Analysing persuasion principles in phishing emails

105 Pages·2014·2.22 MB·English

ANALYSING PERSUASION PRINCIPLES IN PHISHING EMAILS
nurul akbar
Supervisors:
Prof.Dr.P.H. Hartel
E.E.H. Lastdrager MSc.
SERVICES, CYBERSECURITY AND SAFETY GROUP
Faculty of Electrical Engineering, Mathematics and Computer Science
University of Twente
2014
August
Nurul Akbar: Analysingpersuasionprinciplesinphishingemails, Master
2014
thesis, © August
supervisors
:
Prof.Dr.P.H. Hartel
E.E.H. Lastdrager MSc.
location
:
Enschede
The life of this world is only the enjoyment of deception.
3185
— Quran :

ABSTRACT
As the barrier to abuse system vulnerabilities has been raised signifi-
cantly with time, attacking users’ psyche has rapidly become a more
efficient and effective alternative. The usage of email as an electronic
means of communication has been exploited by phishers to deliver
their attacks. The success of a phishing attack through distributed
emails is determined by the response from the unsuspecting victims.
Although persuasion can be used as a tool for a good reason, it can
also be used for a malicious reason by phishers to get a positive re-
sponse from an intended victim in phishing emails.
To protect users from phishing attacks on the email level, system
designers and security professionals need to understand how phish-
ers use persuasion techniques in phishing emails. In this thesis, we
present an analysis of persuasion techniques in phishing emails. Our
research is aimed at understanding the characteristics of phishing
emails, by considering persuasion techniques in the real world analy-
sis.
We have conducted a quantitative analysis on our dataset that con-
2013
sistsofreportedphishingemailsbetweenAugust andDecember
2013
. The findings are mainly observed from three different view-
points: general structural properties; persuasion principles character-
istics; and their relationships. We have found that financial institu-
tions are the most common target with high number of occurrences
1
in our dataset. Three important findings of our research are that: ( )
authority is the most popular persuasion technique regardless of the
2
target and the reason used; ( ) depending on the target types and
the reason types, the next most popular persuasion principles are
3
scarcity, consistency, and likeability; and ( ) scarcity principle has a
high involvement with administrator target type and account-related
concerns.
v

Our technological powers increase,
but the side effects and potential hazards also escalate.
— Arthur C, Clarke
ACKNOWLEDGMENTS
Firstandforemost,Iwouldlikeusethisopportunitytothankbothof
my supervisors, Prof. Dr. Pieter Hartel and Elmer Lastdrager MSc. I
am thankful for their unrelenting guidance and support, which have
made this research possible. They have gone beyond the expected
duties as supervisors and helped make this master thesis possible.
They have provided me with invaluably constructive thoughts and
critical feedback. I am sincerely grateful to them for sharing their
truthful and illuminating views on a number of issues related to the
research. It was Elmer’s vision to integrate a phishing emails corpus
with Cialdini’s principles as the core of my research. He has assisted
me in obtaining the data as it is confidential and sensitive.
I would like to thank PhD candidates in the SCS group for letting
me pick their brains when I did a brief presentation at the beginning
of my research. Thanks to Geert Jan for letting me work in the lab.
andtoSuseandBertineforlendingmethekeywhennooneelsewas
in the lab. I would also like to express my appreciation and gratitude
to Drs. Jan Schut for providing me invaluable advice and direction
throughout my study in University of Twente.
A special thanks to Eyla who has give me incentives to strive to-
wards my goal and for being there in difficult times, and Gaurav and
Vignesh who have assisted me by giving feedback on my writing.
I appreciate all my friends, Aldi, Saud and all the others who sup-
ported me either directly and indirectly during my master studies.
Without all their support, accomplishing my studies would not have
beenpossible.Iwouldliketothankmyfamilymembersandrelatives
who have supported me financially and emotionally throughout my
entire master education. Words cannot express how grateful I am to
my mother and father in spite of all the difficult times, I thank you
all for letting me cherish my dream. Lastly, I thank God almighty for
answering my prayers.
– Nurul Akbar (Nolie)
vii

CONTENTS
1 introduction 1
11 2
. Problem statement
12 7
. Research goal
13 8
. Research Questions
14 8
. Structures
2 background literature review 9
&
21 9
. What is phishing?
211 10
. . The History
212 11
. . The universal definition
22 12
. The costs of phishing attacks
23 13
. Modus operandi
24 19
. Types of phishing
241 20
. . Phishing based on visual similarities
242 20
. . Malware-based phishing
25 21
. Current countermeasures
251 21
. . Phishing detection
252 29
. . Phishing prevention
26 32
. Human factor and persuasion
3 research questions and hypotheses 35
4 data and analysis 41
41 41
. Research Methodology
411 42
. . Data collection
412 42
. . Selection
413 44
. . Data Classification
414 49
. . Statistical analysis
42 49
. Results
421
. . Relationshipbetweenpersuasionprinciplesand
63
target types
422
. . Relationshipbetweenpersuasionprinciplesand
69
reason types
423 72
. . Target types and reason types
5 discussion 75
51 75
. Research questions
52 78
. Conclusion
53 80
. Limitation
54 81
. Future work
a appendices 83
a1 83
. Target Types
a2 83
. Reason Types
a3 84
. Financial targeted phishing emails
b bibliography 85
ix
LIST OF FIGURES
1 18 15
Figure PhishingprocessesbasedonFrauenstein[ ]
2
Figure ExampleofaphishingemailimpersonatingING
16
bank
3 74 17
Figure Phishingattacktaxonomyandlifecycle[ ]
4 17 17
Figure Flowofinformationinphishingattack[ ]
5 18
Figure Information flow phishing attack
6 18 30
Figure Holistic anti-phishing framework [ ]
7 38 31
Figure Simulated phishing attack [ ]
8 38 31
Figure Embedded phishing training [ ]
9 41
Figure Research methodology diagram
10 42
Figure Selection diagram
11
Figure Integration pseudo-code of Cialdini’s princi-
48
ples
12 54
Figure Detailed account related reason graph
13 65
Figure Financial target and scarcity
14 65
Figure E-Commerce/Retails and scarcity
15 66
Figure Administrator and scarcity
16 67
Figure Government and consistency (a)
17 67
Figure Government and consistency (b)
18 70
Figure Exampleoffinancialincentiveandconsistency
19 71
Figure Social reason and likeability principle
20 84
Figure Detailed of financial sectors
LIST OF TABLES
1 3
Table QuerysearchesinScopusandWebofScience
2 33
Table A map of message argument quality [ ] to
8 7
Cialdini’s persuasion principles [ ]
3 14
Table Compilation of phishing phases
4 22
Table Summary phishtank studies
5 52 24
Table Comparison summary [ ]
6 44 78 26
Table Existing lexical features [ , ]
7 45 46 44 78 27
Table Host-based features [ , , , ]
8 78 44 28
Table Site popularity features [ , ]
9 50
Table Attachment analysis
10
Table Request analysis of all total emails (one email
can contain more than one instructions so the
100 51
total here does not sum up to %)
x