« Top Spamming Countries | Main | iPhone Hacked -- What Now? »

A recent study at Indiana University tested several versions of phishing email on their students. And while some have questioned the ethics of sending out fake phishing emails to see how best to capture the students personal information, it seems to me that the best way to understand the bad guys is to act like them.

Also, before sending out the phishing emails, the researchers made sure to protect all the emails used in the study behind a secure server, and that none of the information submitted by the unwitting subjects was saved or stored.

And what did they discover? According to this article at Macroworld Investor, 72 percent of the more than 600 students tested fell for an phishing email if it came from an account that looked familiar and asked for usernames and passwords.

If they received the same email from an unfamiliar email address only 18 percent of the students were fooled. This means that hackers can achieve the greatest success using hijacked email accounts. The research also showed that computer users (and these are college students were talking about) have little understanding of Web site security certificates and what constituted a fake website.

Other phishing research has found that phishing is more successful if it relies on human vulnerabilities such as greed, curiosity, ignorance, or fear, which is basically the ingredients of social engineering spam.

"When you talk to someone, you look in their eyes and say, ‘Does this look like they're telling the truth?' And we get pretty good at making these judgments," said Lorrie Cranor, who directs an anti-phishing group at Carnegie Mellon in Pittsburgh. "But most of are not very good at making these judgments online."

The best way to counteract phishing is to train users to recognize these weaknesses and essentially never, whenever personal information is asked for, to restart your web browser and go directly to the website in question, thereby bypassing the potential phishing email altogether.

Posted by pschooff in |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/2152