syssec_red_book

13. Social Engineering and Phishingfairly popular. Another interesting finding, which confirms anecdotal beliefs,is that vishers often rely on interactive voice responders to automate theircalls. Recently, a study by Isacenkova et al. [219], based on a publicly availabledataset of 419 scams, showed that this type of phishing practices, which aresometimes initiated via email, are on the rise. Interestingly, as suggested byMaggi et al. [266] in the past, Isacenkova et al. also found that phone numbersare the cornerstone that allows the different campaigns to be grouped together;their experiments also show that it is possible to identify large groups ofscam campaigns probably run by the same criminal organizations. Suspiciousphone calls have also been put under the microscope of Fujitsu and NagoyaUniversity, which developed a proprietary technique for creating a model of ascammer’s typical voice tone [34]; together with the extraction of keywordscharacteristics of scams, Fujitsu’s system can detect suspicious situations of“overtrust.”13.6 Research GapsThe effectiveness of social engineering and phishing attacks lies in the factthat users are unsuspecting and tend to trust communication (seemingly)originating from online contacts and sent through inherently “compromisable”media (e.g., email, online social networks). Defending against such attacksrequires inter-disciplinary research in two orthogonal dimensions: (i) effectivemethods for educating users about the attacks, providing them with thebasic skills for identifying them, and (ii) developing defense mechanisms forautomatically identifying phishing attempts.A major challenge for both dimensions is the ever increasing spear phishingattacks. From a technical aspect, they are deployed on a much smaller scale,and are thus able to evade the existing infrastructure (e.g., spam-traps) thatcollects samples for updating spam filters. From a user perspective, the contentis crafted to resemble a legitimate communication and includes informationand details that are very convincing, and can trick even careful users. Overall,we expect that in the near future attackers will have incorporated and beheavily dependent on social engineering techniques for delivering their attacks;accordingly, researchers will also have to focus on implementing effectivecountermeasures.13.7 Example ProblemsEven though phishing and social engineering are a relatively cold topic from aresearch perspective, these issues still lack effective solution. In this sectionwe provide three example research problems, which all revolve around theidea of correlating phishing activities: the goal is to gain insights into howcybercriminals use their resources to carry out phishing and related threats.100