Real World Phishing Statistics

Over the last two days I have been dealing with the fallout of a big phishing message that hit our organization.  We had two messages come out in two days and one of them was really well done.  It had no grammar mistakes and it used the proper name of our organization and our services.  The spoofed reply to address even matched our domain, which has not been the case in previous phishing messages.  This one was head and shoulders above the rest.

We had to field a lot of calls from people asking about this message.  We get phishing messages every day so I have to admit that I am a little bit jaded about them now.  But after we got a few calls I ran a query to find out how many of these had come in and when we saw that it was a rather large number (465 users) we decided that we needed to take some action.  We queried our outgoing mail and locked the user account of anyone that responded to the message in any way.  The next day the second message came in and it went to about 840 users.  This time we hijacked the return address so that anyone who sent a response went into a mailbox that we control instead of the phisher.  This was helpful in preventing misuse of our systems, but it also allowed us to gather some statistics that I'd like to share with you.  Keep in mind that these are statistics for one single incident at a college in the Midwest United States.  It would be foolish to think these numbers will hold true for any organization in any part of the world.

The two messages went to a total of 853 unique users (there was some overlap in the two messages).  Of those 853 users, 29 responded to the message.  We have about 14,000 user accounts so that means that we can say with 95% confidence that 3.34% (+/- 1.17%) of our users will provide *SOME* response to a well-crafted phishing message.

Of the 29 total responses, we were able to intercept and examine 13 of them.  Of the 13 we found that 11 of them had responded with a username and password.  The other people told the phisher to "piss off" or asked if the request was real.  Based on these numbers we have a sample size of 29 out of a population of 853 and 84.61 provided their password.  So we can say with 95% certainty that 84.61% (+/- 14.83%) of responses to phishing messages contain the username and password.

There are a couple interesting demographic things you should know about our organization and my methodology for coming up with these numbers.  First of all, I came up with the statistics using the sample size calculator here: http://www.surveysystem.com/sscalc.htm

Next, our organization has about 14,000 users most of whom are from the Midwest and most of whom are between the ages of 18 and 22.  10% of the population has been through a computer-based computer awareness training program, and the organization sends email reminders about phishing about twice a year.

One thing that no human or machine could count is the number of calls, emails and shouts in the hallway asking if the message was real or not.  That actually consumed more of my time than dealing with the 29 people that responded to the messages.  So if you're ever working through how much a phishing attack might cost your organization, make sure you add in the value of people's time dealing with the same question about 6 million times.  6 million times in an organization with about 14,000 users.  That's a good starting metric, but you may get more.  

Teach a man to phish...

If you teach a man to phish, then he'll come to my University and make my life hell. Actually, I guess a single phisher wont make my life hell. Really all of them together aren't making my life hell, they're just making it more hellful.

A while back I reviewed Adam Shostack's book, "The New School of Information Security." One of the things he talks about in that book is user awareness training. Many of us, myself included, track security metrics such as the number of people that are completing our user awareness training rather than looking for metrics that prove the effectiveness of our training. I haven't been able to put together any studies into the effectiveness of our training because so few of my users have actually done the training. Never the less, I think this story might be interesting to some of you.

I've mentioned that we've been having a real problem with phishing email. Just this semester we have had three intrusions into our network by people that have valid credentials which they phished out of our users. The most recent one was last week. We detected the problem and locked out the account. I went through the victims mail and found where he or she had responded to the phishing message. Then I called the victim and we had a very interesting conversation. It turns out that the user was aware that our department does not ask for passwords over email. The user told me that he or she would never respond to such a message because we have put so much publicity around not responding to phishing messages. When I pointed the user to the sent item, the user said "Oh no, I remember sending this."

As we talked the user described complete bewilderment that he or she was suckered in by this. It seems like even though we had successfully educated this user, the user just automatically responded when the real thing showed up. I'm not even sure what to make of this evidence. Does this indicate that our user awareness efforts have been ineffective? You could say yes, because the user gave up the password; or you could say no because the user knew better. Was this just an isolated mistake that wont be repeated by other users? Do I need to focus more on spreading the word, or do I need to change the word that I'm spreading? It's a real head scratcher.

One thing I would like to look into is writing up a plug-in for Microsoft Outlook. The idea would be to write up some basic rules and if the message matches those rules then the Reply button would be greyed out. Maybe it would give them some warning message before they can really reply to the message. Maybe it would notify us in IT if someone responded to a suspicious message. Prevention is always better than policing, right?

Any other ideas to fight phishing when your users are just looking for a hook to bite onto?

Does it seem like people with more education are harder to educate?

I'm kind of annoyed today. I was in meetings for pretty much all of Friday and then after I got home I made the mistake of reading my email. The lesson I've taken away is that people with more education might be more difficult to educate.

For those who don't know me, you can see from my profile that I work for a four year university. So I am surrounded by some of the best and brightest minds in the Western world. Or at least one would think that, but todays events have lead me to doubt that.

Starting in January we are going to have a new standard in place governing the length and complexity of passwords. On Friday I met with some people to talk about the best way to get the message out to the campus community. At this point our standard has been drafted and signed, and we've already presented it to various groups of stakeholders that had no objections. But one faculty member was acting like I was throwing puppies out of the third floor window. He was shocked and incensed that we weren't going to let them use the same password over and over again. He didn't seem to have a problem with us changing passwords every 180 days as long as he could keep setting the password to what it was. He kept asking me "How are they going to remember these passwords?" I can't believe it that an army of PhDs can't remember passwords.

After we got done with that unpleasantness, we moved on to a configuration standard for computers that are available to the Internet. This time I was getting grief because my standard is too difficult to understand. This same faculty member was suggesting that we can't expect people that set up these server to know what things like TCP, SMTP, or DNS are. Sorry, but I feel like if you're going to set up an SMTP server you better know how to make sure it isn't an open relay. I did get some satisfaction from telling him that if I don't enforce these rules then the rest of the Internet will by blacklisting that open relay. And while it may be true that some people wont be able to understand the technical talk in my standard, it still needs to be documented somewhere so that people don't think we make these requirements up on a server by server basis. This guy just wasn't getting it.

So then after that great day, I went home and ready my email. We have been having a problem with phishing emails being sent to the campus and several people have been tricked into giving their password to spammers. To combat the problem, we have send emails out to the entire campus, and I have gone to several meetings with leadership groups around campus. For the last three months I haven't gone a day without telling someone that ITS will never ask for your password over email. So guess what I found in my inbox? One of the most senior leaders in our organization asking for the fourth time if a phishing email was legitimate or not? I have to say that it is really demoralizing when the leaders that are supposed to be supporting your efforts don't even know what you're doing...even after you have told them four times!

I've heard other security managers mention that it can be difficult to get the message through to senior leadership that information security is important to them. I also have heard that it can be difficult to teach users to change the way they do things. I guess I am disappointed because I thought that a University would be full of thought leaders, lifelong learners, and people that could grasp a simple concept after four lessons. Also, most of the staff and students are grasping these concepts quite quickly. So is it just that people who have more education are too thick-headed to learn this?