<p>Because of the development of the Internet and the rapid increase of the electronic commercial, the incidents on stealing the consumers' personal identify data and financial account credentials are becoming more and more common. This phenomenon is called phishing. Now phishing is so popular that web sites such as papal , eBay, MSN, Best Buy, and America Online are frequently spoofed by phishers. What’s more, the amount of the phishing sites is increasing at a high rate.</p><p>The aim of the report is to analyze different phishing phenomenon and help the readers to identify phishing attempts. Another goal is to design an anti-phishing system which can detect the phishing e-mails and then perform some operations to protect the users. Since this is a big project, I will focus on the mail detecting part that is to analyze the detected phishing emails and extract details from these mails.</p><p>A list of the most important information of this phishing mail is extracted, which contains “mail subject”, “ mail received date”, “targeted user”, “the links”, and “expiration and creation date of the domain”. The system can presently extract this information from 40% of analyzed e-mails.</p>

Phishing is the use of social engineering and electronic communications such as emails to try and illicit sensitive information such as usernames, passwords, and financial information. This form of identity theft has become a rampant problem in today’s society. Phishing attacks have cost financial institutions millions of dollars per year and continue to do so. Today’s defense against phishing attacks primarily consists of trying to take down the phishing web site as quickly as possible before it can claim too many victims. This thesis demonstrates that is possible to track down a phisher to the IP address of the phisher’s workstation rather than innocent machines used as intermediaries. By using web bugs and honeytokens on the fake web site forms the phisher presents, one can log accesses to the web bugs by the phisher when the attacker views the results of the forms.

Denna studie har undersökt ett relativt outforskat område inom phishing; språkets inverkan på människors mottaglighet för phishing. Syftet med studien var att undersöka hur stor skillnaden är mellan hur bra svenska Internetanvändare kan upptäcka phishing-mejl på svenska jämfört med engelska. För detta ändamål skapades en webbenkät med 32 mejl på både svenska och engelska. De 32 mejlen delades in i fyra lika stora grupper baserat på mejlets typ och språk. Deltagarna blev sedan tillfrågade att kategorisera mejlen som antingen legitima eller phishing. Målgruppen för studien bestod av Internetanvändare mellan 18–81 år med svenska som modersmål. En kvantitativ metod tillämpades på frågeformuläret, varpå statistiska analyser användes för att besvara syftet med studien. Studiens resultat visar en signifikant skillnad (p = 0,039) mellan hur väl svenska Internetanvändare upptäcker phishing på svenska jämfört med engelska. Deltagarna identifierade felaktigt 20 % av de engelska phishing-mejlen och 17 % av de svenska phishing-mejlen som legitima. Resultatet visar svaga indikationer på att svenska Internetanvändare är bättre på att upptäcka phishing på svenska jämfört med engelska. Resultatet i studien visar även starka indikationer på att engelsk språkförmåga och IT-kompetens är betydande faktorer vid identifiering av engelska legitima mejl. Det fanns inga tecken som tyder på att dessa faktorer gjorde deltagarna bättre på att upptäcka engelska phishing-mejl. Däremot tyder resultatet på att deltagarna kan ha nyttjat icke-språkliga ledtrådar till att identifiera de engelska phishing-mejlen. / This study has examined a relatively unexplored area of phishing; the impact of language on people's susceptibility to phishing. The purpose of the study was to investigate how big the difference is between how well Swedish Internet users can detect phishing emails in Swedish compared to English. For this purpose, an online questionnaire was created containing 32 emails in both Swedish and English. The 32 emails were divided into four equally large groups based on the type and language of the email. Participants were then asked to categorize the emails as either legitimate or phishing. The target group of the study consisted of Internet users between the ages of 18 and 81 with Swedish as their native language. A quantitative method was applied to the questionnaire, whereupon statistical analyses were used to answer the purpose of the study. The results of the study show a significant difference (p = 0,039) between how well Swedish Internet users detect phishing in Swedish compared to English. The participants incorrectly identified 20% of the English phishing emails and 17% of the Swedish phishing emails as legitimate. This result shows a weak indication that Swedish internet users are better at detecting phishing in Swedish compared to English. Furthermore, the results strongly indicate that English language skills and IT-competence are important factors when identifying English legitimate emails. There were no signs indicating that those two factors made the participants better at detecting English phishing emails. However, findings in the study suggests that the participants may have used non-language cues to identify the English phishing emails.

Because of the development of the Internet and the rapid increase of the electronic commercial, the incidents on stealing the consumers' personal identify data and financial account credentials are becoming more and more common. This phenomenon is called phishing. Now phishing is so popular that web sites such as papal , eBay, MSN, Best Buy, and America Online are frequently spoofed by phishers. What’s more, the amount of the phishing sites is increasing at a high rate. The aim of the report is to analyze different phishing phenomenon and help the readers to identify phishing attempts. Another goal is to design an anti-phishing system which can detect the phishing e-mails and then perform some operations to protect the users. Since this is a big project, I will focus on the mail detecting part that is to analyze the detected phishing emails and extract details from these mails. A list of the most important information of this phishing mail is extracted, which contains “mail subject”, “ mail received date”, “targeted user”, “the links”, and “expiration and creation date of the domain”. The system can presently extract this information from 40% of analyzed e-mails.

<p>Denna rapport tar en titt på phishing-problemet, något som många har råkat ut för med bland annat de falska Nordea eller eBay mejl som på senaste tiden har dykt upp i våra inkorgar, och ett eventuellt sätt att minska phishingens effekt. Fokus i rapporten ligger på klassificering av mejl och den huvudsakliga frågeställningen är: ”Är det, med hög träffsäkerhet, möjligt att med hjälp av ett klassificeringsverktyg sortera ut mejl som har med phishing att göra från övrig skräppost.” Det visade sig svårare än väntat att hitta phishing mejl att använda i klassificeringen. I de klassificeringar som genomfördes visade det sig att både metoden Naive Bayes och med Support Vector Machine kan hitta upp till 100 % av phishing mejlen. Rapporten pressenterar arbetsgången, teori om phishing och resultaten efter genomförda klassificeringstest.</p> / <p>This report takes a look at the phishing problem, something that many have come across with for example the fake Nordea or eBay e-mails that lately have shown up in our e-mail inboxes, and a possible way to reduce the effect of phishing. The focus in the report lies on classification of e-mails and the main question is: “Is it, with high accuracy, possible with a classification tool to sort phishing e-mails from other spam e-mails.” It was more difficult than expected to find phishing e-mails to use in the classification. The classifications that were made showed that it was possible to find up to 100 % of the phishing e-mails with both Naive Bayes and with Support Vector Machine. The report presents the work done, facts about phishing and the results of the classification tests made.</p>

Denna rapport tar en titt på phishing-problemet, något som många har råkat ut för med bland annat de falska Nordea eller eBay mejl som på senaste tiden har dykt upp i våra inkorgar, och ett eventuellt sätt att minska phishingens effekt. Fokus i rapporten ligger på klassificering av mejl och den huvudsakliga frågeställningen är: ”Är det, med hög träffsäkerhet, möjligt att med hjälp av ett klassificeringsverktyg sortera ut mejl som har med phishing att göra från övrig skräppost.” Det visade sig svårare än väntat att hitta phishing mejl att använda i klassificeringen. I de klassificeringar som genomfördes visade det sig att både metoden Naive Bayes och med Support Vector Machine kan hitta upp till 100 % av phishing mejlen. Rapporten pressenterar arbetsgången, teori om phishing och resultaten efter genomförda klassificeringstest. / This report takes a look at the phishing problem, something that many have come across with for example the fake Nordea or eBay e-mails that lately have shown up in our e-mail inboxes, and a possible way to reduce the effect of phishing. The focus in the report lies on classification of e-mails and the main question is: “Is it, with high accuracy, possible with a classification tool to sort phishing e-mails from other spam e-mails.” It was more difficult than expected to find phishing e-mails to use in the classification. The classifications that were made showed that it was possible to find up to 100 % of the phishing e-mails with both Naive Bayes and with Support Vector Machine. The report presents the work done, facts about phishing and the results of the classification tests made.