Design, Implementation and Evaluation of an Anti-Phishing Education App

Scammers discover the Internet as a convenient place for their criminal activities. For instance, they send Internet users spoofed e-mails which link to fraudulent websites. These websites prompt visitors to enter their confidential data. This kind of Internet fraud is referred to as phishing. There exist multiple technical solutions to approach the problem of phishing which, for example, warn the users against accessing a revealed phishing website. Yet, they all cannot guarantee 100% accuracy since there will always be ways to circumvent these techniques. Moreover, security warnings or indicators of such approaches are not always recognized or even ignored by some end users. For these reasons, a complementary approach is required. Previous approaches do not draw on a crucial factor to combat the threat - the users themselves. Therefore, the increase of security awareness and especially user education about the dangers of the Internet is a further key strategy to combat phishing. Our master’s thesis aims at developing a smartphone app, which increases security awareness and educates the user regarding the detection of phishing. To increase security awareness, the users send themselves a “spoofed” e-mail right away when starting the app for the first time. The user education part entails alerts regarding known techniques of attackers and is supposed to assist the users to internalize these with the aid of practice and repetition. By this means, we aspire to help the users achieve the capability of defending themselves against phishing attacks in the future. In detail, our app is realized as a quiz based game which mainly focuses on the detection of phishing URLs. In order to evaluate the effectiveness of the app a user study is conducted. The study outcomes show that our app helps users make better decisions regarding the legitimacy of URLs