Design and evaluation of the highly insidious extreme phishing attacks. Issue 70 (September 2017)

• Record Type: Journal Article
• Authors: Zhao, Rui; John, Samantha; Karas, Stacy; Bussell, Cara; Roberts, Jennifer; Six, Daniel; Gavett, Brandon; Yue, Chuan
• Is Part Of: Computers & security. Issue 70(2017)
• Page Start: 634
• Page End: 647
• Publication Date: 2017-09
• Subjects: Web -- Phishing -- Susceptibility -- Single Sign-On -- Toolkit; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.08.008
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: One of the most severe and challenging threats to Internet security is phishing, which uses spoofed websites to steal users' passwords and online identities. Phishers mainly use spoofed emails or instant messages to lure users to the phishing websites. A spoofed email or instant message provides the first-layer context to entice users to click on a phishing URL, and the phishing website further provides the second-layer context with the look and feel similar to a targeted legitimate website to lure users to submit their login credentials. In this paper, we focus on the second-layer context to explore the extreme of phishing attacks; we explore the feasibility of creating extreme phishing attacks that have the almost identical look and feel as those of the targeted legitimate websites, and evaluate the effectiveness of such phishing attacks. We design and implement a phishing toolkit that can support both the traditional phishing and the newly emergent Web Single Sign-On (SSO) phishing; our toolkit can automatically construct unlimited levels of phishing webpages in real time based on user interactions. We design and perform a user study with 194 participants to evaluate the effectiveness of the phishing attacks constructed from this toolkit. The results demonstrate that extreme phishing attacks are indeed highly effective and insidious as over 90% of the participants became the "victims". It is reasonable to assume that extreme phishing attacks will be widely adopted and deployed in the future, and we call for a collective effort to effectively defend against them.