Det är inte många som känner till begreppet spear-phishing. Spear-phishing är ett sätt att attackera en person via mejl. De som utför den här typen av attacker använder sig av sociala aspekter för att lura dig. De kan säga att det är från ett företag som du som person har kontakt med. Det kan t.ex. vara från en bank eller skatteverket. Studien har som syfte att försöka förstå varför människor faller för de här attackerna och hur de kan hindra att sprida andra attacker. De virus som den här typen av attack sprider kan vara t.ex. trojaner och ransomware.

Hundreds of millions of people use their home computers every day for different purposes. Many of them are connected to the Internet. Most of them are unaware of the threats or do not know how to protect themselves. This unawareness is a major threat to global computer security. This master thesis starts by explaining some security related terms that might be unknown to the reader. It then goes on by addressing security vulnerabilities and flaws in the most popular home computer operating systems. The most important threats to home computer security are reviewed in the following chapter. These threats include worms, email worms, spyware and trojan horses. After this chapter some possible solutions for improving home computer security are presented. Finally this master thesis contains a short user survey to find out what the problems are in the real world and what can be doneto improve the current situation.

Abstrakt  Social Engineering är konsten att manipulera människor, för att på så sätt vinna deras förtroende. Med hjälp av detta förtroende kan attackeraren sedan kringgå säkerhetssystem och få tillgång till organisationers information. Vi har i denna uppsats genomfört elva intervjuer på tre stora organisationer med både IT-chefer och övrig personal. Med dessa intervjuer har vi sedan försökt få en bild av hur medvetenheten ser ut samt vilka åtgärder organisationerna tar för att förhindra Social Engineering. Med denna uppsats vill vi belysa den ovisshet som råder kring Social Engineering, men även farorna och hur effektiv en attack av denna typ kan vara. Slutsaten är att medvetenheten om Social Engineering är låg på de organisationer vi intervjuvat och att de åtgärder som finns inte alltid är tillräckliga.  Nyckelord: Social Engineering, Social manipulatör, Phishing, Dumpster diving, Säkerhetspolicy

Actualmente, el fraude por correo electrónico se ha transformado en un problema que afecta la seguridad y la economía global, cuya detección mediante el uso de filtros para correos tradicionales ha sido reconocida como poco efectiva. Si bien se han desarrollado filtros específicos para este tipo de correo, no se han presentado estudios que consideren explícitamente el comportamiento adversarial de quienes cometen fraude por correo electrónico. Por lo general, en sistemas adversariales la calidad de un clasificador disminuye a medida que un adversario aprende cómo derrotarlo. Para esto, la minería de datos adversarial ha sido recientemente propuesta como una solución preliminar, donde la interacción entre un adversario y el clasificador se define a través de un juego entre dos agentes, pero que no logra capturar elementos asociados al dinamismo de esta interacción. Esta tesis comprende el diseño y desarrollo de una metodología para clasificar mensajes de fraude por correo electrónico considerando su comportamiento adversarial. La interacción entre el perpetrador de fraude y el clasificador fue desarrollada utilizando juegos dinámicos con información incompleta y minería de datos adversarial. De acuerdo a la metodología propuesta, es necesario considerar componentes que describen la interacción entre agentes, como sus estrategias, tipos y funciones de utilidad. Para determinar lo anterior, es necesario definir propiedades, establecer supuestos y analizar los datos asociados a la aplicación de interés. Para esto, se pueden utilizar distintas técnicas, tanto cualitativas como cuantitativas, para definir los perfiles de estrategias, los tipos a considerar y las funciones de utilidad. Sin embargo, estos elementos son de exclusiva responsabilidad del modelador, y pueden variar significativamente dependiendo de la aplicación. En este trabajo se presenta una primera experiencia que puede ser utilizada de guía para el desarrollo de futuras aplicaciones en un contexto adversarial. La metodología presentada en este trabajo fue aplicada en una base de datos de correo electrónico con mensajes fraudulentos y regulares, utilizada frecuentemente por investigadores de este tipo de fraude. En términos de la caracterización de los correos de fraude, fueron utilizadas técnicas de análisis semántico latente y minería de datos de texto para potenciar la identificación de elementos cercanos a la ingeniería social, ampliamente presente en este tipo de fraude. Con respecto a los resultados experimentales, el método de caracterización propuesto presentó un rendimiento de clasificación competitivo con respecto a las últimas técnicas de caracterización presentes en la literatura (Bergholz et al., 2010). En esta tesis se presentan cuatro nuevos algoritmos de clasificación determinados mediante una aproximación del equilibrio secuencial para juegos con información incompleta. Cada uno de ellos actualiza incrementalmente sus parámetros con el objetivo de mejorar su capacidad de predicción en un ambiente de aprendizaje en línea. En términos de los resultados experimentales para los algoritmos de clasificación propuestos, se concluye que la interacción adversarial entre los agentes es capturada satisfactoriamente mejorando resultados obtenidos anteriormente para la predicción en línea (Sculley y Watchman, 2007). Finalmente, los resultados obtenidos en el análisis de sensibilidad de los algoritmos propuestos justifican la robustez de los resultados anteriores. Este trabajo abre la puerta a futuros desafíos relacionados principalmente con extensiones teóricas del marco de trabajo propuesto y aplicaciones de la metodología desarrollada en otros ámbitos. Además, esta tesis define un marco de trabajo que se puede adecuar al estudio de otras interacciones complejas entre agentes adversariales.

E-Commerce has been plagued with problems since its inception and this study examines one of these problems: The lack of user trust in E-Commerce created by the risk of phishing. Phishing has grown exponentially together with the expansion of the Internet. This growth and the advancement of technology has not only benefited honest Internet users, but has enabled criminals to increase their effectiveness which has caused considerable damage to this budding area of commerce. Moreover, it has negatively impacted both the user and online business in breaking down the trust relationship between them. In an attempt to explore this problem, the following was considered: First, E-Commerce’s vulnerability to phishing attacks. By referring to the Common Criteria Security Model, various critical security areas within E-Commerce are identified, as well as the areas of vulnerability and weakness. Second, the methods and techniques used in phishing, such as phishing e-mails, websites and addresses, distributed attacks and redirected attacks, as well as the data that phishers seek to obtain, are examined. Furthermore, the way to reduce the risk of phishing and in turn increase the trust between users and websites is identified. Here the importance of Trust and the Uncertainty Reduction Theory plus the fine balance between trust and control is explored. Finally, the study presents Critical Success Factors that aid in phishing prevention and control, these being: User Authentication, Website Authentication, E-mail Authentication, Data Cryptography, Communication, and Active Risk Mitigation.

The majority of documented phishing attacks have been carried by email, yet few studies have measured the impact of email headers on the predictive accuracy of machine learning techniques in detecting email phishing attacks. Research has shown that the inclusion of a limited subset of email headers as features in training machine learning algorithms to detect phishing attack did increase the predictive accuracy of these learning algorithms. The same research also recommended further investigation of the impact of including an expanded set of email headers on the predictive accuracy of machine learning algorithms. In addition, research has shown that the cost of misclassifying legitimate emails as phishing attacks--false positives--was far higher than that of misclassifying phishing emails as legitimate--false negatives, while the opposite was true in the case of fraud detection. Consequently, they recommended that cost sensitive measures be taken in order to further improve the weighted predictive accuracy of machine learning algorithms. Motivated by the potentially high impact of the inclusion of email headers on the predictive accuracy of machines learning algorithms and the significance of enabling cost-sensitive measures as part of the learning process, the goal of this research was to quantify the impact of including an extended set of email headers and to investigate the impact of imposing penalty as part of the learning process on the number of false positives. It was believed that if email headers were included and cost-sensitive measures were taken as part of the learning process, than the overall weighted, predictive accuracy of the machine learning algorithm would be improved. The results showed that adding email headers as features did improve the overall predictive accuracy of machine learning algorithms and that cost-sensitive measure taken as part of the learning process did result in lower false positives.

abstract: Despite an abundance of defenses that work to protect Internet users from online threats, malicious actors continue deploying relentless large-scale phishing attacks that target these users. Effectively mitigating phishing attacks remains a challenge for the security community due to attackers' ability to evolve and adapt to defenses, the cross-organizational nature of the infrastructure abused for phishing, and discrepancies between theoretical and realistic anti-phishing systems. Although technical countermeasures cannot always compensate for the human weakness exploited by social engineers, maintaining a clear and up-to-date understanding of the motivation behind---and execution of---modern phishing attacks is essential to optimizing such countermeasures. In this dissertation, I analyze the state of the anti-phishing ecosystem and show that phishers use evasion techniques, including cloaking, to bypass anti-phishing mitigations in hopes of maximizing the return-on-investment of their attacks. I develop three novel, scalable data-collection and analysis frameworks to pinpoint the ecosystem vulnerabilities that sophisticated phishing websites exploit. The frameworks, which operate on real-world data and are designed for continuous deployment by anti-phishing organizations, empirically measure the robustness of industry-standard anti-phishing blacklists (PhishFarm and PhishTime) and proactively detect and map phishing attacks prior to launch (Golden Hour). Using these frameworks, I conduct a longitudinal study of blacklist performance and the first large-scale end-to-end analysis of phishing attacks (from spamming through monetization). As a result, I thoroughly characterize modern phishing websites and identify desirable characteristics for enhanced anti-phishing systems, such as more reliable methods for the ecosystem to collectively detect phishing websites and meaningfully share the corresponding intelligence. In addition, findings from these studies led to actionable security recommendations that were implemented by key organizations within the ecosystem to help improve the security of Internet users worldwide. / Dissertation/Thesis / Doctoral Dissertation Computer Science 2020

Informationssäkerhetsutbildning om phishing krävs för att kunna bekämpa det hot som phishing utgör, då människan alltid är den svagaste länken inom en organisation. Även om förslag och krav kopplade till hur informationssäkerhetsutbildning bör genomföras finns beskrivet i litteratur, standarder och ramverk är det svårt för SMF:er att anpassa och implementera dessa rent praktiskt. Syftet med denna studie är därför att undersöka svenska SMF:ers implementation av utbildningsinsatser för att bemöta phishing-hotet. Empirin har samlats in genom semistrukturerade intervjuer samt tematisk analys. Resultaten från studien visade att utbildningsinsatserna främst är grundade på egna erfarenheter och exempel från tidigare phishing-attacker som drabbat andra organisationer. Ett par organisationer har inte utvecklat sina utbildningsinsatser själva, utan använder verktyg och andra organisationers erfarenheter som hjälpmedel. Resultaten visade också att åsikterna om den valda utbildningsinsatsen inte alltid var lika mellan ledningen och användare. Slutsatsen av studien är att SMF:er kan implementera utbildning kring det hot som phishing utgör utan att förlita sig på specifika ramverk eller standarder, men att organisationen måste vara noga med att anpassa den efter sin egen organisations storlek. För att dra mer långtgående slutsatser än de som beskrivs i rapporten hade det varit av vikt att kunna förlita sig på ett större antal organisationer än de 4 organisationer och 10 intervjudeltagare som deltog i studien. Dessutom behövs mer forskning inom området gällande smishing och vishing. / Information security training about phishing is required to be able to combat the threat that phishing determine, as humans are always the weakest link within an organization. Although proposals and requirements linked to how information security training should be implemented in the literature, standards, and frameworks, it is difficult for SMEs to adapt and implement these in practice. The purpose of this study is therefore to investigate Swedish SMEs' implementation of forms of education to address the phishing threat. The empirical data has been collected through semi-structured interviews and thematic analysis. The results from the study showed that the forms of education are mainly based on own experiences and examples from previous phishing attacks that have affected other organizations. A couple of organizations have not developed their forms of education themselves, instead they use tools and other companies experiences as aids. The results also showed that the opinions about the chosen form of education were not always the same between management and users. The conclusion of the study is that SMEs can implement education around the threat that phishing constitutes without specific frameworks or standards to rely on, but if the organization want to use it, they must be careful to adapt the education to their own organization's size. In order to draw more far-reaching conclusions than those described in the report, it would have been important to be able to rely on a larger number of organizations than the 4 organizations and the 10 interviewees that participated in the study. In addition, more research is needed in the field of smishing and vishing.

This work deals with the design of a phishing attack detection and classification tool. The work describes techniques and forms of phishing attacks and availible tools and techniques for phishing detection. Based on the analysis of existing tools a solution for file classification is proposed. Implemented tool handles input parsing and creation of input model. Model is based on hybrid analysis of input file and URL. Using the YARA tool, YARA rules are applied which are then used in creation of input classification. Analysis of input model and definition of classification rules is enabled by implemented YARA module. Implemented solution makes it possible to define YARA rules for phishing classification based on the structural properties of a phishing file and features of source URL.

This diploma thesis deals with a central user identification and personal data management on the Internet. The first part analyzes questions of a identification process and discusses the requirements for implementation, security and user-friendliness. Subsequently, the process is designed with respect to the defined requirements. A detailed overview of possible attacks to the system and means of protection against them is also included in the thesis. The described methods are as follows: Phishing, Man in the middle, hardware modification and acoustic keypress emissions. A practical design of a identification system is discussed in the second part of the thesis. It consists of two parts: a library implementable to individual Internet services requiring a user identification and a server centrally identificating the users and storing their personal data and passwords. An implementation in Joomla content management system is also described.