1. Phishing markus.jakobsson@parc.com

2. Conventional Aspects of Security Computational assumptions –E.g., existence of a one-way function, RSA assumption, Decision Diffie-Hellman Adversarial model –E.g., access to data/hardware, ability to corrupt, communication assumptions, goals Verification methods –Cryptographic reductions to assumptions, BAN logic Implementation aspects –E.g., will the communication protocol leak information that is considered secret in the application layer?

3. The human factor of security Configuration Neglect Deceit

4. The human factor: configuration Weak passwords With Tsow, Yang, Wetzel: “Warkitting: the Drive-by Subversion of Wireless Home Routers” (Journal of Digital Forensic Practice, Volume 1, Special Issue 3, November 2006) Wireless firmware update Shows that more than 50% of APs are vulnerable wardriving rootkitting

5. The human factor: configuration Weak passwords With Stamm, Ramzan: “Drive-By Pharming” (Symantec press release, Feb 15, 2007; top story on Google Tech news on Feb 17; Cisco warns their 77 APs are vulnerable, Feb 21; we think all APs but Apple’s are at risk. Firmware update tested on only a few. Paper in submission) Wireless nvram value setting “Use DNS server x.x.x.x” And worse: geographic spread!

6. The human factor: neglect

7. The human factor: deceit (Threaten/disguise - image credit to Ben Edelman)

8. The human factor: deceit Self: “Modeling and Preventing Phishing Attacks” (Panel, Financial Crypto, 2005 - notion of spear phishing) With Jagatic, Johnson, Menczer: “Social Phishing” (Communications of the ACM, Oct 2007) With Finn, Johnson: “Why and How to Perform Fraud Experiments” ( IEEE Security and Privacy,March/April 2008)

9. Experiment Design

10. Gender Effects

12. B eBay A Ethical and accurate assessments With Ratkiewicz “Designing Ethical Phishing Experiments: A study of (ROT13) rOnl auction query features” (WWW, 2006) Reality: 3 credentials 1 2 4

13. B A Ethical and accurate assessments With Ratkiewicz “Designing Ethical Phishing Experiments: A study of (ROT13) rOnl auction query features” (WWW, 2006) Attack: 1 (spoof) 2 credentials

14. B A Ethical and accurate assessments With Ratkiewicz “Designing Ethical Phishing Experiments: A study of (ROT13) rOnl auction query features” (WWW, 2006) Experiment: 3 (spoof) A 1 2 eBay 4 credentials Yield (incl spam filtering loss): 11% + 3% …“eBay greeting” removed: same - 1 2 5

15. Mutual authentication in the “real world” With Tsow,Shah,Blevis,Lim, “What Instills Trust? A Qualitative Study of Phishing” (Abstract at Usable Security, 2007) starting with 4901

16. How does the typical Internet user identify phishing?

17. Spear Phishing and Data Mining Current attack style: Approx 3% of adult Americans report to have been victimized.

18. Spear Phishing and Data Mining More sophisticated attack style: “context aware attack”

19. How can information be derived? Jane Smith Jose Garcia … and little Jimmy Garcia Jane Garcia, Jose Garcia

20. Let’s start from the end! “Little” Jimmy his parents their marriage license and Jimmy’s mother’s maiden name: Smith More reading: Griffith and Jakobsson, "Messin' with Texas: Deriving Mother's Maiden Names Using Public Records."

21. www.browser-recon.info

22. Approximate price list: PayPal user id + password $1 + challenge questions$15 Why?

23. Password Reset: Typical Questions Make of your first car Mother ’ s maiden name City of your birth Date of birth High school you graduated from First name of your / your sister ’ s best friend Name of your pet How much wood would a woodchuck …

24. Problem 1: Data Mining Make of your first car? –Until 1998, Ford has >25% market share First name of your best friend? –10% of males named James (Jim), John, or Robert (Bob or Rob) + Facebook does not help Name of your first / favorite pet? –Top pet names are online

25. Problem 2: People Forget Name of the street you grew up on? –There may have been more than one First name of your best friend / sisters best friend? –Friends change, what if you have no sister? City in which you were born? –NYC? New York? New York City? Manhattan? The Big Apple? People lie to increase security … then forget!

26. Intuition Preference-based authentication: preferences are more stable than long- term memory (confirmed by psychology research) preferences are rarely documented (in contrast to city of birth, brand of first car, etc.) … especially dislikes!

27. Our Approach (1) Demo at Blue-Moon-Authentication.com, info at I-forgot-my-password.com

28. Our Approach (2)

29. And next? http://www. democratic-party.us/LiveEarth

30. Countermeasures? Technical –Better filters –CardSpace –OpenId Educational –SecurityCartoon –Suitable user interfaces Legal

31. Interesting? Internships at PARC / meet over coffee / etc. markus.jakobsson@parc.com