Security Watch

Why Phishing Sites Work

According to a recent study, user education may indeed be the only solution.

An extremely interesting study (PDF download) was recently produced by several individuals from Harvard and U.C. Berkeley. The study approached the phishing problem from the perspective of trying to determine what users did to verify the trustworthiness of a Web site. Fifty nine percent of the study participants relied entirely on the Web site page contents and domain name alone, ignoring all browser security cues.

While the study only involved 22 participants, its findings are interesting and well worth reading if you are in the business of designing a Web site or user interface tool intended to impart trustworthiness information to consumers. The study found that users were better grouped according to what information they relied upon for trustworthiness. Grouping them demographically, say age or sex, or by length of computer experience yielded extremely little difference.

In other words, it appears to come down to how a person has learned to read what their browsers were presenting them in determining whether they'd be any good at distinguishing a phishing site from a real one. While this certainly makes sense, it's amazing how many people have either not learned to see the interface as well as the content, or have learned to ignore it.

Could this be similar to the way people typically turn off pop-up dialog boxes when given the option? Could it be a result of being bombarded with overly technical jargon in such dialog boxes? Many of the subjects in the study appeared to not even read what was being presented, like a broken certificate warning dialog. Others couldn't distinguish between a locked padlock in the interface versus one in the content itself, and still others felt it was more secure when the lock was in the content!

With so many people relying on the content over the interface, it’s understandable that we’re seeing tools like SiteAdvisor, which implants security queues in the content itself. SiteAdvisor was recently acquired by McAfee. The problem is if we pander to this habit of relying upon the content, we actually end up making it easier for phishers to do their evil deeds. Our content can already be so rich and interactive; attempting to enforce it as the reason for trustworthiness definitely doesn’t feel right to me.

I’m not suggesting I know the solution. Could we get security rules to prevent the mouse from clicking on a bad link? Sure! But could we also prevent a phishing Web site or spyware application from preventing that from happening? Probably not. User education is often ridiculed as impossible, but this study certainly tells me it is the route we have to follow.

The big question now is can we still re-educate so many people who have already learned the wrong things? Perhaps that will only happen when they become victims, but I sure hope not.

About the Author

Russ Cooper is a senior information security analyst with Verizon Business, Inc. He's also founder and editor of NTBugtraq,, one of the industry's most influential mailing lists dedicated to Microsoft security. One of the world's most-recognized security experts, he's often quoted by major media outlets on security issues.

comments powered by Disqus
Most   Popular

SharePoint Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.