Norman M. | May 18, 2012

Why Phish Should Not Be Treated as Spam

Phishing — or the use of highly targeted e-mails to induce users to divulge passwords or use malware — is a problem for all companies. In this invited editorial, security expert Norman Sadeh discusses how phishing needs to be treated separately from spam and spam solutions.

More than 500 million phishing e-mails appear in user inboxes every day. While this number pales in comparison to spam (which accounts for almost 70% of all e-mail traffic), spam is mainly a nuisance, whereas phishing can lead to costly security breaches. In the U.S. alone, phishing attacks on customers have been reported to result in direct financial losses of several billion dollars per year. But for corporations and government organizations, this is just the tip of the iceberg, as more-targeted "spear phishing" attacks can lead to potentially devastating security breaches, loss of sensitive data, and significant financial losses.

Anti-Spam Vendors: Comparing Apples with Oranges

While most anti-spam/anti-virus vendors have repurposed their filters to also catch phishing e-mails, their solutions rely primarily on manually maintained "black lists." To minimize the risk of flagging legitimate sites, these black lists typically come in the form of fraudulent URLs that are manually vetted by people. By their very nature, these black lists are always one step behind, lagging by at least several critical hours and sometimes days. During that lag time, many phishing e-mails will go undetected by spam filters and many of the malicious websites to which phishing victims are directed will not be flagged by their browsers — as the browsers rely heavily on black lists, too. Yet studies have shown that during regular work hours, 50% of users who fall for phishing attacks read their e-mail within two hours of the time it reaches their inbox. This number reaches 90% within eight hours. In other words, a lag in updating blacklists by just a few hours can have devastating consequences. "Reply-to" phishing e-mails with no attachments and no links are another example of phishing attacks that often go undetected by anti-spam/anti-virus filters. This is due in part to anti-spam filters' use simple "bag of words" techniques. These are techniques that look for e-mails containing collections of words that are indicative of spam. They are good for catching spam, but they are unable to differentiate between phishing e-mails and legitimate e-mails, since many phishing e-mails are crafted to look just like legitimate e-mails.

Ironically, this state of affairs is not entirely obvious to someone who looks at the statistics advertised by many vendors promoting their anti-virus/anti-spam filters. Many continue to boast about their ability to catch "up to 99%" of malicious e-mail, a confusing statement that clumps together spam, viruses, and phishing attacks. Because almost 70% of all e-mail traffic is spam, and phishing attacks amount to only about 0.5% of the traffic, "catching up to 99% of malicious e-mail" is an ambiguous statement. The consequences of finding an unfiltered spam e-mail in your inbox cannot be equated to the potential consequences of receiving a phishing e-mail. In other words, spam vendors are often comparing apples with oranges. In addition, they fail to tell us about the number of false positives they may end up flagging to reach the 99% performance they boast of. False positives are those legitimate e-mails they sometimes classify as spam and move to your junk box, forcing you to regularly go and check whether an important e-mail found its way there by mistake. In truth, to reach 99% effectiveness, many spam filters require settings that also lead to more false positives, effectively reducing the value of the filter because users are forced to regularly check the content of their junk box for legitimate correspondence.

Click here to continue reading

- See more at: /why-phish-should-not-be-treated-as-spam#sthash.A7cVXEhy.dpuf