Carnegie Mellon University is researching the best ways to educate e-mail users about the dangers of phishing, such as how
to distinguish the URL of a fraudulent Web site from a legitimate one. Not exactly rocket science…or is it?
The Pittsburgh-based university has scientists and graduate students working on research to determine, in essence, how to
get through to e-mail users. Early results of a recent study show that users need to fall for phishing first in order to become aware enough to educate themselves against this form of fraud.
Another Ph.D. student at CMU took the time to develop an online game called Anti-Phishing Phil that goes into great detail about fraudulent sites and how to detect them.
Read the latest WhitePaper - IP Surveillance - The Next Generation Security Camera Application
But clearly, not enough people are playing Anti-Phishing Phil.
How do we know that e-mail users are clicking on fraudulent URLs embedded in messages? Because spammers and phishers continue
to send them. These guys don’t waste their time; if a spamming technique doesn’t work they move on to something that does.
Clearly, embedding bogus URLs in spam messages and getting recipients to click on them is working.
Here’s an example from an e-mail I received today: In a so-called account confirmation spam that purported to come from Western Union (the sender’s domain is listed as westernunion.com), I was asked to click on an embedded link to confirm my account information
with them, or it would be deleted. The fact that I don’t have a Western Union account was my first clue that this message
was trying to send me to a site that would probably ask for some personal information and promptly steal it.
But what was even a bigger clue to me was the URL itself. I’m not sure what the site that it pointed to entails, and I don’t
want to publish the URL because I wouldn’t want to be responsible for anyone else clicking on it, but it has the words `hotel,’
`bar,’ and `pub online’ in it; nary a mention of Western Union. Plus the domain suffix is `ch,’ for Switzerland; Western Union
is based in Colorado.
|
