full-disclosure - Re: phish war game

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <28f529ba0808050649n30938e0fu6ad32b58a5522653@mail.gmail.com>
Date: Tue, 5 Aug 2008 06:49:54 -0700
From: blah <blah@...kogre.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: phish war game

>
> observations:
>
> 1. The model is over-simplified, in reality it's unlikely that BLUE
> would consistently achieve 80%.  However in reality it's also
> unlikely that RED would enjoy a linear relationship between
> obfuscation and success, specifically, the more RED obfuscates the
> less success it has.  Both teams might suffer diminishing returns
> from their efforts. (for the purposes of the above model, these
> effects have been allowed to cancel each other out)
>
> 2. The model has a constant 1% reduction in the victim rate, this is
> debatable, however it will never go upwards, eg., there is nothing
> RED can do to push that number back towards 100%.  Conversely,
> everything BLUE does pushes that number towards 0%.  In addition,
> other anti-phishing technologies will also be pushing the number
> towards 0%.  GREEN itself might even push the number down.
>

FLAWS:
1)  This also assumes that no new users ever start using the Internet that
may become new victims
2) It also assumes that all evolutions in phisher techniques are
predictable.  Anyone following the industry knows that all sorts of things
have been done so that their phishes seem more realistic/plausible.  And,
after using these new techniques, RED can push the number of victims back up
-- in direct contradiction of your statements, which do not reflect what
happens.

These 2 facts alone explain why phishing isn't the simple fix you have made
it out to be.  Your model is flawed, as it is based on flawed assumptions.

not interesting anymore.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/