Designing Ethical Phishing Experiments: A study of (ROT13) rOnl query features

Markus JakobssonSchool of InformaticsIndiana UniversityBloomington, IN 47406, USAJacob RatkiewiczDept. of Computer ScienceIndiana UniversityBloomington, IN 47406, USADesigning Ethical Phishing Experiments:A study of (ROT13) rOnl query featuresIntroductionPhishing

Ethical & Accurate

Experiment V.S. Attack statusPrevious workGartner Group 2004 servey $2.4 billion per year in the US aloneAround 5% adult American Internet users are successfully targeted by phishing attacks each yearLower bound Previous workMailfrontier March 05 (report)identified phishing emails correctly 83% of the timeidentified legitimate emails 52% of the time.

Their conclusionOur believeTechniquesMonitoring of ongoing attacksAdministratorsLower estimate

Real Experiment Ethical & accurateUSER-TO-USERPHISHING ON RONLrOnl User-to-User Communication

Third Party

USER-TO-USERPHISHING ON RONLAbusing User-to-User Communication

Content injection attack

Spoofing attack

ContextAware Attacks

Content injection attack

Spoofing attack

ContextAware AttacksPurchase History

Username / Email Correspondence

RONL PHISHING SCENARIOSAttack 1: Context-aware spoofing attackAttack 2: Contextless spoofing attack

Experimenting with SpoofingExperiment 1: context & Non-malicious linkExperiment 2: No context & Non-malicious link

Experimenting with Spoofing

Experimenting with a Malicious LinkExperiment 3: Context & Malicious linkExperiment 4: No Context & Malicious link

Experimenting with a Malicious Link

Experiment Design Analysis

METHODOLOGYIdentity Linkage

93 rOnl users (through the rOnl interface).

44 of the 93 users (47%)

Automated Google searches with several queries limited to cgi.ronl.com(237)

Experimental Email

Experimental EmailMulti Accounts & DaysQuestions1. Hi! How soon after payment do you ship? Thanks!2. Hi, can you ship packages with insurance for an extra fee? Thanks.3. HI CAN YOU DO OVERNIGHT SHIPPING??4. Hi - could I still get delivery before Christmas to a US address? Thanks!! (sent a few weeks before Christmas 05).

Results

Questions