Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

Jan-Willem Bullee; L. Montoya; Marianne Junger; Pieter H. Hartel

doi:10.3233/978-1-61499-617-0-107

Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

Jan-Willem Bullee, L. Montoya, Marianne Junger, Pieter H. Hartel

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

19 Citations (Scopus)

574 Downloads (Pure)

Abstract

The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.

Original language	Undefined
Title of host publication	Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016)
Editors	A. Mathur, A. Roychoudhury
Place of Publication	Amsterdam
Publisher	IOS
Pages	107-114
Number of pages	6
ISBN (Print)	978-1-61499-616-3
DOIs	https://doi.org/10.3233/978-1-61499-617-0-107
Publication status	Published - Jan 2016
Event	Singapore Cyber Security R&D Conference, SG-CRC 2015 - Singapore, Singapore Duration: 14 Jan 2016 → 15 Jan 2016

Publication series

Name	Cryptology and Information Security Series
Publisher	IOS Press
Volume	14
ISSN (Print)	1871-6431

Conference

Conference	Singapore Cyber Security R&D Conference, SG-CRC 2015
Period	14/01/16 → 15/01/16
Other	14-15 January 2016

Keywords

SCS-Cybersecurity
EC Grant Agreement nr.: FP7/2007-2013
EC Grant Agreement nr.: FP7/318003
Retention
Scam
Training
IR-98314
Social Engineering
Time
EWI-26500
Awareness
Decay
METIS-315056
Telephone

Access to Document

10.3233/978-1-61499-617-0-107

19 Citations
1 PhD Thesis - Research UT, graduation UT

Experimental social engineering: investigation and prevention
Bullee, J.-W., 6 Oct 2017, Enschede: Centre for Telematics and Information Technology (CTIT). 178 p.
Research output: Thesis › PhD Thesis - Research UT, graduation UT

Open Access
File
651 Downloads (Pure)

Cite this

Bullee, J.-W., Montoya, L., Junger, M., & Hartel, P. H. (2016). Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention. In A. Mathur, & A. Roychoudhury (Eds.), Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016) (pp. 107-114). (Cryptology and Information Security Series; Vol. 14). IOS. https://doi.org/10.3233/978-1-61499-617-0-107

Bullee, Jan-Willem ; Montoya, L. ; Junger, Marianne et al. / Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention. Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016). editor / A. Mathur ; A. Roychoudhury. Amsterdam : IOS, 2016. pp. 107-114 (Cryptology and Information Security Series).

@inproceedings{7195aa285db44bb8bf844a027155a1cf,

title = "Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention",

abstract = "The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.",

keywords = "SCS-Cybersecurity, EC Grant Agreement nr.: FP7/2007-2013, EC Grant Agreement nr.: FP7/318003, Retention, Scam, Training, IR-98314, Social Engineering, Time, EWI-26500, Awareness, Decay, METIS-315056, Telephone",

author = "Jan-Willem Bullee and L. Montoya and Marianne Junger and Hartel, {Pieter H.}",

note = "Foreground = 100%; Type of activity = conference; Main leader =UT; Type of audience = scientific community, industry; Size of audience = 150; Countries addressed = international;; Singapore Cyber Security R&D Conference, SG-CRC 2015 ; Conference date: 14-01-2016 Through 15-01-2016",

year = "2016",

month = jan,

doi = "10.3233/978-1-61499-617-0-107",

language = "Undefined",

isbn = "978-1-61499-616-3",

series = "Cryptology and Information Security Series",

publisher = "IOS",

pages = "107--114",

editor = "A. Mathur and A. Roychoudhury",

booktitle = "Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016)",

address = "Netherlands",

}

Bullee, J-W , Montoya, L , Junger, M & Hartel, PH 2016, Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention. in A Mathur & A Roychoudhury (eds), Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016). Cryptology and Information Security Series, vol. 14, IOS, Amsterdam, pp. 107-114, Singapore Cyber Security R&D Conference, SG-CRC 2015, 14/01/16. https://doi.org/10.3233/978-1-61499-617-0-107

Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention. / Bullee, Jan-Willem ; Montoya, L.; Junger, Marianne et al.
Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016). ed. / A. Mathur; A. Roychoudhury. Amsterdam: IOS, 2016. p. 107-114 (Cryptology and Information Security Series; Vol. 14).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

AU - Bullee, Jan-Willem

AU - Montoya, L.

AU - Junger, Marianne

AU - Hartel, Pieter H.

N1 - Foreground = 100%; Type of activity = conference; Main leader =UT; Type of audience = scientific community, industry; Size of audience = 150; Countries addressed = international;

PY - 2016/1

Y1 - 2016/1

N2 - The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.

AB - The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.

KW - SCS-Cybersecurity

KW - EC Grant Agreement nr.: FP7/2007-2013

KW - EC Grant Agreement nr.: FP7/318003

KW - Retention

KW - Scam

KW - Training

KW - IR-98314

KW - Social Engineering

KW - Time

KW - EWI-26500

KW - Awareness

KW - Decay

KW - METIS-315056

KW - Telephone

U2 - 10.3233/978-1-61499-617-0-107

DO - 10.3233/978-1-61499-617-0-107

M3 - Conference contribution

SN - 978-1-61499-616-3

T3 - Cryptology and Information Security Series

SP - 107

EP - 114

BT - Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016)

A2 - Mathur, A.

A2 - Roychoudhury, A.

PB - IOS

CY - Amsterdam

T2 - Singapore Cyber Security R&D Conference, SG-CRC 2015

Y2 - 14 January 2016 through 15 January 2016

ER -

Bullee JW , Montoya L , Junger M, Hartel PH. Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention. In Mathur A, Roychoudhury A, editors, Proceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016). Amsterdam: IOS. 2016. p. 107-114. (Cryptology and Information Security Series). doi: 10.3233/978-1-61499-617-0-107

Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

Abstract

Publication series

Conference

Keywords

Access to Document

Research output

Experimental social engineering: investigation and prevention

Cite this