee

et al. 2020

Preprint

View full text Add to dashboard Cite

Cyber attacks such as phishing, IRS scams, etc., still are successful in fooling Internet users. Users are the last line of defense against these attacks since attackers seem to always find a way to bypass security systems. Understanding users' reason about the scams and frauds can help security providers to improve users security hygiene practices. In this work, we study the users' reasoning and the effectiveness of several variables within the context of the company representative fraud. Some of the variables that we study are: 1) the effect of using LinkedIn as a medium for delivering the phishing message instead of using email, 2) the effectiveness of natural language generation techniques in generating phishing emails, and 3) how some simple customizations, e.g., adding sender's contact info to the email, affect participants perception. The results obtained from the within-subject study show that participants are not prepared even for a well-known attack -company representative fraud. Findings include: approximately 65% mean detection rate and insights into how the success rate changes with the facade and correspondent (sender/receiver) information. A significant finding is that a smaller set of well-chosen strategies is better than a large 'mess' of strategies. We also find significant differences in how males and females approach the same company representative fraud. Insights from our work could help defenders in developing better strategies to evaluate their defenses and in devising better training strategies.

show abstract

Section: Related Workmentioning

confidence: 93%

Less is More: Exploiting Social Trust to Increase the Effectiveness of a Deception Attack

Baki,

Verma,

Mukherjee

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…Automated crawling and identity theft can be done easily as shown in [9] on a number of popular social networking sites. Among the previous works, two of them focused on using Facebook as a plain delivery platform [7,8]. Researchers in [8] showed that users' click through rate is significantly higher for messages delivered by email.…”

Section: Attacks On Social Networkmentioning

confidence: 99%

“…Among the previous works, two of them focused on using Facebook as a plain delivery platform [7,8]. Researchers in [8] showed that users' click through rate is significantly higher for messages delivered by email. On the contrary, authors in [7] showed that Facebook-delivered messages performed better than emails in fooling people to click on the link.…”

Section: Attacks On Social Networkmentioning

confidence: 99%

“…Several researchers studied deception and social engineering attacks on social networks (SN) [56,57] but none of them investigated the effectiveness of SNs as a message delivery medium (facade). Researchers in [7,8] compared the users' susceptibility to attacks delivered by Facebook and email. Authors in [8] showed email-based attacks are significantly more successful than Fakebook-based attacks, while results of [7] showed the opposite.…”

Section: Introductionmentioning

confidence: 99%

“…Researchers in [7,8] compared the users' susceptibility to attacks delivered by Facebook and email. Authors in [8] showed email-based attacks are significantly more successful than Fakebook-based attacks, while results of [7] showed the opposite. We use a professional network, LinkedIn, as a platform to deliver messages to potential victims and compare its effect on users' judgment with the case where messages are delivered by email.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Scam Augmentation and Customization: Identifying Vulnerable Users and Arming Defenders

Baki

Verma

Gnawali

2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Why do "classical" attacks such as phishing, IRS scams, etc., still succeed? How do attackers increase their chances of success? How do people reason about scams and frauds they face daily? More research is needed on these questions, which is the focus of this paper. We take a well-known attack, viz. company representative fraud, and study several parameters that bear on its effectiveness with a between-subjects study. We also study the effectiveness of a coherent language generation technique in producing phishing emails. We give ample room for the participants to demonstrate their reasoning and strategies. Unfortunately, our experiment indicates that participants are inadequately prepared for dealing with even the company representative fraud. Participants also could not differentiate between offers written by human or generated semi-automatically. Moreover, our results show attackers can easily increase their success rate by adding some basic information about the sender, so defenders should focus more on such attacks. We also observed that participants who paid attention to more clues were better in distinguishing legitimate messages from phishing, hence training regimes should check for reasoning strategies, not just who did not click on a link or download an attachment. Thus, insights from our work can help defenders in developing better strategies to evaluate their defenses and also in devising more effective training strategies. CCS CONCEPTS • Security and privacy → Phishing; Usability in security and privacy; • Human-centered computing → User studies.

show abstract