No description available.

published_or_final_version / SPACE / Master / Master of Arts

Yes / The use of online forums and social media sites by extremists for recruiting and radicalising individuals has been covered extensively by researchers. Meanwhile, the social engineering techniques utilised by these extremists to lure marginalised individuals into radicalisation has been neglected. In this article, the social engineering aspects of online radicalisation will be explored. Specifically, the five Principles of Persuasion in Social Engineering (PPSE) will be mapped onto the online radicalisation methods employed by extremists online. Analysing these tactics will aid in gaining a deeper understanding of the process of indoctrination and of the psychology of both the attacker and the target of such attacks. This understanding has enabled the development of a preliminary radicalisation framework based on the social traits of a target that may be exploited during an attack.

Sociala manipulatörer besitter förmågan att använda social interaktion som medel för att övertyga en individ eller organisation till samtycke för en specifik förfrågan. Syftet är att uppnå ett mål i form av exempelvis ekonomisk vinning, obehörig åtkomst eller serviceavbrott. En social manipuleringsattack föranleds utav bakomliggande processer och innefattar en datorrelaterad enhet för antingen den sociala interaktionen, för övertalningen till samtycke eller för manipulatörens förfrågan. Syftet med arbetet var att kartlägga säkerhetsåtgärder mot sociala manipuleringsattacker och på så vis ge uttryck för en utveckling av området över tid. Resultatet förväntades med andra ord att ge uttryck för en mognad inom området och bidra med ökade insikter i hur attacker på ett tidstroget vis kan tacklas inom administrativ- och teknisk säkerhet. En kartläggande granskning genomfördes utifrån ett urval utifrån de tre databaserna; IEEE Xplore Digital Library, Springer Link och DBLP Computer Science Bibliography. Studier primär- och sekundärkategoriserades utifrån en kodningsprocess i syfte att understödja en narrativ analys. Fyra primärkategorier utav säkerhetsåtgärder uppstod; modellering, sårbarhetsbedömning, datasystem och (in)direkt utbildning. Sökstrategi och bedömningsprocess gav en inkluderad datamängd av totalt 28 studier. Säkerhetsåtgärder mot social manipulering från 2008 representerades av fem studier; en föreslog modellering, tre föreslog datasystem och en föreslog (in)direkt utbildning. Säkerhetsåtgärder från 2018 representerades av 23 studier; fyra föreslog modellering, två föreslog sårbarhetsbedömning; nio föreslog datasystem och åtta föreslog (in)direkt utbildning. Kodningsprocessen gav även upphov till sekundära kategorier – samtliga kategorier återgavs en dynamisk återspegling utav säkerhetsåtgärder mot social manipulering 2008 kontra 2018. Fyra av fem studier från 2008 definierade social manipulering med avsaknad av teoretiska förklaringar till bakomliggande processer för en attack – respektive 13 av 23 studier från 2018. Analysen mynnade ut i insikter om att framtida forskning behöver eftersträva ett holistiskt synsätt för de bakomliggande processer som föranleder en social manipuleringsattack – på så vis kan en ökad säkerhetsmedvetenhet och motståndskraft mot social manipulering uppnås. / Social engineers possess the ability to use social interaction as a means of convincing an individual or organization to consent to a specific request. The purpose is to achieve a goal in the form of, for example, financial gain, unauthorized access or service interruption. A social engineering attack is caused by underlying processes and includes a computer-related device for either the social interaction, for the persuasion to consent or for the social engineer's request. The purpose of the thesis was to map security measures against social engineering attacks and thus express the development of the area over time. In other words, the result was expected to express a maturity in the area and contribute with increased insights into how attacks in a timely manner can be tackled in administrative and technical security. A survey was conducted based on a selection based on the three databases; IEEE Xplore Digital Library, Springer Link and DBLP Computer Science Bibliography. Studies were primary and secondary categorized based on a coding process in order to support a narrative analysis. Four primary categories of security measures occurred; modelling, vulnerability assessment, computer systems and (in)direct education. Search strategy and assessment process provided an included data set of a total of 28 studies. Security measures against social manipulation from 2008 were represented by five studies; one proposed modeling, three suggested computer systems and one suggested (in)direct education. Security measures from 2018 were represented by 23 studies; four proposed modeling, two suggested vulnerability assessment; nine proposed computer systems and eight suggested (in)direct education. The coding process also gave rise to secondary categories - all categories were given a dynamic reflection of security measures against social manipulation 2008 versus 2018. Four out of five studies from 2008 defined social manipulation with the absence of theoretical explanations for underlying processes for an attack - and 13 of 23 studies from 2018. The analysis resulted in insights that future research needs to strive for a holistic approach to the underlying processes that cause a social manipulation attack - in this way increased security awareness and resistance to social engineering can be achieved.

Malware continues to be one of the primary tools employed by attackers. It is used in attacks ranging from click fraud to nation state espionage. Malware infects hosts over the network through drive-by downloads and social engineering. These infected hosts communicate with remote command and control (C&C) servers to perform tasks and exfiltrate data. Malware's reliance on the network provides an opportunity for the detection and annotation of malicious communication. This thesis presents four main contributions. First, we design and implement a novel incident investigation system, named WebWitness. It automatically traces back and labels the sequence of events (e.g., visited web pages) preceding malware downloads to highlight how users reach attack pages on the web; providing a better understanding of current attack trends and aiding in the development of more effective defenses. Second, we conduct the first systematic study of modern web based social engineering malware download attacks. From this study we develop a categorization system for classifying social engineering downloads and use it to measure attack properties. From these measurements we show that it is possible to detect the majority of social engineering downloads using features from the download path. Third, we design and implement ExecScent, a novel system for mining new malware C&C domains from live networks. ExecScent automatically learns C&C traffic models that can adapt to the deployment network's traffic. This adaptive approach allows us to greatly reduce the false positives while maintaining a high number of true positives. Lastly, we develop a new packet scheduling algorithm for deep packet inspection that maximizes throughput by optimizing for cache affinity. By scheduling for cache affinity, we are able to deploy our systems on multi-gigabit networks.

Syftet med denna studie är att ta reda på hur medvetna gymnasieelever är om it-säkerhetshot och risker på Internet. Detta har gjorts genom att först undersöka aktuella hot genom att studera trendrapporter från ledande it-säkerhetsföretag. Denna information har sedan använts i en enkät för att ta reda på kunskapen och medvetenhetsnivån om dessa it-säkerhetshot bland gymnasieelever i Uppsala. Studien visar att det finns ett behov av utökad kunskap inom området. I resultatet kunde särskilda brister ses i de sociala aspekterna av it-säkerhet. Undersökningens resultat kan användas som stöd vid framtagandet av utbildning inom risker och hot på Internet.

Social network web sites become very popular nowadays. Users can establish connections with other users forming a social network, and quickly share information, photographs, and videos with friends. Malwares called social network worms can send text messages with malicious URLs by employing social engineering techniques. They are trying let users click malicious URL and infect users. Also, it can quickly attack others by infected user accounts in social network. By curiosity, most users click it without validation. This thesis proposes a malicious URL detection method used in Facebook wall, which used heuristic features with high classification property and machine learning algorithm, to predict the safety of URL messages. Experiments show that, the proposed approach can achieve about 96.3% of True Positive Rate, 95.4% of True Negative Rate, and 95.7% of Accuracy.

Thesis (Ph. D.)--University of California, San Diego, 1998. / Vita. Includes bibliographical references (leaves 423-463).

Zugl.: Stuttgart, Univ., Diss., 2010

Context. Phishing emails is a type of computer attack targeting users and tries to trick them into giving out personal information, follow shady links or download malicious attachments. Phishing is often closely linked to ransomware, which is a type of attack that locks a users computer and asks for a ransom in order to give access back. Ransomware viruses often contaminate a computer through a phishing email. Hospitals are a growing target for these types of attacks because of their need of being able to access their system at all times. Objectives. This study intends to research the phishing knowledge among employees at Blekingesjukhuset and whether Blekingesjukhuset is at a risk of falling victim to a ransomware attack through a phishing email opened by an employee. Methods. This is researched by reading relevant literature and a survey sent out to employees at Blekingesjukhuset regarding their phishing knowledge. Results. The results show that the participants of the survey where overall unsure on how to detect phishing emails and thought that knowledge about the subject is necessary. Conclusions. The conclusion was made that the employees did not know what to look for in order to determine whether an email is a phishing email or not. Based on this information the conclusion can be made that it does exist a risk of Blekingesjukhuset falling victim to a ransomware attack through a phishing email unintentionally opened by an employee.