The Impact of Secure Transport Protocols on Phishing Efficacy
The Impact of Secure Transport Protocols on Phishing Efficacy
复制标题
安全传输协议对网络钓鱼效率的影响
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Michael Bailey
中科院分区：
文献类型：
--
作者：
Zane Ma;J. Reynolds;Joseph Dickinson;Kaishen Wang;Taylor Judd;J. D. Barnes;Joshua Mason;Michael Bailey
近年来，安全传输协议变得非常普遍，这主要是由于HTTPS和SMTP在TLS上的日益普及。令人担忧的是，先前的用户研究表明，用户通常不了解这些协议提供的安全性，并可能假设不存在的保护。本研究通过对266个用户进行网络钓鱼实验，a /B测试HTTP/HTTPS和SMTP/SMTP+TLS对网络钓鱼易感性的影响，研究了安全协议知识差距如何影响用户行为。安全电子邮件传输的影响很小，而HTTPS增加了电子邮件网络钓鱼链接的点击率（HTTPS为72.0%，HTTP为60.0%）和网络钓鱼网站的凭据输入率（HTTPS为58.0%，HTTP为55.6%）。然而，我们的结果仅仅是暗示性的，并没有上升到统计显著性的水平(p = 0。17点击通过，p = 0。31日凭据条目)。为了更好地理解影响凭据输入的因素，我们对HTTP/HTTPS浏览器表示的差异进行了分类，并将参与者的易感性与浏览器URL显示特性相关联。我们对网络钓鱼受害者进行了后续调查，旨在为观察到的结果提供定性的见解，但没有产生有意义的结果。总的来说，这项研究对安全传输协议的行为影响具有启发性，可以作为未来更大规模研究的基础。
Secure transport protocols have become widespread in recent years, primarily due to growing adoption of HTTPS and SMTP over TLS. Worryingly, prior user studies have shown that users often do not understand the security that is provided by these protocols and may assume protections that do not exist. This study investigates how the security protocol knowledge gap impacts user behavior by performing a phishing experiment on 266 users that A/B tests the effects of HTTP/HTTPS and SMTP/SMTP+TLS on phishing susceptibility. Secure email transport had minimal effect, while HTTPS increased the click-through rate of email phishing links (72.0% HTTPS, 60.0% HTTP) and the credential-entry rate of phishing sites (58.0% HTTPS, 55.6% HTTP). However, our results are merely suggestive and do not rise to the level of statistical significance ( p = 0 . 17 click-through, p = 0 . 31 credential-entry). To better understand the factors that affect credential-entry, we categorized differences in browser presentation of HTTP/HTTPS and correlated participant susceptibility with browser URL display features. We administered a follow-up survey for phishing victims, which was designed to provide qualitative insights for observed outcomes, but it did not yield meaningful results. Overall, this study is a suggestive look at the behavioral impact of secure transport protocols and can serve as a basis for future larger-scale studies.