1. Teaching you NOT to fall for Phish
Carnegie Mellon
Beth Cueni

2. Internet addiction People do get addicted to the Internet
What are the signs?

3. Fighting Cybercrime
View these images.
Only one is an actual web site.
How can you tell?

4. Password Protection Number of Characters Possible Combinations Human
Computer 1 36
3 minutes
seconds 2
1,300
2 hours
seconds 3
47,000
3 days
.02 seconds 4
1,700,000
3 months
1 second 5
60,000,000
10 years
30 seconds 10
3,700,000,000,000,000
580 million years
59 years
Possible characters A-Z and 0-9
Human discovery assumes 1 try every 10 seconds
Computer discovery assumes one million tries per second
Average time assumes the password would be discovered in approx half the time it would take to try all possible combinations

5. Characteristics of Phish scams
Sense of urgency
No specific person signs the
Links do not take you to a valid address
Dear eBay member – they should know your name!

6. Phishing Works
73 millions US adults received more than 50 phishing s each year in the year 2005
3.6 million adults lost 3.2 billion dollars in phishing attacks in 2007
Financial institutions and the military are also victims

7. Why phishing works
Phishers take advantage of Internet users; trust in legitimate organizations
Lack of computer and security knowledge
People do not protect themselves

8. Anti-phishing strategies (What industry is doing)
Silently eliminate the threat
Find and take down the phishing sites
Detect and delete phishing s
Warn users about the threat
Anti phishing toolbars and web browsers feature (IE 7.0 and Firefox)
Train users not to fall for attacks

9. Users education is challenging
Users are not motivated to learn about security
Security is a secondary task

10. Web Site Training Lab study – 28 non-expert computer users
Evaluate 10 sites
Take a break (read training material or play games)
Evaluate 10 more sites
People who read the training material identified phishing sites better

11. PhishGuru http://phishguru.org/
YouTube

12. Students are most vulnerable
Students more likely to fall for phish than staff
18-25 age group were consistently more vulnerable to phishing attacks

13. Wombat Security
Purchased the Anti Phishing game from Carnegie Mellon and is now using it to train others

14. Play the game!