Nav: Home

Under cyber attack: UH researchers look at how to catch a 'phisher'

May 16, 2017

As cybersecurity experts scramble to stop another wave of ransomware and malware scams that have infected computers around the world, computer science experts at the University of Houston are "phishing" for reasons why these types of attacks are so successful. The research findings, presented last month at the ACM Asia Conference on Computer and Communications Security, are being used to develop the next generation of email filters to better identify and defend against this type of cyber attack.

Computer science professors Rakesh Verma, Arjun Mukherjee, Omprakash Gnawali and doctoral student Shahryar Baki used publicly available emails from Hillary Clinton and Sarah Palin as they looked at the characteristics of phishing emails and traits of the email users to determine what factors contribute to successful attacks. The team used natural language generation-- a process used to replicate human language patterns--to create fake phishing emails from real emails. It's a tactic used by hackers to execute "masquerade attacks," where they pretend to be authorized users of a system by replicating the writing styles of the compromised account.

Using the Clinton and Palin emails, the research team created fake emails and planted certain signals, such as fake names, repetitive sentences and "incoherent flow". Study participants were then given eight Clinton emails and eight Palin emails--four were real, four were fake. Volunteers were asked to identify which emails were real and explain their reasoning. The study took into account the reading levels of the Clinton and Palin emails as well as the personality traits, confidence levels and demographics of the 34 volunteers who participated.

The results of the study showed that:
  • Participants could not detect the real emails with any degree of confidence. They had a 52 percent overall accuracy rate.

  • Using more complex grammar resulted in fooling 74 percent of participants.

  • 17 percent of participants could not identify any of the signals that were inserted in the impersonated emails.

  • Younger participants did better in detecting real emails.

  • Only 50 percent of the participants mentioned the fake names.

  • Only six participants could show the full header of an email.

  • Education, experience with emails usage and gender did not make a difference in the ability to detect the deceptive emails.

"Our study offers ideas on how to improve IT training," Verma said. "You can also generate these emails and then subject the phishing detectors to those kind of emails as a way to improve the detectors' ability to identify new attacks."

In the case of the recent Google Docs attack, Verma says people fell for the scam because they trust Google. When users opened the given URL, they were sent to a permissions page and hackers got control of their emails, contacts and potentially their personal information. Google stopped the scam, removed the fake pages and disabled offending accounts. Verma said a real Google Docs application will generally not ask for permission to access your contacts or read your emails.

The "WannaCry" ransomware attack that has hit banks, hospitals and government agencies around the globe is also spread through email phishing and can be spread through the Google Doc-type "worm" as well.

What all email users need to know in order to protect themselves:
  • Look closely at the sender of the email and the full header that has information about how the email was routed.

  • Look at the body of the email for any fake, broken links that can be identified by hovering a mouse over them.

  • Think about the context of the email and how long it has been since you have had contact with the sender.

"There will be copycat attacks in the future and we have to watch out for that," said Verma.
-end-
Rakesh Verma is available for interviews. Please contact Sara Tubbs at 713.743.4248 or sstubbs2@uh.edu. Click here to read the entire study.

About the University of Houston

The University of Houston is a Carnegie-designated Tier One public research university recognized by The Princeton Review as one of the nation's best colleges for undergraduate education. UH serves the globally competitive Houston and Gulf Coast Region by providing world-class faculty, experiential learning and strategic industry partnerships. Located in the nation's fourth-largest city, UH serves more than 43,700 students in the most ethnically and culturally diverse region in the country.

University of Houston

Related Computer Articles:

Stabilizing brain-computer interfaces
Researchers from Carnegie Mellon University (CMU) and the University of Pittsburgh (Pitt) have published research in Nature Biomedical Engineering that will drastically improve brain-computer interfaces and their ability to remain stabilized during use, greatly reducing or potentially eliminating the need to recalibrate these devices during or between experiments.
Computer-generated genomes
Professor Beat Christen, ETH Zurich to speak in the AAAS 2020 session, 'Synthetic Biology: Digital Design of Living Systems.' Christen will describe how computational algorithms paired with chemical DNA synthesis enable digital manufacturing of biological systems up to the size of entire microbial genomes.
Computer-based weather forecast: New algorithm outperforms mainframe computer systems
The exponential growth in computer processing power seen over the past 60 years may soon come to a halt.
A computer that understands how you feel
Neuroscientists have developed a brain-inspired computer system that can look at an image and determine what emotion it evokes in people.
Computer program looks five minutes into the future
Scientists from the University of Bonn have developed software that can look minutes into the future: The program learns the typical sequence of actions, such as cooking, from video sequences.
Computer redesigns enzyme
University of Groningen biotechnologists used a computational method to redesign aspartase and convert it to a catalyst for asymmetric hydroamination reactions.
Mining for gold with a computer
Engineers from Texas A&M University and Virginia Tech report important new insights into nanoporous gold -- a material with growing applications in several areas, including energy storage and biomedical devices -- all without stepping into a lab.
Teaching quantum physics to a computer
An international collaboration led by ETH physicists has used machine learning to teach a computer how to predict the outcomes of quantum experiments.
Seeing the next dimension of computer chips
Japanese researchers used a scanning tunneling microscope to image the side-surfaces of 3-D silicon crystals for the first time.
How old does your computer think you are?
Computerised face recognition is an important part of initiatives to develop security systems, in building social networks, in curating photographs, and many other applications.
More Computer News and Computer Current Events

Trending Science News

Current Coronavirus (COVID-19) News

Top Science Podcasts

We have hand picked the top science podcasts of 2020.
Now Playing: TED Radio Hour

Listen Again: Reinvention
Change is hard, but it's also an opportunity to discover and reimagine what you thought you knew. From our economy, to music, to even ourselves–this hour TED speakers explore the power of reinvention. Guests include OK Go lead singer Damian Kulash Jr., former college gymnastics coach Valorie Kondos Field, Stockton Mayor Michael Tubbs, and entrepreneur Nick Hanauer.
Now Playing: Science for the People

#562 Superbug to Bedside
By now we're all good and scared about antibiotic resistance, one of the many things coming to get us all. But there's good news, sort of. News antibiotics are coming out! How do they get tested? What does that kind of a trial look like and how does it happen? Host Bethany Brookeshire talks with Matt McCarthy, author of "Superbugs: The Race to Stop an Epidemic", about the ins and outs of testing a new antibiotic in the hospital.
Now Playing: Radiolab

Dispatch 6: Strange Times
Covid has disrupted the most basic routines of our days and nights. But in the middle of a conversation about how to fight the virus, we find a place impervious to the stalled plans and frenetic demands of the outside world. It's a very different kind of front line, where urgent work means moving slow, and time is marked out in tiny pre-planned steps. Then, on a walk through the woods, we consider how the tempo of our lives affects our minds and discover how the beats of biology shape our bodies. This episode was produced with help from Molly Webster and Tracie Hunte. Support Radiolab today at Radiolab.org/donate.