Phishing

The practice of scamming e-mail recipients by convincing them to input personal or financial information into a Web site that then steals the information is nothing new, but continues to be of particular interest as phishers relentlessly modify their tactics to net more victims.

Carnegie Mellon University (CMU) has been researching why phishing attacks work and learned that a little bit of education regarding online fraud goes a long way. Early findings of the research, presented in October at the Anti-Phishing Working Group's eCrime Researchers Summit in Pittsburgh, showed that phishers are often successful because e-mail users ignore information that could help them recognize fraud.

Researchers at the university even developed an online game designed to teach Internet users about the dangers of phishing. Featuring a cartoon fish named Phil, the game, called Anti-Phishing Phil, has been tested in CMU's Privacy and Security Laboratory. Officials with the lab say users who spent 15 minutes playing the interactive, online game were better able to discern fraudulent Web sites than those who simply read tutorials about the threat.

Blacklisting

Blacklisting is the practice of publicizing known IP addresses that send spam so message-transfer agents won't accept connection requests from these senders; it's also used with Web sites that download malicious code so that inbound messages with URLs to these sites are blocked. Blacklisting has been around as long as Internet exploits, but because of the practice's inherently reactive nature (one must know that an IP address or Web site is "bad" before it can be blocked) researchers continue to try and perfect it.

From Dartmouth comes "Blacklistable Anonymous Credentials: Blocking Misbehaving Users without TTPs," or trusted third parties. Published at the end of September, this paper suggests the use of an anonymous credential system that can be used to blacklist misbehaving users without requiring the involvement of a TTP. Because blacklisted users would remain anonymous "misbehaviors can be judged subjectively without users fearing arbitrary deanonymization by a TTP," the paper states.

Researchers at Georgia Tech are looking into behavioral blacklisting. In the paper "Filtering Spam with Behavioral Blacklisting," the concept of having blacklisting techniques adapt to changes in spam senders is proposed. With a filtering system they call SpamTracker, e-mail senders are classified based on their sending behavior, rather than their identity. The filter uses fast clustering algorithms that react quickly to changes in sending behavior, researchers say.