Ichthyology: Phishing as a Science

I watched a presentation from Stripe internal eng that was given I forget where. An internal engineer there who did a bunch of security work phished like half of her own company (testing, obviously). Her conclusion, in a really well-done talk, was that it was impossible. No human measures will reduce it given her success at a very disciplined, highly security conscious place. The only thing that works is yubikeys which prevent this type of credential + 2fa theft phishing attack. edit: karla burnette / talk ▶ this video

Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out. There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. ▶ this video

Phishing is frankly an embarrassment for the mainstream security community. The temptation is to "blame the stupid users" -- but the truth is that even a script kiddie can take a real email from a mainstream brand, "Save As HTML...", change one link, and resend... and snare even sophisticated victims. This BlackHat talk ( ▶ this video ) shows just how easy it is to phish even users who think they are too good to be fooled. At Inky ( link ) we're using a combination of computer vision, anomaly detection, and domain-specific hacks to identify zero-day phishing emails "from first principles" (as I like to say). And it works! But the pushback from the security establishment is impressive. I like to say that there are two widely-held but false beliefs about phishing: 1) phishing is solved; 2) phishing is unsolvable. The truth is that we can already see clearly that within 3-5 years machines will be good enough at identifying phishing emails that attackers will move to another vector... but you'd never know it listening to "Security Thought Leaders."

This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites. ▶ this video