Research by the University of Plymouth has shown that technology companies are not doing enough to protect individuals and organizations from threats such as phishing. At the same time, users need to be aware of the risks so that hackers access to personal and sensitive information.
Phishing is designed to trick victims into revealing sensitive personal information, such as identity and financial details. It can take four forms:
- Bulk-phishing: where the approach is not specifically targeted or customized for the recipient.
- Spear-phishing: where the message is addressed to specific individuals or companies and tailored accordingly.
- Clone-phishing: where hackers take a legitimate email message containing an attachment or link and replace it with a malicious one.
- Whaling: where it is addressed to distinguished personalities.
The research evaluated the effectiveness of phishing filters by sending two sets of messages to victims' accounts using content from phishing emails. These messages were initially in plain text with links disabled, and then with links that led to their original destination.
They then looked at which messages arrived and to which email accounts, and whether they were categorized in any way as malicious or even suspicious. In the vast majority of emails, the messages were delivered normally and had no marking as spam or suspicious. Only 6% of the messages were classified as malicious.
The lead researcher and professor, Steven Furnell, said that this admittedly poor performance by providers implies that they either do not use filters at all or that they are simply inadequate. This means that it is long overdue to improve the detection of phishing emails, which is difficult with the current technology.
The number of phishing attacks has increased dramatically since they were first recorded in 2003. The well-known antivirus Kasperskyreported that its anti-phishing system detected viruses 482,465,211 times in 2018, almost twice as many times as in 2017.
