COUNTERACTING PHISHING THROUGH HCI: DETECTING ATTACKS AND WARNING USERS

Transcription

1 COUNTERACTING PHISHING THROUGH HCI: DETECTING ATTACKS AND WARNING USERS DISSERTATION an der Fakultat fur Mathematik, Informatik und Statistik der Ludwig-Maximilians-Universitat Munchen vorgelegt von Diplom-Medieninformatiker MAX-EMANUEL MAURER Munchen, den 15. Dezember

2 TABLE OF CONTENTS List of Figures xvii I INTRODUCTION 1 1 Introduction Usable Security Usable Warning Design Problem Statement Protection: Detection plus Intervention Technical Terms of Detection Main Contributions Structure 9 2 The Act of Phishing What is a Phishing Attack? The Need to Counteract Phishing Attack Overview The Lifecycle of a Phishing Attack Attacks out of Scope Attacks in Scope: Impersonation A Brief History of Phishing and a Possible Future Outlook The Term "Phishing" Design Space of Current Phishing Attacks Typical Phishing Examples Looking at Today's Browsers: Security Indicators in Use 33 3 Related Work The Phishing Problem Phishing in Numbers 40

3 xii TABLE OF CONTENTS Who is Falling for Phishing and Why? The Current State of Detection Methods Black- and Whitelists Security Toolbars Virus Scanners Typo Checkers Law Enforcement and Website Takedown Changing The Internet Architecture The Current State of User Intervention Classical Warning Research Computer-Specific Warning Literature Phishing Education Research Concepts for Detection General Phishing Defense Detection Attempts for Different Features Making Use of a Community Research Concepts for User Intervention Adaptive Dialogs Guidelines and Applications Thereof User Study Methodology 68 II PROTECTION THROUGH HCI 73 4 Overview of Research Covered Delimitation to Related Work Main Research Classification Research Questions Project Overview 79 5 Nine Research Projects on Phishing and Usability Phishing Website Test Set What Should a Phishing Test Set Look Like? Collection Phase Postprocessing The Final Test Set Findings from of the Test Set Data 90

4 TABLE OF CONTENTS xiii Application of The Test Set Research Results SecurityGuard Website Status Rollup Yet Another Status Toolbar? Designing the Extension Implementation User Study Discussion and Limitations Research Results Community-based Rating Intervention The Real World Example: Web Of Trust Community-Based Security Research Building the Prototype User Study Evaluation Discussions and Limitations Research Results Spell Checking to Detect Fraudulent Websites Detecting Phishing URLs Detector Evaluation Results Discussion and Limitations Research Results Possible User Intervention for the Approach Data Type Based Security Dialogs User Intervention Concept The First Prototype Detecting the Data Types Lab Evaluation The Second Prototype Field Evaluation Second Lab Evaluation Discussion and Limitations Research Results Enhancing SSL Awareness in Web Browsers The Concept of SSLPersonas Redesigning SSL Warning Messages Lab Evaluation Field Evaluation Discussion, Limitations and Future Enhancements Research Results 157

5 xiv TABLE OF CONTENTS 5.7 Diminishing Visual Brand Trust The Concept of Destroying Content Trust Focus Group The Final Plugin User Study Evaluation Discussion and Limitations Research Results Visual Image Comparison For Phishing Detection and Reporting Concept: Detecting Phishing Through Visual Similarity Detector Architecture Evaluating the Detector User Intervention Design User Intervention Evaluation User. Intervention Discussion Research Results The User Study Web Browser Web Browsers Usage in Today's Experiments Universal Browser Manipulation Developing the Extension User Study: Validating the Extension Research Results Aggregated Results and Derived Recommendations Answers to the Research Questions Phishing Detection User Intervention From Phishing To General Security Detector and User Intervention Model Recommendations and Guidelines A Utopia of Anti-Phishing Achieving the Best Detection Optimal User Intervention Future Proof Methods A Web Without Phishing? Evaluation Recommendations Preparation Ethics and Privacy 231

6 TABLE OF CONTENTS xv Execution Analysis 235 III CONCLUSIONS Conclusions and Future Work Summarizing This Thesis Open and Future Work A Final Take Home Message 244 IV BIBLIOGRAPHY 245 Bibliography 247 V APPENDIX 275 Index 281