Friend or foe: an investigation into recipient identification of SMS-based phishing

Max Clasen; Fudong Li; David Williams

doi:10.1007/978-3-030-81111-2_13

Friend or foe: an investigation into recipient identification of SMS-based phishing

Max Clasen
, Fudong Li^*
, David Williams

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

273 Downloads (Pure)

Abstract

Short Message Service (SMS) messaging plays a key role in many people’s lives, allowing communication between friends, family and businesses through the convenient use of a mobile phone. At the same time, criminals are able to utilise this technology to their own benefit, such as by sending phishing messages that convince their victims into sharing sensitive information or installing dangerous software on their devices. Indeed, Proofpoint’s State of the Phish report found 81% of surveyed US organisations had faced smishing attacks – which is a type phishing attack via SMS message in 2020.

Although phishing is well studied, the amount of research in SMS-based phish-ing is somewhat limited. Therefore, this study addresses the lack of SMS-based phishing insight, investigating which techniques/tactics are used by malicious senders and honest recipients to disguise/identify SMS-based phishing. By using an online questionnaire, a total of 576 participants’ options upon 20 text messages (10 genuine and 10 phishing) were gathered. The result shows 73.4% of the SMS messages were categorised correctly; also a number of factors such as shortened URLs, inconsistent metadata/content, urgency cue, and age play a positive role in identifying phishing attacks.

Original language	English
Title of host publication	Human Aspects of Information Security and Assurance
Subtitle of host publication	15th IFIP WG 11.12 International Symposium, HAISA 2021, Virtual Event, July 7–9, 2021, Proceedings
Editors	Steven Furnell, Nathan Clarke
Place of Publication	Cham
Publisher	Springer
Chapter	13
Pages	148-163
Number of pages	16
Edition	1st
ISBN (Electronic)	9783030811112
ISBN (Print)	9783030811105, 9783030811136
DOIs	https://doi.org/10.1007/978-3-030-81111-2_13 https://doi.org/10.1007/978-3-030-81111-2
Publication status	Published - 8 Jul 2021
Event	HAISA 2021: International Symposium on Human Aspects of Information Security and Assurance - Virtual Event Duration: 7 Jul 2021 → 9 Jul 2021 https://haisa.org/

Publication series

Name	IFIP Advances in Information and Communication Technology
Publisher	Springer Verlag
Volume	613
ISSN (Print)	1868-4238
ISSN (Electronic)	1868-422X

Conference

Conference	HAISA 2021: International Symposium on Human Aspects of Information Security and Assurance
Period	7/07/21 → 9/07/21
Internet address	https://haisa.org/

Keywords

short message service (SMS)
phishing
text message
mobile phishing

Access to Document

Clasen_et_al_2021_AAM
This is a post-peer-review, pre-copyedit version of an article published in Furnell S., Clarke N. (eds) Human Aspects of Information Security and Assurance. HAISA 2021. IFIP Advances in Information and Communication Technology, vol 613. Springer, Cham. The final authenticated version is available online at: http://dx.doi.org/10.1007/978-3-030-81111-2_13.
Accepted author manuscript (Post-print), 1.34 MB

Cite this

Clasen, M., Li, F., & Williams, D. (2021). Friend or foe: an investigation into recipient identification of SMS-based phishing. In S. Furnell, & N. Clarke (Eds.), Human Aspects of Information Security and Assurance: 15th IFIP WG 11.12 International Symposium, HAISA 2021, Virtual Event, July 7–9, 2021, Proceedings (1st ed., pp. 148-163). (IFIP Advances in Information and Communication Technology; Vol. 613). Springer. https://doi.org/10.1007/978-3-030-81111-2_13, https://doi.org/10.1007/978-3-030-81111-2

Clasen, Max ; Li, Fudong ; Williams, David. / Friend or foe: an investigation into recipient identification of SMS-based phishing. Human Aspects of Information Security and Assurance: 15th IFIP WG 11.12 International Symposium, HAISA 2021, Virtual Event, July 7–9, 2021, Proceedings. editor / Steven Furnell ; Nathan Clarke. 1st. ed. Cham : Springer, 2021. pp. 148-163 (IFIP Advances in Information and Communication Technology).

@inproceedings{c4c891578aae4fe9807795574a376ec4,

title = "Friend or foe: an investigation into recipient identification of SMS-based phishing",

abstract = "Short Message Service (SMS) messaging plays a key role in many people{\textquoteright}s lives, allowing communication between friends, family and businesses through the convenient use of a mobile phone. At the same time, criminals are able to utilise this technology to their own benefit, such as by sending phishing messages that convince their victims into sharing sensitive information or installing dangerous software on their devices. Indeed, Proofpoint{\textquoteright}s State of the Phish report found 81\% of surveyed US organisations had faced smishing attacks – which is a type phishing attack via SMS message in 2020. Although phishing is well studied, the amount of research in SMS-based phish-ing is somewhat limited. Therefore, this study addresses the lack of SMS-based phishing insight, investigating which techniques/tactics are used by malicious senders and honest recipients to disguise/identify SMS-based phishing. By using an online questionnaire, a total of 576 participants{\textquoteright} options upon 20 text messages (10 genuine and 10 phishing) were gathered. The result shows 73.4\% of the SMS messages were categorised correctly; also a number of factors such as shortened URLs, inconsistent metadata/content, urgency cue, and age play a positive role in identifying phishing attacks. ",

keywords = "short message service (SMS), phishing, text message, mobile phishing",

author = "Max Clasen and Fudong Li and David Williams",

year = "2021",

month = jul,

day = "8",

doi = "10.1007/978-3-030-81111-2\_13",

language = "English",

isbn = "9783030811105",

series = "IFIP Advances in Information and Communication Technology",

publisher = "Springer",

pages = "148--163",

editor = "Steven Furnell and Nathan Clarke",

booktitle = "Human Aspects of Information Security and Assurance",

address = "Netherlands",

edition = "1st",

note = "HAISA 2021: International Symposium on Human Aspects of Information Security and Assurance ; Conference date: 07-07-2021 Through 09-07-2021",

url = "https://haisa.org/",

}

Clasen, M, Li, F & Williams, D 2021, Friend or foe: an investigation into recipient identification of SMS-based phishing. in S Furnell & N Clarke (eds), Human Aspects of Information Security and Assurance: 15th IFIP WG 11.12 International Symposium, HAISA 2021, Virtual Event, July 7–9, 2021, Proceedings. 1st edn, IFIP Advances in Information and Communication Technology, vol. 613, Springer, Cham, pp. 148-163, HAISA 2021: International Symposium on Human Aspects of Information Security and Assurance, 7/07/21. https://doi.org/10.1007/978-3-030-81111-2_13, https://doi.org/10.1007/978-3-030-81111-2

Friend or foe: an investigation into recipient identification of SMS-based phishing. / Clasen, Max; Li, Fudong; Williams, David.
Human Aspects of Information Security and Assurance: 15th IFIP WG 11.12 International Symposium, HAISA 2021, Virtual Event, July 7–9, 2021, Proceedings. ed. / Steven Furnell; Nathan Clarke. 1st. ed. Cham: Springer, 2021. p. 148-163 (IFIP Advances in Information and Communication Technology; Vol. 613).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Friend or foe: an investigation into recipient identification of SMS-based phishing

AU - Clasen, Max

AU - Li, Fudong

AU - Williams, David

PY - 2021/7/8

Y1 - 2021/7/8

N2 - Short Message Service (SMS) messaging plays a key role in many people’s lives, allowing communication between friends, family and businesses through the convenient use of a mobile phone. At the same time, criminals are able to utilise this technology to their own benefit, such as by sending phishing messages that convince their victims into sharing sensitive information or installing dangerous software on their devices. Indeed, Proofpoint’s State of the Phish report found 81% of surveyed US organisations had faced smishing attacks – which is a type phishing attack via SMS message in 2020. Although phishing is well studied, the amount of research in SMS-based phish-ing is somewhat limited. Therefore, this study addresses the lack of SMS-based phishing insight, investigating which techniques/tactics are used by malicious senders and honest recipients to disguise/identify SMS-based phishing. By using an online questionnaire, a total of 576 participants’ options upon 20 text messages (10 genuine and 10 phishing) were gathered. The result shows 73.4% of the SMS messages were categorised correctly; also a number of factors such as shortened URLs, inconsistent metadata/content, urgency cue, and age play a positive role in identifying phishing attacks.

AB - Short Message Service (SMS) messaging plays a key role in many people’s lives, allowing communication between friends, family and businesses through the convenient use of a mobile phone. At the same time, criminals are able to utilise this technology to their own benefit, such as by sending phishing messages that convince their victims into sharing sensitive information or installing dangerous software on their devices. Indeed, Proofpoint’s State of the Phish report found 81% of surveyed US organisations had faced smishing attacks – which is a type phishing attack via SMS message in 2020. Although phishing is well studied, the amount of research in SMS-based phish-ing is somewhat limited. Therefore, this study addresses the lack of SMS-based phishing insight, investigating which techniques/tactics are used by malicious senders and honest recipients to disguise/identify SMS-based phishing. By using an online questionnaire, a total of 576 participants’ options upon 20 text messages (10 genuine and 10 phishing) were gathered. The result shows 73.4% of the SMS messages were categorised correctly; also a number of factors such as shortened URLs, inconsistent metadata/content, urgency cue, and age play a positive role in identifying phishing attacks.

KW - short message service (SMS)

KW - phishing

KW - text message

KW - mobile phishing

U2 - 10.1007/978-3-030-81111-2_13

DO - 10.1007/978-3-030-81111-2_13

M3 - Conference contribution

SN - 9783030811105

SN - 9783030811136

T3 - IFIP Advances in Information and Communication Technology

SP - 148

EP - 163

BT - Human Aspects of Information Security and Assurance

A2 - Furnell, Steven

A2 - Clarke, Nathan

PB - Springer

CY - Cham

T2 - HAISA 2021: International Symposium on Human Aspects of Information Security and Assurance

Y2 - 7 July 2021 through 9 July 2021

ER -

Clasen M, Li F, Williams D. Friend or foe: an investigation into recipient identification of SMS-based phishing. In Furnell S, Clarke N, editors, Human Aspects of Information Security and Assurance: 15th IFIP WG 11.12 International Symposium, HAISA 2021, Virtual Event, July 7–9, 2021, Proceedings. 1st ed. Cham: Springer. 2021. p. 148-163. (IFIP Advances in Information and Communication Technology). doi: 10.1007/978-3-030-81111-2_13, 10.1007/978-3-030-81111-2

Friend or foe: an investigation into recipient identification of SMS-based phishing

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this