Slashdot Mirror
People Suck at Spotting Phishing
JohnGrahamCumming writes "Initial results at SpamOrHam.org show that people don't fare well when trying to spot spams and phishes. This blog entry shows some actual spams and phishes that people fell for, as well as genuine messages that they think are spam." The thing about these s[cp]ams is that they must work sometimes. When I see the messages, I can't fathom 'how'.
I've seen more sophisticated phishing examples by far, and some are indistinguishable from what might be the real thing. The distinguishing factor from a genuine missive is the best phishes have links to bogus addresses (sometimes denoted with only an IP address), and the destination site asks for information company's won't ask for from an e-mail.
One of the best phishes I've seen was sent to me -- it was ostensibly from my phone company, and it described a problem with my on-line bill pay (I don't). The letter was nicely formatted with the colors and icons of my phone company. The link was a giveaway, when I rolled over it, I could see the IP address, not a phone company web-site.
I researched this a bit more, went to my phone company's web site, and downloaded their graphics. A bit-for-bit comparison of their icons, etc., and the phishers showed them to be identical. (Interestingly, this puts phishers also in the position of being guilty of more crime: copyright violations.)
Had my suspicions not been raised by the fact I wasn't participating in on-line bill pay and the phish indicated that problem, and had I not seen the IP address by rolling over the link (which I only did because of above suspicion), I easily could have been convinced I was dealing with a real e-mail (NOTE: this was two years ago, before phishing had become real big, and it was my first incident.)
I can easily believe many, if not most could fall for well crafted phishing expeditions. I would agree with the cited article, those are weak examples unlikely to catch savvy users (though they still could catch the naive, of which there are millions!). (And, I would claim some of the examples really are nothing more than SPAM.)
He finds it strange that people called that message from "Keith" to be spam... but the thing is, if you have no idea who "Keith" is, it probably IS spam... and if you do know him, you probably would not mark it as such.
The same goes for the US Airways thing. Yeah, it's an example of "not spam", but if you haven't recently bought a US Airways ticket, then the save bet would be that it is.
Oh... and the nun joke is fucking hilarious. That alone made TFA worth reading.
Information wants to be anthropomorphized.
TFA seems to be using a funny definition of spam.
Most would say it's unsolicited commercial junk mail, but he seems to think it means "phony" email. Apparently he doesn't mind receiving weekly airfare specials containing choice bits like "BID FOR TICKETS TO THE BIG GAME IN THE BIG EASY!"
Also re phishing: I'd say paypal is largely at fault for this. They do (did?) send an awful lot of useless mail full of clickable links - they were just begging to get phished because people were so used to receiving authentic but useless clickable mail from them. None of my other banks have done this (although one sends a fair amount of crap not specific to my account - rates and such).
So what if someone thinks a legitimate email from a bank is a phishing scam? Banks shouldn't be using email for anything serious because it makes their customers more susceptible to fraud. If people expect to receive legitimate and sensitive communications from their bank via email, it's that much easier to fall for it.
For example, I got one this morning talking about my home loan account with a large bank I don't have an account with. I know it's a phishing scam just from the From and Subject lines. However, if my own bank sent an email talking about my actual mortgage, I'd treat it in exactly the same way. There's no benefit to giving an email the benefit of the doubt. If there is something my bank needs from me, they can send a letter and I'll go to my local branch to take care of it in person.
Let's say I handed you an entire crate of auto parts, and told you that some of them may be genuine parts, while others might be knockoffs. I give you a whole binder, filled with instructions on how to differentiate between all the different "good" and "bad" parts. Some of these knockoffs are obvious fakes; others are quite cleverly done, requiring you to check for minute details such as whether or not inner surfaces are well-polished, or subtle discrepancies in serial number schemes and product logos.
At what point do you just start winging it? After one day of studious sifting? After a week? A month? When you see a part that you're pretty sure is genuine, but would need to haul out the manual for ten minutes' worth of cross-checking part and serial number ranges to confirm this--at what point do you simply go with your gut?
When somebody who knows what they're doing goes about trying to hoodwink your typical individual, it can be very hard for the individual to know when they're being hoodwinked, even if they know they might be being hoodwinked. It's part of human nature--there's a point at which you just throw your hands in the air and grant your trust to an unknown entity, because it's too tedious or time-consuming to check everything out. Given the average person--heck, even a person who knows a fair amount about the subject--there'll be a point where they just take the damn part and have it installed in their car, because they just want to be done with it and get on with their life. It's the same thing with phishing--unless you're one of those few individuals who has fairly advanced knowledge on the subject, you're eventually going to give up and make a gut-reaction decision to whether or not you "trust" the email you just got, simply because it's more trouble than it's worth to actually dig through it.
Obliteracy: Words with explosions
Ah, and by the way, there are many people falling for fraud on the front door. We really shouldn't allow people to open the front door if they have not passed a test or three. The fact that anyone is able to open his front door means that there are a lot of ... uninformed people out there.
The Tao of math: The numbers you can count are not the real numbers.
That might be a little harsh. We're seeing increasingly sophisticated phishing stuff -- right down to building a look-alike site of the bank which they are pretending to be.
I think it's getting increasingly difficult for even people who know what they're looking for to spot.
Yes, people need to learn the basics of how to spot and avoid spam and phishing. But, the increasing sophistication of the bad guys makes it a difficult thing to always identify.
Cheers
Lost at C:>. Found at C.
Evil will always triumph, because good is dumb.
Proud member of the American Non Sequitur Society. We might not make much sense, but boy do we love pizza!
Email clients and servers need to start automatically looking at the chain of IP addresses or domains in the headers, and rating them accordingly.
If any header lies, e.g. IP address mismatches with domain name, or two successive Received-by headers don't have consistent information, then RED ALERT.
If the From domain doesn't appear in top-most received line, YELLOW ALERT. If it doesn't appear in any line, RED ALERT.
If the top-most received line's address is from a known spamming domain or open relay, RED ALERT.
If any previous mail-server, such as your ISP's, tagged the message with YELLOW or RED alerts, your alert should be at least this high.
Note that red and yellow alerts don't necessarily indicate spam. They are simply one of many indicators of spam, and should be used as input to the spam/ham decision-making process.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Problem is, people often mistake unwanted email for unsolicited email. I don't want to hear from Travelocity every week, with their weekly specials. It's unwanted, but I can cancel their letter if it gets irritating enough. The V14Gr4 ads, are not easily (or at all) cancellable. When you blend the two types of emails, people do tend to misclassify them.
You have a constitutionally protected right to be wrong, and I the right to ignore you.
I don't see how you could possibly think that the results of such a website could be meaningful. Spam filtering is a contextual process. This site cripples the critical component that allows humans to behave differently from naive filters, i.e. judgement based on memory. The claim being made here is that humans can't identify other people's spam (and this makes sense, how can you tell if you're shown a random email whether it's unsolicited or not? the only way you can is by knowing whether the recipient had been signed up for a mailing list or not!). You should NOT conclude, based on that fact, that humans are bad at identifying their own spam.
There are lives at stake here!
Stop using HTML or convert it plain text and it's hard not to spot a phish.
UNIX/Linux Consulting
I conduct almost all of my business online and I don't think this is necessary.
I am never, ever asked for a password or identifying information via email. At least never by the legitimate company.
And I never click a link in an email. If my bank/company wants me to update my information, I type their website URL by hand into Firefox, log into my account section, and do what I need to do.
It basically comes down to this: Don't click links in email.
This one basic rule really does solve 99.999% of all scam problems, while allowing you to conduct business online safely.
I completed about four tests before I started to get the feeling that I was actually working on training their filter. I felt like I should be charging a fee. Most of the tests are bogus. One email asked me to add some addresses to the "TW mailing list". I don't have context - in this scenario, do I work for an employer who has a "TW mailing list"? Do I manage it? The answer has everything to do with the way I'd rank it. In fact, most of the emails referred to specific people, and knowing or not knowing them would control the rating on the email.
EVERY serious site has a disclaimer stating they will NOT ask you for your details by email. EVERY scam involves them sending an email asking for your details.
In the early days, yes. Now, many phishers have wised up. They'll send you a phish that, save for one or two links, looks absolutely legitimate. You click the link, it sends you to a page at ebay.verification-department.com that mimics an actual eBay login page. You'll "log in", then they'll welcome you and very professionally gather your information--all, of course, after you've "logged in" to their system.
You can't cheat a honest man
Oh, you most certainly can. Just 'cause something rolls off the tongue nicely doesn't mean it's true.
and you can't phis a person who thinks.
Again, we're talking about attrition and trust. Unless you have a quite solid understanding of what phishing is, how to identify it, and how to go about avoiding it, you're going to eventually just trust something that looks legitimate enough. It's simply not feasible to expect that every single user of email will have enough technical know-how to identify and avoid getting phished.
You've got telephone slamming, you've got phishing, you've got insurance fraud, you've got pyramid schemes, you've got con artists--if we were all simply smart enough to know a rat when we saw one, none of these would be a problem. The problem is that many, many people have ductile minds and want to trust other people. If you're somebody who is willing to cheat another person out of their money, odds are that you'll eventually nail somebody. It's attrition, plain and simple--eventually, people simply let their guard down, even if only for a moment.
Obliteracy: Words with explosions
It's pretty easy to tell the phish from the non-phish, as I don't bank or shop at most of the places the phishers send my way. Also, should I receive an e-mail from my bank (which they already said they wouldn't send me--believing that snail mail is more secure and less likely to be abused), and I feel the need to get there to deal with whatever the message may be saying, I'm surely not going to click a link. Heck, I probably wouldn't even visit the bank during the same session for fear of some kind of redirect spyware that they tried to sneak into the session.
Looking at the URL and seeing "ebay.somewhere.ch" instead of "ebay.com" isn't secure enough anyway, as it's trivial to spoof the status bar with the hover-over text.
The only way to avoid being phished is to not trust any e-mail that has anything to do with anything related to money, savings, charge cards, or deals that are too good to be true--they are too good to be true. A good runner-up is to find a black-hole mail service (i.e., get your own domain name) and set up an account for each vendor you deal with, with a less-than-likely phishable address (e.g. nvrSp4mMy-ebay@mydomain.us). Then, never give your "real" e-mail address to any site you don't explicitly trust. Or even use the same black-hole method for sites you do trust--like slashdot@mydomain.us), instead opting for a black hole e-mail address; this also helps identify who compromised your identity.
While some software is sometimes better at recognizing these things than others (I seldom get phish-mail at my GMail account, as they're recognized and flagged by the other users first), we still can't rely on an automated method to stop these things. It is on the individual to be responsible with their own information.
"I am not who I seem to be," is the safest way to present yourself to the generally anonymous Internet. That's the way they're presenting themselves.
End the FUD