1. Wahida Chowdhury M.Cog.Sci. Thesis Defense 2013 Carleton University Funded by Ontario Graduate Scholarship Co-Supervisors: Dr. Robert Biddle & Dr. Warren Thorngate Do malware warnings reduce the likelihood of installing bad software? The Case of The Trojan Horse

2. Trojan Horse Into ComputerBugs  Who does it: attackers with any motive and from anywhere.  How does it affect us: compromises data, steals passwords, etc.  Result: Computer insecurity!  BBC: Skype, the internet communications platform, is being used by hackers to distribute a "worm" that infects Windows PCs. – 9 oct. 2012 THE ISSUE 2

3. WHAT IS BEING DONE?  Technical approach:  Improvements in antivirus software (e.g., Gribble, Levy, Moshchuk, & Bragin, 2012) to detect a Trojan Horse.  But often expensive to implement, slow to distribute, and anti- virus can fail.  Social approach:  Educational (websites and books offer extensive suggestions on how to be careful before “clicking”) and security standards.  But education doesn’t always work!  Compliance with security standards is low (Barlette & Fomin, 2009), and most users ignore standards, such as End User License Agreements (Chia, Heiner & Asokan, 2012; Thorngate & Tavakoli, 2007)  User reviews 3

4. WHAT ABOUT USER REVIEWS? WILL THEY WORK?  Yes because……  User reviews are widely used. So it means they work.  Aren't we smart and careful to listen to others?  No because…….  I listen to Microsoft and tech experts only.  I have anti-virus software  I never got a virus before  I am using a Mac  I don’t read reviews  How many of us are among the ‘yes’ sayers and how many among the ‘no’ sayers. 4

5. PREVIOUS STUDIES  Social cognitive theory predicts that human thought, motivation and action could be influenced by communication from others (Bandura, 1986).  Can user reviews have the similar effect as the theory predicts? Marketing studies  Will warnings in user reviews work? Health domain & gambling behaviour  What about in the domain of computer security?  Chia et al. (2012) found the number of installation decisions for software with no warnings were higher than the software with warnings in reviews from online community or friends. However, they do not mention if the difference was significant enough to be worth our attention. 5

6. MY RESEARCH HYPOTHESIS  Malware warnings in reviews of computer games, and their strength and number, will reduce people’s likelihood of installing the games.  Strong malware warnings will reduce likelihood more than weak ones  Two malware warnings will reduce lilelihood more than one  Malware warning: “My anti-virus software detected a virus in the game. Don't download it!”  Positive Non-malware-review: “A solid game with good controls.”  Negative Non-malware reviews: “The game is boring”. 6

7. RESEARCH: STUDY 1  Purpose: a manipulation check to determine which malware warnings I wrote would be rated by users as highest and lowest in strength.  Method: 43 undergraduates viewed, one at a time, 30 user reviews of hypothetical games.  15 of the reviews were malware warnings, and participants rated each warning’s strength.  Participants also rated each of the 30 reviews on how likely they were to install the reviewed computer game.  Results  the three highest-ranked [ranked for what? Strength? Liklihood?] warnings had significantly higher strength ratings than did the three lowest-ranked warnings.  The three highest strength warnings had signif lower intention blah, blah… 7

8. Results from Study 1: Ratings of install-likelihood after reading different types of user reviews? 8

9. RESEARCH: STUDY 2  Participants rated each of 10 games before and after viewing three reviews.  Four games were randomly selected for each participant to show one or two, strong or weak, malware warnings in a 2x2 factorial design.  I randomly paired a computer game with malware warnings for some participants and with non-malware reviews for others.  Analysing the pre-post difference in rated likelihood of installing the games allowed me to test my hypotheses. 9

10. 10

11. 11 Nonmalware review Malware review Nonmalware review

12. STUDY 2 RESULTS  The average post-rated likelihood of installing a game after viewing malware warnings was significantly lower than the average post-rated likelihood of installing the same game after viewing non-malware reviews.  A within-subject t-test shows, on average, participants’ pre-post rating drop in the four games with malware warnings was significantly greater (M = 1.15, SD = 1.05) than the pre-post rating difference in the six games with non- malware reviews (M = -.20, SD =.42), t(44) = -9.39, ρ <.001.  The average pre-post rating drop was greater after reading one-star malware warnings than it was after reading one-star non-malware reviews. 12

13. Results from Study 2: How much did the likelihood drop following different user warnings? 13

14.  The findings were not significantly correlated with participants’ age, gender, and self-assessments of computer use, download behaviour, risk taking behaviour, and impulsiveness  There are individual differences in the kind of experiences with computer problems that might affect people’s aversion to malware.  Example 1  Example 2 ADDITIONAL FINDINGS 14

15. CONCLUSIONS  Malware warnings worked to change people’s mind.  Malware warnings from users can warn others of malware quickly and efficiently.  Malware warnings can complement other tactics designed to make computing more secure. LIMITATIONS  I asked to read reviews but people might not read reviews outside the lab.  People might install a game even though they rated their intention to install the game low.  I examined warnings about computer games but the findings might not generalize to other kinds of software. 15

16. THANK YOU! 16