Leveraging the crowds to disrupt phishing

Preventative anti-phishing approaches are not always effective. As there seem to be always users who ignore warnings, use old anti-phishing software, or rely on obsolete blacklists of phishing sites, phishers continue to find new victims who surrender their credentials to phishing sites. We thus take an aggressive anti-phishing approach, a research direction rarely explored. We study how we may disrupt phishing operations by injecting to phishing sites many fake credentials-also called honey tokens-that are indistinguishable from real credentials, allowing institutions under attack to detect and track phishing activities when honey tokens are used. We address the limitations from our early work, Humboldt 1.0, which automatically submits fake credentials but can fail if phishers take smart countermeasures. Based on a new architecture, Humboldt 2.0, we study how we may leverage human users to submit honey tokens successfully, while being resilient to various malicious countermeasures to our system. We further analyze its effectiveness and evaluate its cost using the Amazon Mechanical Turk service, showing that Humboldt 2.0 can successfully complement Humboldt 1.0.