Carl Weinschenk spoke with Markus Jakobsson, associate professor at Indiana University and associate director of the Center for Applied Cyber Security Research. Jakobsson runs experiments designed to gather information to combat phishing.

Weinschenk: Why do you do these studies?
Jakobsson: Many people think we do this to mess with people or prove the obvious, that phishing works. It's not the case. We want to measure what the vulnerabilities are. People are not single-minded. We don't know exactly what they respond to and how. There are different kinds of attacks. Some things are offensive to people and some are effective. We want to understand the human vulnerabilities. We want to know how bad various problems are so that we can compare and quantify them.

Weinschenk: What was the goal of the most recent set of studies?
Jakobsson: The goal of this set of studies was to establish the tendencies and types of vulnerabilities people go for. There are three good reasons for this. One is to develop better countermeasures. Imagine an airplane. All the safety features can be in place, but if the pilot can be tricked into thinking up is down, that plane is going to crash. We need to know what is going to work and what is not, and design things that do work.

Weinschenk: What is the second reason?
Jakobsson: The second reason is to predict trends. If a phisher would try to spoof Bank of America, he would only be able to fool people who have an account at that bank. The chances a recipient is a customer of that bank is very small. Others would not respond to their message. But the phisher could buy a URL such as www.democratic-party.us and ask for a donation in a phishing e-mail. Half of the population who receive this will say, "This is my party." Not like one out of 100 with Bank of America. One out of two saying "this is from my political party" is good for the phisher. I registered www.democratic-party.us and www.support-gop.org. Both of those are mine. Of course, we are not defrauding anyone. If people go there, it explains what is going on, and there is a phishing cartoon.

Weinschenk: And the third?
Jakobsson: The third reason is as an educational measure, which can be seen at www.securitycartoon.com. If we want to design an educational campaign that teaches people things they don't know but could learn, we have to understand what people understand and what they don’t. Some things are difficult for people to understand about Internet security. Maybe we can't teach them everything, but we can teach them what is necessary.

Previous Page Next Page