Hossein Siadati
New York University, Computer Science and Engineering, Graduate Student
The goal of anti-phishing techniques is to reduce the delivery rate of phishemails, and anti-phishing training aims to decrease the phishing click-through rates. This paper presents the X-Platform Phishing Attack, a deceptive phishing... more
The goal of anti-phishing techniques is to reduce the delivery rate of phishemails, and anti-phishing training aims to decrease the phishing click-through rates. This paper presents the X-Platform Phishing Attack, a deceptive phishing attack with an alarmingly high delivery and click-through rates, and highlights a subclass of phishing attacks that existing anti-phishing methods do not seem to be able to address. The main characteristic of this attack is that an attacker is able to embed a malicious link within a legitimate message generated by service providers (e.g., Github, Google, Amazon) and sends it using their infrastructure to his targets. This technique results in the bypassing of existing anti-phishing filters because it utilizes reputable service providers to generate seemingly legitimate emails. This also makes it highly likely for the targets of the attack to click on the phishing link as the email id of a legitimate provider is being used. An X-Platform Phishing attack...
Research Interests:
Business Email Compromise (BEC) is an attack in which a scammer poses as a colleague of the intended victim or vendor of the targeted organization, and where the scammer either asks the intended victim to perform a payment or to send... more
Business Email Compromise (BEC) is an attack in which a scammer poses as a colleague of the intended victim or vendor of the targeted organization, and where the scammer either asks the intended victim to perform a payment or to send sensitive data. However, even though BEC is an increasing threat, the shape of the underlying scam is not well understood precisely because it is “underground.” In this chapter, we create a framework on analysis methodologies that assist us in exploiting a rare opportunity to view BEC scammers’ organizations from the inside. Using a “ground truth” data set, including 77 emailboxes belonging to scammers which contain a total of 73,212 emails, we provide a framework by which we create an in-depth empirical analysis of BEC attacks which provide insights into how BEC targets are selected and techniques employed by BEC scammers.
Research Interests:
Android Pattern, form of graphical passwords used on Android smartphones, is widely adopted by users. In theory, Android Pattern is more secure than a 5-digit PIN scheme. Users’ graphical passwords, however, are known to be very skewed.... more
Android Pattern, form of graphical passwords used on Android smartphones, is widely adopted by users. In theory, Android Pattern is more secure than a 5-digit PIN scheme. Users’ graphical passwords, however, are known to be very skewed. They often include predictable shapes (e.g., Z and N), biases in selection of starting point, and predictable sequences of the points that make them easy to guess. In practice, this decreases the security of Android Pattern to that of a 3-digit PIN scheme for at least half of the users. In this paper, we effectively increase the strength of Android Patterns by using a persuasive security framework, a set of principles to get users to behave more securely. Using these principles, we have designed two user interfaces that persuade users to choose stronger patterns. One of the user interfaces is called BLINK, where the starting point of the pattern is suggested to user, effectively nudging her to create a pattern with a significantly less predictable st...
Research Interests:
Research Interests:
Research Interests:
Enterprise networks have been a frequent target of data breaches and sabotage. In a widely used method, attackers establish a foothold in the target network by compromising a single computer or account. They then move laterally between... more
Enterprise networks have been a frequent target of data breaches and sabotage. In a widely used method, attackers establish a foothold in the target network by compromising a single computer or account. They then move laterally between computers to access valuable resources and information located deeper inside the network. To move laterally, attackers often steal valid user credentials. This paper is based on the observation that an attackers' pattern of access characteristics of the stolen credentials in the form of <;User, Source, Destination> deviates from benign patterns and can be used to detect malicious logins. In this paper, we present APT-Hunter1, a visualization tool that helps security analysts to explore login data for discovering patterns and detecting malicious logins. To evaluate the proposed system, a pilot study was conducted over an open dataset of more than one billion logins of an enterprise network, provided by Los Alamos National Lab (LANL). Using APT-Hunter, security analysts (unfamiliar with the dataset) were able to detect 349 of 749 malicious logins related to lateral movements performed by a Red Team during a penetration test conducted at LANL. APT-Hunter is currently deployed in a global financial company and helps security analysts detect account compromises.
Research Interests:
This chapter delivers an overview of traditional mechanisms to detect and stop unwanted emails. These mechanisms include email authentication (e.g., DKIM, SPF, DMARC), blacklisting (e.g., DNSBL), and content-based spam filtering (e.g.,... more
This chapter delivers an overview of traditional mechanisms to detect and stop unwanted emails. These mechanisms include email authentication (e.g., DKIM, SPF, DMARC), blacklisting (e.g., DNSBL), and content-based spam filtering (e.g., Naive Bayes Classifier). We explain the extent to which they can be useful to block scam, and point out evasion techniques that help spammers and scammers survive.
Research Interests:
Major Internet service providers deploy SMS-based verification mechanisms to fortify the security of users’ accounts for critical actions such as password reset and logging in from a new computer. In this paper, we describe a new type of... more
Major Internet service providers deploy SMS-based verification mechanisms to fortify the security of users’ accounts for critical actions such as password reset and logging in from a new computer. In this paper, we describe a new type of phishing attack where an attacker triggers the delivery of a verification code from a service provider to a user and lures the user to forward the code to him so that he can bypass the SMS verification process. We call this a Verification Code Forwarding Attack (VCFA). The attacker can use VCFA to reset a password of a user’s account or to get access to a 2-factor enabled account which he already knows its password (e.g., through leaked databases). We attribute the success of this attack to the lack of an effective and usable means for users to verify the service provider, the lack of context for the message sent, and an assumption about users’ understanding of the authentication process. To show the susceptibility of the users to such an attack, we conducted an experiment with 20 mobile phone users and found that more than 25 % of users were vulnerable against this type of attack. A semi-structured interview with the subjects of the experiment and a survey of 100 subjects on Amazon Mechanical Turk were done to explore possible causes for the success of this type of attack. We also discuss possible remediation.
Research Interests:
Research Interests:
Research Interests:
Research Interests:
In this chapter, we describe a novel approach to reduce the impact of spoofing by a subtle change in the login process. At the heart of the technique is the understanding that current anti-spoof technologies fail largely as a result of... more
In this chapter, we describe a novel approach to reduce the impact of spoofing by a subtle change in the login process. At the heart of the technique is the understanding that current anti-spoof technologies fail largely as a result of the difficulties to communicate security and risk to typical users. Accordingly, the approach is oblivious to whether the user was tricked by a fraudster or not. This is achieved by modifying the user login process and letting the browser or operating system cause different results of user login requests based on ...
Research Interests:
We describe a preference-based authentication scheme in which both security and usability of previous approaches are dramatically improved upon. We report on experimental findings supporting a false negative rate on the order (For precise... more
We describe a preference-based authentication scheme in which both security and usability of previous approaches are dramatically improved upon. We report on experimental findings supporting a false negative rate on the order (For precise estimates of error rates, large-scale testing is necessary.) of 0.9% and a false positive rate on the order of 0.5% for a choice of parameters that result in a registration time of 100 s and an authentication time of 40 s.
Research Interests:
User reported experiences and opinions are used by peers to make decisions about where to go and what to buy. Unfortunately, not all users or opinions are honest. Many opinions are fabricated and may be submitted by automated systems or... more
User reported experiences and opinions are used by peers to make decisions about where to go and what to buy. Unfortunately, not all users or opinions are honest. Many opinions are fabricated and may be submitted by automated systems or by people who are recruited by businesses and search engine optimizers to write good reviews. Such reviews and ratings are called spam reviews. These are misleading for users and troublesome for honest businesses. While most cur- rent efforts to tackle this problem are focused on spam review detection, in this paper we focused on detecting authentic and valuable reviews for a front-end application that reorders the reviews. In this manner, we have identified several features based upon the content of the reviews as well as identifying behavioral features of reviewers to pinpoint useful reviews with 80% accuracy.
Research Interests:
We describe a common but poorly known type of fraud – so-called liar buyer fraud – and explain why traditional anti-fraud technology has failed to curb this problem. We then introduce a counter-intuitive technique based on user interface... more
We describe a common but poorly known type of fraud – so-called liar buyer fraud – and explain why traditional anti-fraud technology has failed to curb this problem. We then introduce a counter-intuitive technique based on user interface modification to address liar-buyer fraud, and report result of experiments supporting that our technique has the potential of dramatically reducing fraud losses. We used a combination of role playing and questionnaires to determine the behavior and opinions of about 1700 subjects, and found that our proposed technique results in a statistically significant reduction of fraud rates for both men and women in an experimental setting. Our approach has not yet been tested on real e-commerce traffic, but appears sufficiently promising to do that. Our findings also support that men are more willing to lie and defraud than women are; but maybe more interestingly, our analysis shows that the technique we introduce make men as honest as women.
Research Interests:
Android Pattern, form of graphical passwords used on Android smartphones, is widely adopted by users. In theory, Android Pattern is more secure than a 5-digit PIN scheme. Users’ graphical passwords, however, are known to be very skewed.... more
Android Pattern, form of graphical passwords used on Android smartphones, is widely adopted by users. In theory, Android Pattern is more secure than a 5-digit PIN scheme. Users’ graphical passwords, however, are known to be very skewed. They often include predictable shapes (e.g., Z and N), biases in selection of starting point, and predictable sequences of the points that make them easy to guess. In practice, this decreases the security of Android Pattern to that of a 3-digit PIN scheme for at least half of the users. In this paper, we effectively increase the strength of Android Patterns by using a persuasive security framework, a set of principles to get users to behave more securely. Using these principles, we have designed two user interfaces that persuade users to choose stronger patterns. One of the user interfaces is called BLINK, where the starting point of the pattern is suggested to user, effectively nudging her to create a pattern with a significantly less predictable starting point. The other user interface is called EPSM, where the system gives continuous feedback to user while she is creating a new pattern, effectively persuading her to create a complex pattern. Security and usability of our proposed designs evaluated by conducting a user study on 270 participants recruited from Amazon MTurk demonstrated that while only 49% of subjects choose strong patterns in Android Pattern user interface, our suggested designs increase it to 60% in BLINK and 77% in EPSM version.
Research Interests:
Research Interests:
In this chapter, we describe a novel approach to reduce the impact of spoofing by a subtle change in the login process. At the heart of the technique is the understanding that current anti-spoof technologies fail largely as a result of... more
In this chapter, we describe a novel approach to reduce the impact of spoofing by a subtle change in the login process. At the heart of the technique is the understanding that current anti-spoof technologies fail largely as a result of the difficulties to communicate security and risk to typical users. Accordingly, the approach is oblivious to whether the user was tricked by a fraudster or not. This is achieved by modifying the user login process and letting the browser or operating system cause different results of user login requests based on ...