Exploiting Curiosity and Context: How to Make People Click on a Dangerous Link...
summary
Sent fake email and Facebook messages to over 1600 students claiming links to party photos, serve an “access denied” landing page and log who clicks. When addressed by first name click rates are 56% (email) and 38% (Facebook); without names they are 20% and 42.5% respectively. Surveyed users report 78% awareness, but that awareness does not predict clicking; top motives are curiosity about the content (34%), plausibility/context (27%) and thinking they know the sender (16%). Technical defenses are recommended over relying on user training.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 2:35Technical vs. Human Vulnerabilities
- 5:22Research questions
- 6:19Study Idea
- 7:55Ethics: Recruitment
- 9:30Ethics: Connecting Behavior with Survey
- 10:24Final Design
- 11:00Study 1: Survey
- 11:44Study 2: Design Changes
- 14:54Addressing by Name
- 16:41Study 1 vs. Study 2: Survey Reliability
- 17:12Study 2: Email vs. Facebook Survey Reliability
- 20:33Trust Into Technical Context
- 22:11Reasons for Non clicking
- 25:37Limitations
- 26:19Targeting
- 27:24Requirements on Users
- 28:36Let me introduce...
- 29:10Want Your Employees Be Aware of Spear Phishing?
- 35:28Pentesting & Patching Humans
- 38:07Feasible User Involvement?
- 41:03Key Takeaways
related talks
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
30mGetting Engagement in the Midst of Chaos
07mSpear Phishing the Masses: When Open Data is Dark
53mRisk Profiles: Why Some Employees Attract Danger and Others Dodge It
09mPresenting Suspicious Details in User-Facing E-mail Headers Does Not Improve...
20mDissecting Spear Phishing Emails for Older vs Young Adults: On the Interplay of Weapons of ...
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness
44mHacking Humans: Social Engineering Techniques