Understanding the role of sender reputation in abuse reporting and cleanup

Çetin, Orçun; Jhaveri, Mohammad Hanif; Gañán, Carlos; Eeten, Michel van; Moore, Tyler

doi:10.1093/cybsec/tyw005

Cited by 31 publications

(38 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, one respondent recalled that they "had to google you to know it was not phishing" while another suggested providing "instructions on how to verify the authenticity of the sender." These replies indicate that the sender may impact a notification's effectiveness, a conclusion that conflicts with the study from Cetin et al [6], which experimented with several different notification senders and found that sender reputation did not appear to affect remediation rates. Further investigation into this factor is needed, as our survey responses suggest that trust in the sender is an important consideration.…”

Section: F Trust As a Factorcontrasting

confidence: 79%

“…The difference is drastic, even when considering the possibility that some respondents may have mistaken (or did not distinguish) between the two. This counters the intuition used in prior notification studies [6,13,19,25,26] which have utilized the abuse contact, considering it more security-relevant.…”

Section: E Proper Points Of Contactmentioning

confidence: 53%

“…The ethics of performing security notifications themselves are not fully settled, although a number of prior notification studies [6,13,17,19,25] have set a precedence for acceptable notifications. In particular, surveys in two prior studies [13,19] documented the acceptability and helpfulness of these notifications in the eyes of message recipients.…”

Section: E Ethical Considerationsmentioning

confidence: 99%

See 2 more Smart Citations

Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications

Stock

Pellegrino

et al. 2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

After treating the notification of vulnerable parties as mere side-notes in research, the security community has recently put more focus on how to conduct vulnerability disclosure at scale. The first works in this area have shown that while notifications are helpful to a significant fraction of operators, the vast majority of systems remain unpatched. In this paper, we build on these previous works, aiming to understand why the effects are not more significant. To that end, we report on a notification experiment targeting more than 24,000 domains, which allowed us to analyze what technical and human aspects are roadblocks to a successful campaign. As part of this experiment, we explored potential alternative notification channels beyond email, including social media and phone. In addition, we conducted an anonymous survey with the notified operators, investigating their perspectives on our notifications. We show the pitfalls of email-based communications, such as the impact of anti-spam filters, the lack of trust by recipients, and the hesitation in fixing vulnerabilities despite awareness. However, our exploration of alternative communication channels did not suggest a more promising medium. Seeing these results, we pinpoint future directions in improving security notifications.

show abstract

Section: F Trust As a Factorcontrasting

confidence: 79%

Section: E Proper Points Of Contactmentioning

confidence: 53%

Section: E Ethical Considerationsmentioning

confidence: 99%

See 1 more Smart Citation

Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications

Stock

Pellegrino

et al. 2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Cetin et al studied the effect of reputation of the sender of the abuse notification on cleanup rates. While notifications in general improved cleanup, there was no observable effect of the sender reputation [8].…”

Section: Related Workmentioning

confidence: 80%

Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai

Çetin

Gañán

Altena

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

With the rise of IoT botnets, the remediation of infected devices has become a critical task. As over 87% of these devices reside in broadband networks, this task will fall primarily to consumers and the Internet Service Providers. We present the first empirical study of IoT malware cleanup in the wild-more specifically, of removing Mirai infections in the network of a medium-sized ISP. To measure remediation rates, we combine data from an observational study and a randomized controlled trial involving 220 consumers who suffered a Mirai infection together with data from honeypots and darknets. We find that quarantining and notifying infected customers via a walled garden, a best practice from ISP botnet mitigation for conventional malware, remediates 92% of the infections within 14 days. Email-only notifications have no observable impact compared to a control group where no notifications were sent. We also measure surprisingly high natural remediation rates of 58-74% for this control group and for two reference networks where users were also not notified. Even more surprising, reinfection rates are low. Only 5% of the customers who remediated suffered another infection in the five months after our first study. This stands in contrast to our lab tests, which observed reinfection of real IoT devices within minutes-a discrepancy for which we explore various different possible explanations, but find no satisfactory answer. We gather data on customer experiences and actions via 76 phone interviews and the communications logs of the ISP. Remediation succeeds even though many users are operating from the wrong mental model-e.g., they run antivirus software on their PC to solve the infection of an IoT device. While quarantining infected devices is clearly highly effective, future work will have to resolve several remaining mysteries. Furthermore, it will be hard to scale up the walled garden solution because of the weak incentives of the ISPs.

show abstract

“…We have "measured" effort only as a latent factor in the unexplained variance of our model. Future work could try to measure it more directly, via surveys or experiments with abuse notifications and takedown speed [Li et al 2016;Cetin et al 2015].…”

Section: Discussionmentioning

confidence: 99%

Rotten Apples or Bad Harvest? What We Are Measuring When We Are Measuring Abuse

Tajalizadehkhoob

Böhme

Gañán

et al. 2018

ACM Trans. Internet Technol.

Self Cite

View full text Add to dashboard Cite

Internet security and technology policy research regularly uses technical indicators of abuse in order to identify culprits and to tailor mitigation strategies. As a major obstacle, readily available data are often misaligned with actual information needs. They are subject to measurement errors relating to observation, aggregation, attribution, and various sources of heterogeneity. More precise indicators such as size estimates are costly to measure at Internet scale. We address these issues for the case of hosting providers with a statistical model of the abuse data generation process, using phishing sites in hosting networks as a case study. We decompose error sources and then estimate key parameters of the model, controlling for heterogeneity in size and business model. We find that 84 % of the variation in abuse counts across 45,358 hosting providers can be explained with structural factors alone. Informed by the fitted model, we systematically select and enrich a subset of 105 homogeneous "statistical twins" with additional explanatory variables, unreasonable to collect for all hosting providers. We find that abuse is positively associated with the popularity of websites hosted and with the prevalence of popular content management systems. Moreover, hosting providers who charge higher prices (after controlling for level differences between countries) witness less abuse. These factors together explain a further 77 % of the remaining variation, calling into question premature inferences from raw abuse indicators on security efforts of actors, and suggesting the adoption of similar analysis frameworks in all domains where network measurement aims at informing technology policy.There is an enormous amount of work on methods for detecting abused resources. The blacklists based on these detections have also been extensively studied [Pitsillidis et al. 2012;Kührer et al. 2014]. Observational data on abuse incidents is the starting point for our study. We do not engage with the detection methods themselves and therefore will not survey them here.

show abstract

Understanding the role of sender reputation in abuse reporting and cleanup

Cited by 31 publications

References 5 publications

Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications

Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications

Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai

Rotten Apples or Bad Harvest? What We Are Measuring When We Are Measuring Abuse

Contact Info

Product

Resources

About