International Journal of Security and Its Applications
V ol. 10, No. 1 (2016)
Copyright ⓒ 2016 SERSC 249
A 2006 study [7] found:
 Phishing websites may fool up to 90% of visitors
 Existing anti-phishing browsing cues are often ineffective. Twenty-three percent of
those studied did not look at security indicators displayed
 Warnings about fraudulent certificates were also ineffective: The majority of
participants in the study proceeded without hesitation when presented with warnings.
The procedures and techniques used in phishing constantly evolve. The attackers, often
rich in technical understanding of computer communications and well versed with the
target system procedures, protocols, and common casual habits of its users, develop new
methods of bypassing security protocols and evading detection in order to increase the
chances of a successful attack. In addition to user inability to detect phishing attacks, the
frequency of attack and diversity in attack methods also helps improve the chances of
successful attacks. Technological advances and newly found vulnerabilities also play a
major role in assisting the success of phishing attacks. It is not surprising that even well
trained end users failed to detect 29% of phishing attacks [8]. Untrained users can be
expected to detect even fewer attacks.
Early phishing emails and sites were crafted by the attacker and often easily detectable.
Phishing websites today are created with toolkits that let a phisher specify what legitimate
page to copy and where to direct stolen data, then generate all needed content [4]. One
interesting finding of this research is that these phishing kits often hide backdoors through
which the phished information is sent to recipients other than or as well as the intended
ones. Phishing today is an industry. Phishing toolkits and associated malware are
available for free or purchase. There is also a ready market for information obtained from
victims [3].
Phishing is not only a technological problem. It is also a social engineering attack that
aims at exploiting vulnerabilities in the overall system and is facilitated by users. These
vulnerabilities can be used by the attackers to construct more convincing scams. It is
therefore essential to counter phishing at both the technical and social aspects.
The remainder of this report is organized as follows: in section 2, we discuss the formal
threat landscape. We discuss related work in section 3 and in section 4 we propose
countermeasures to mitigate the phishing problems.
2. Problem Description
Phishing relies on a masquerade where attackers disguise themselves as someone else
and, based on the reputation and human level relationships with the target, try to uncover
information. Some argue that phishing is a social science problem because the attacker
uses social engineering tools to exploit the victim. Others would counter this argument by
noting that it requires technical knowledge of the system that victim is using, bypassing
the security measures, and making your message look credible in order to gain victim's
attention. For classifying the attack vector, we look at the problem through both social
engineering as well as technical perspectives.
A typical phishing attack consists of three key components: lure, hook, and catch [3]:
 The lure is most commonly an email message that appears to be from a legitimate
organization such as a bank or internet service provider the message contains a link to
the hook. The hook is often hidden by obfuscating the URL.
 The hook is a website that mimics the site of the legitimate institution which the
victim or phish is willing to divulge confidential information to.
 The catch involves the phisher making use of the collected information.
Social engineers exploit curiosity, fear, and empathy factors plus traditional phishing
techniques to trick the users into becoming phishing victims [9].

+13062052269

info@desklib.com

See discussions, stats, and author profiles for this publication

Contribute Materials