The Impact of Public Information on Phishing Attack and Defense

Tyler Moore and Richard Clayton
Additional contact information
Tyler Moore: Harvard University
Richard Clayton: University of Cambridge

Communications & Strategies, 2011, vol. 1, issue 81, 45-68

Abstract: Attackers compromise web servers in order to host fraudulent content, such as malware and phishing websites. While the techniques used to compromise websites are widely discussed and categorized, analysis of the methods used by attackers to identify targets has remained anecdotal. In this paper, we study the use of search engines to locate potentially vulnerable hosts. We present empirical evidence from the logs of websites used for phishing to demonstrate attackers' widespread use of search terms which seek out susceptible web servers. We establish that at least 18% of website compromises are triggered by these searches. Many websites are repeatedly compromised however the root cause of the vulnerability is not addressed. We find that 17% of phishing websites are recompromised within a year, and the rate of recompromise is much higher if they have been identified through web search. By contrast, other public sources of information about phishing websites actually lower recompromise rates. We find that phishing websites placed onto a public blacklist are recompromised less often than websites only known within closed communities. Consequently, we conclude that strategic disclosure of incident information can actually aid defenders if designed properly.

Keywords: security economics; online crime; phishing; transparency (search for similar items in EconPapers)
JEL-codes: K42 L86 (search for similar items in EconPapers)
Date: 2011
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://repec.idate.org/RePEc/idt/journl/CS8102/CS81_MOORE_CLAYTON.pdf

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:idt:journl:cs8102

Access Statistics for this article

More articles in Communications & Strategies from IDATE, Com&Strat dept. Contact information at EDIRC.
Bibliographic data for series maintained by BLAVIER Thomas ( this e-mail address is bad, please contact ).