Phishers Use Psychology To Rein in Victims

Intel Security and those who performed a University of Buffalo study titled "Examining the impact of presence on phishing victimization" agree that phishing is successful and is about more than some random hacker on the other end of the computer trying to get information.  It's also about human behavior.

In a University of Buffalo study, Professor Arun Vishwanath found that emails that include such information as graphics, logo, and personalized text give the reader a sense of "social presence," which is providing the reader the feeling that he or she is corresponding with an actual person. It found that phishers who sent email messages that were personalized, caught the reader's attention, and/or invoked some type of fear, they were more likely to be successful. In the messages sent for the study, those that looked as if they were legitimately coming from the university and gave a deadline to reply or they would no longer have email access garnered a 68% success rate.

It's important to be able to identify phishing email messages. Often times, they are so well done, that it is difficult to detect them. However, if viewed closely, there are a few typical signs including poor grammar and spelling, incorrect use of the English language, "to" and "from" addresses that don't look quite right, and odd links that can be seen if the mouse hovers over them for a bit. For example, if a message claims to be from Intel and the link directs to something that is nothing remotely similar to what you would expect from that company, it's probably phishing and should be ignored and deleted.

Best practice is to never click on an email link unless you are absolutely sure who it's from and that it is legitimate. Sometimes that may require calling or texting the sender. This is especially true in the work place. Corporate emails are easily duplicated with fake money wiring instructions or fake links that lead to malware. Keep in mind that every major US breach in recent past was caused by someone clicking on a fake link within a phishing email.

Intel Security has a term for what the attackers do to build a relationship with a target and extract information: Farming. In these cases, the information is gathered over a period of time. Victims of this are often found on social media sites and particularly on dating sites. Their report defines phishing attacks of this type, as well as in the "hunting" type (information is gathered by an attacker with minimal interaction) in four phases:

Phase I: Research-Attackers do some due diligence to find out about their targets.  If it isn't a targeted attack, this step may be skipped.

Phase II: The Hook-The attacker engages with the target to create a "story" that will trigger interaction.

Phase III: The Play-Information is extracted from the victim.

Phase IV: The Exit-The attacker ends the interaction and the victim is none-the-wiser about being exploited.

In the quiz provided by Intel to determine how many will fall for them, it found that 80% fell for 14% or more of the phishing emails they saw in the quiz.

The University of Buffalo study was presented at the 48th Hawaii International Conference on System Sciences.  Intel Security's quiz was posted online in May of 2014 and included over 16,000 test takers.  It found that those who performed worst on their quiz were often those who hold some of the most sensitive corporate data: HR and Accounting.