Featured Research

from universities, journals, and other organizations

Researchers work to counter spear phishing attacks

Date:
January 8, 2013
Source:
Georgia Institute of Technology, Research Communications
Summary:
Researchers are working to counter threats from spear phishing. The attacks use knowledge of computer users to gain their trust to break into corporate networks.

The email resembled the organization's own employee e-newsletter and asked recipients to visit a website to confirm that they wanted to continue receiving the newsletter. Another email carried an attachment it said contained the marketing plan the recipient had requested at a recent conference. A third email bearing a colleague's name suggested a useful website to visit.

None of these emails were what they pretended to be. The first directed victims to a website that asked for personal information, including the user's password. The second included a virus launched when the "marketing plan" was opened. The third directed users to a website that attempted to install a malicious program.

All three are examples of what information security experts at the Georgia Tech Research Institute (GTRI) say is the most challenging threat facing corporate networks today: "spear phishing."

Generic emails asking employees to open malicious attachments, provide confidential information or follow links to infected websites have been around for a long time. What's new today is that the authors of these emails are now targeting their attacks using specific knowledge about employees and the organizations they work for. The inside knowledge used in these spear phishing attacks gains the trust of recipients.

"Spear phishing is the most popular way to get into a corporate network these days," said Andrew Howard, a GTRI research scientist who heads up the organization's malware unit. "Because the malware authors now have some information about the people they are sending these to, they are more likely to get a response. When they know something about you, they can dramatically increase their odds."

The success of spear phishing attacks depends on finding the weakest link in a corporate network. That weakest link can be just one person who falls for an authentic-looking email.

"Organizations can spend millions and millions of dollars to protect their networks, but all it takes is one carefully-crafted email to let someone into it," Howard said. "It's very difficult to put technical controls into place to prevent humans from making a mistake. To keep these attacks out, email users have to do the right thing every single time."

Howard and other GTRI researchers are now working to help email recipients by taking advantage of the same public information the malware authors use to con their victims. Much of that information comes from social media sites that both companies and malware authors find helpful. Other information may be found in Securities and Exchange Commission (SEC) filings, or even on an organization's own website.

"There are lots of open sources of information that will increase the chances of eliciting a response in spear phishing," Howard said. "We are looking at a way to warn users based on this information. We'd like to see email systems smart enough to let users know that information contained in a suspect message is from an open source and suggest they be cautious."

Other techniques to counter the attacks may come from having access to all the traffic entering a corporate network.

To increase their chance of success, criminals attempting to access a corporate network often target more than one person in an organization. Network security tools could use information about similar spear phishing attempts to warn other members of an organization. And by having access to all email, security systems could learn what's "normal" for each individual -- and recognize unusual email that may be suspicious.

"We are looking at building behavioral patterns for users so we'd know what kinds of email they usually receive. When something comes in that's suspicious, we could warn the user," Howard said. "We think the real answer is to keep malicious email from ever getting into a user's in-box, but that is a much more difficult problem."

It's difficult because organizations today depend on receiving, opening and responding to email from customers. Deleting or even delaying emails can have a high business cost.

"What we do requires a careful balance of protecting the user, but allowing the user to get his or her job done," he said. "Like any security challenge we have to balance that." These and other strategies will be part of Phalanx, a new product being developed by GTRI researchers to protect corporate networks from spear phishing. It will be part of Titan, a dynamic framework for malicious software analysis that GTRI launched last spring.

Among the challenges ahead are developing natural language algorithms that can quickly separate potential spear phishing attacks from harmless emails. That could be done by searching for language indicating a request such as "open this attachment" or "verify your password."

GTRI researchers been gaining experience with corporate networks based on security evaluations they've done, and work with GTRI's own network -- which receives millions of emails each day. Fortunately, they say, it's not just the bad guys who are learning more.

"The chief financial officers of companies now understand the financial impacts of spear phishing, and whey they join forces with the chief information officers, there will be an urgency to address this problem," he added. "Until then, users are the front line defense. We need every user to have a little paranoia about email."


Story Source:

The above story is based on materials provided by Georgia Institute of Technology, Research Communications. The original article was written by John Toon. Note: Materials may be edited for content and length.


Cite This Page:

Georgia Institute of Technology, Research Communications. "Researchers work to counter spear phishing attacks." ScienceDaily. ScienceDaily, 8 January 2013. <www.sciencedaily.com/releases/2013/01/130108131800.htm>.
Georgia Institute of Technology, Research Communications. (2013, January 8). Researchers work to counter spear phishing attacks. ScienceDaily. Retrieved August 27, 2014 from www.sciencedaily.com/releases/2013/01/130108131800.htm
Georgia Institute of Technology, Research Communications. "Researchers work to counter spear phishing attacks." ScienceDaily. www.sciencedaily.com/releases/2013/01/130108131800.htm (accessed August 27, 2014).

Share This




More Computers & Math News

Wednesday, August 27, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

ICREACH: NSA Built A Google Of Americans' Info

ICREACH: NSA Built A Google Of Americans' Info

Newsy (Aug. 26, 2014) The Intercept published an article Monday profiling what the online publication called NSA's very own Google of personal data. Video provided by Newsy
Powered by NewsLook.com
Australian Airlines Relax Phone Ban Too

Australian Airlines Relax Phone Ban Too

Reuters - Business Video Online (Aug. 26, 2014) Qantas and Virgin say passengers can use their smartphones and tablets throughout flights after a regulator relaxed a ban on electronic devices during take-off and landing. As Hayley Platt reports the move comes as the two domestic rivals are expected to post annual net losses later this week. Video provided by Reuters
Powered by NewsLook.com
Ralph Lauren Gets Into Wearables Game With 'Polo Tech'

Ralph Lauren Gets Into Wearables Game With 'Polo Tech'

Newsy (Aug. 25, 2014) Ralph Lauren, partnering with OMsignal, is testing out new biometric-reading shirts called "Polo Tech" on ball boys at the U.S. Open. Video provided by Newsy
Powered by NewsLook.com
What Makes Twitch Worth $1 Billion To Amazon?

What Makes Twitch Worth $1 Billion To Amazon?

Newsy (Aug. 25, 2014) Amazon is reportedly about to purchase Twitch, a streaming service for video game players, but why? Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

    Environment News

    Technology News



    Save/Print:
    Share:

    Free Subscriptions


    Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

    Get Social & Mobile


    Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

    Have Feedback?


    Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
    Mobile: iPhone Android Web
    Follow: Facebook Twitter Google+
    Subscribe: RSS Feeds Email Newsletters
    Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins