Why phishing works

ABSTRACT

To build systems shielding users from fraudulent (or phishing) websites, designers need to know which attack strategies work and why. This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users. We first analyzed a large set of captured phishing attacks and developed a set of hypotheses about why these strategies might work. We then assessed these hypotheses with a usability study in which 22 participants were shown 20 web sites and asked to determine which ones were fraudulent. We found that 23% of the participants did not look at browser-based cues such as the address bar, status bar and the security indicators, leading to incorrect choices 40% of the time. We also found that some visual deception attacks can fool even the most sophisticated users. These results illustrate that standard security indicators are not effective for a substantial fraction of users, and suggest that alternative approaches are needed.

REFERENCES

• 1: Ang, L., C. Dubelaar, & B. Lee. To Trust or Not to Trust? A Model of Internet Trust From the Customer's Point of View. Proc. 14th Bled E-Commerce Conf. (2001), 25--26.
• 2: Anti-Phishing Working Group. Phishing Activity Trends Report November 2005 (2005).
• 3: Anti-Phishing Working Group Phishing Archive. http://anti-phishing.org/phishing_archive.htm
• 4: Ba, S. & P. Pavlov. Evidence of the Effect of Trust Building Technology in Electronic Markets: Price Premiums and Buyer Behavior. MIS Quarterly, 26, 3 (2002), 243--268.
• 5: Cheskin Research. E-commerce Trust Study (1999).
• 6: Dhamija, R. Authentication for Humans: The Design and Analysis of Usable Security Systems. Ph.D. Thesis, University of California Berkeley (2005).
• 7: Rachna Dhamija , J. D. Tygar, The battle against phishing: Dynamic Security Skins, Proceedings of the 2005 symposium on Usable privacy and security, p.77-88, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073009]
• 8: Egger, F.N. Affective Design of E-commerce User Interfaces: How to Maximize Perceived Trustworthi-ness. Proc. Intl. Conf. Affective Human Factors De-sign (2001), 317--324.
• 9: Fogg, B. J. Stanford Guidelines for Web Credibility. Res. Sum. Stanford Persuasive Tech. Lab. (2002).
• 10: B. J. Fogg , Cathy Soohoo , David R. Danielson , Leslie Marable , Julianne Stanford , Ellen R. Tauber, How do users evaluate the credibility of Web sites?: a study with over 2,500 participants, Proceedings of the 2003 conference on Designing for user experiences, June 06-07, 2003, San Francisco, California [doi>10.1145/997078.997097]
• 11: B. J. Fogg , Jonathan Marshall , Othman Laraki , Alex Osipovich , Chris Varma , Nicholas Fang , Jyoti Paul , Akshay Rangnekar , John Shon , Preeti Swani , Marissa Treinen, What makes Web sites credible?: a report on a large quantitative study, Proceedings of the SIGCHI conference on Human factors in computing systems, p.61-68, March 2001, Seattle, Washington, United States [doi>10.1145/365024.365037]
• 12: Franco, R. Better Website Identification and Extended Validation Certificates in IE7 and Other Browsers. IEBlog, Nov. 21, 2005.
• 13: Batya Friedman , David Hurley , Daniel C. Howe , Helen Nissenbaum , Edward Felten, Users' conceptions of risks and harms on the web: a comparative study, CHI '02 extended abstracts on Human factors in computing systems, April 20-25, 2002, Minneapolis, Minnesota, USA [doi>10.1145/506443.506510]
• 14: Batya Friedman , David Hurley , Daniel C. Howe , Edward Felten , Helen Nissenbaum, Users' conceptions of web security: a comparative study, CHI '02 extended abstracts on Human factors in computing systems, April 20-25, 2002, Minneapolis, Minnesota, USA [doi>10.1145/506443.506577]
• 15: David Gefen, Reflections on the dimensions of trust and trustworthiness among online consumers, ACM SIGMIS Database, v.33 n.3, p.38-53, Summer 2002 [doi>10.1145/569905.569910]
• 16: Hemphill, T. Electronic Commerce and Consumer Privacy: Establishing Online Trust in the U.S. Digital Economy. Bus. & Soc. Rev., 107, 2 (2002), 331--239.
• 17: Jagatic, T., N. Johnson, & M. Jakobsson. Phishing Attacks Using Social Networks (Indiana U. Human Subject Study 05-9892 & 05-9893). (2005).
• 18: Kim, D., Y. Song, S. Braynov, & H. Rao. A B-to-C Trust Model for Online Exchange. Proc. Americas Conf. on Inf. Sys. (2001), 784--787.
• 19: Lee, M. & E. Turban. A Trust Model for Consumer Internet Shopping. Intl J. Elec. Commerce, 6, 1, (2001), 75--91.
• 20: Litan, A. Phishing Attack Victims Likely Targets for Identity Theft. Gartner Research (2004).
• 21: Loftesness, S. Responding to ""Phishing"" Attacks. Glenbrook Partners (2004).
• 22: MailFrontier, MailFrontier Phishing IQ Test II (2005).
• 23: Princeton Survey Research Associates, A Matter of Trust. (2002).
• 24: Secunia. http://secunia.com/.
• 25: Secunia, Internet Explorer URL Spoofing Vulnerability (2004).
• 26: Secunia, Multiple Browsers Vulnerable to the IDN Spoofing Vulnerability (2005).
• 27: Stone, D. et al. User Interface Design & Evaluation. Elsevier (2005).
• 28: Wang, Y & H. Emurian. An Overview of Online Trust. Computers in Human Behavior, 21, 1 (2005), 105--125.
• 29: Wu, M., R. Miller, & S. Garfinkel. Do Security Toolbars Actually Prevent Phishing Attacks? Posters SOUPS (2005).

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce

Keywords:
phishing, phishing user study, security usability, why phishing works