From Victims to Defenders: An Exploration of the Phishing Attack Reporting Ecosystem
Zhibo Suna, Faris Bugra Kokulub, Penghui Zhangb, Adam Oestb, Gianluca Stringhinic, Tiffany Baob, Ruoyu Wangb, Yan Shoshitaishvilib, Adam Doupéb, Gail‐Joon Ahnb
- aDrexel University, USA
- bArizona State University, United States of America
- cBoston University, United States of America
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
Reporting phishing attacks can significantly shorten the time required to take down their operations and deter further victimization by the same phishing websites. However, little research has been conducted to understand the phishing reporting ecosystem and its effectiveness. In this paper, we comprehensively evaluate the phishing reporting ecosystem to identify the critical challenges people face and their concerns when reporting smishing, vishing, and phishing email attacks. First, we analyze the existing security advice and channels for reporting phishing attacks in both the public and private sectors. Then, we conduct a scenario-based experiment involving 89 participants to investigate what factors affect a participant’s decision to report a phishing attack and what challenges they face in preparing the report. Third, we report phishing attacks ourselves and monitor the status of the reported phishing websites to empirically measure how reports are acted upon and how that affects the reported phishing websites. Finally, we propose approaches under five major concern categories to mitigate the challenges that we discover in the phishing reporting ecosystem.
TL;DRThis paper comprehensively evaluates the phishing reporting ecosystem to identify the critical challenges people face and their concerns when reporting smishing, vishing, and phishing email attacks and proposes approaches under five major concern categories to mitigate the challenges that are discovered. (Semantic Scholar)