1. Markus Jakobsson School of Informatics Indiana University Bloomington, IN 47406, USA Jacob Ratkiewicz Dept. of Computer Science Indiana University Bloomington, IN 47406, USA Designing Ethical Phishing Experiments: A study of (ROT13) rOnl query features

2. Introduction Phishing Ethical & Accurate Experiment V.S. Attack status

3. Previous work Gartner Group 2004 servey $2.4 billion per year in the US alone Around 5% adult American Internet users are successfully targeted by phishing attacks each year Lower bound

4. Previous work Mailfrontier March ’05 (report) identified phishing emails correctly 83% of the time identified legitimate emails 52% of the time. Their conclusion Our believe

5. Techniques Monitoring of ongoing attacks Administrators Lower estimate Real Experiment Ethical & accurate

6. USER-TO-USER PHISHING ON RONL rOnl User-to-User Communication Third Party

7. USER-TO-USER PHISHING ON RONL Abusing User-to-User Communication Content injection attack Spoofing attack ContextAware Attacks

8. Content injection attack

9. Spoofing attack

10. ContextAware Attacks Purchase History Username / Email Correspondence

11. RONL PHISHING SCENARIOS Attack 1: Context-aware spoofing attack Attack 2: Contextless spoofing attack

12. Experimenting with Spoofing Experiment 1: context & Non-malicious link Experiment 2: No context & Non-malicious link

13. Experimenting with Spoofing

14. Experimenting with a Malicious Link Experiment 3: Context & Malicious link Experiment 4: No Context & Malicious link

15. Experimenting with a Malicious Link

16. Experiment Design Analysis

17. METHODOLOGY Identity Linkage 93 rOnl users (through the rOnl interface). 44 of the 93 users (47%) Automated Google searches with several queries limited to cgi.ronl.com(237)

18. Experimental Email Multi Accounts & Days Questions 1. Hi! How soon after payment do you ship? Thanks! 2. Hi, can you ship packages with insurance for an extra fee? Thanks. 3. HI CAN YOU DO OVERNIGHT SHIPPING?? 4. Hi - could I still get delivery before Christmas to a US address? Thanks!! (sent a few weeks before Christmas ’05).

19. Results

20. Questions