Re: Assessing the security awareness of web users at a national level

Hi Demetris,

Not sure about the ethic side of your project (even if I'd be curious to see
the results), but to answer your question, the only similar project I saw
was done by Didier Stevens back in 2007. See his blog post here

http://blog.didierstevens.com/2007/05/07/is-your-pc-virus-free-get-it-infect
ed-here/

I hope you'll find useful information there.

J-P


On 09-09-18 6:29 AM, "Demetris Papapetrou"
<dpapapetrou@xxxxxxxxxxxxxxxxxxxx> wrote:

Dear list members,

I am currently setting up a project, in which I will assess the security
awareness level of my fellow citizens concerning social engineering attacks
that are launched through the web. The scope of the project is to gather
statistical data and possibly draw some useful conclusions as to the level
of awareness of lets say, male vs female users in my country, young vs old
people, linux vs windows users or even firefox vs internet explorer users.
The attack methods will simulate real life scenarios such as fake virus
detection messages, missing codec messages or even "click me" buttons that
are often utilized by attackers to infect computers with
viruses/backdoors/malware/etc. I should note here that no harmful programs
will be sent to users during the assessment. Instead the "malicious website"
will record whether the users clicked on the download button/malicious link
or not.

I was wondering whether any of you know of similar projects performed and if
you are kind enough to point me to any relevant links.

Any suggestions regarding the method of distribution (e.g. emails, forums,
IRC, facebook, myspace, etc) or the different attack vectors (e.g. virus
message, codec missing messages, etc) or anything else that comes to your
mind will be much appreciated.


Thank you in advance,

Demetris


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually
do a proper penetration test. IACRB CPT and CEPT certs require a full
practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------




------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

Relevant Pages

  • Re: career advice
    ... Information Assurance Certification Review Board ... Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. ...
    (Pen-Test)
  • Re: Alisse
    ... Information Assurance Certification Review Board ... Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. ...
    (Pen-Test)
  • Re: demoing sslv2 vulns
    ... This might not be a stand alone attack, however for a POC you can use ... and modify this list and remove strong cipher suites. ... only pick a weak cipher and thus the encryption is much weaker as one would ... Information Assurance Certification Review Board ...
    (Pen-Test)
  • RE: Programming SKills for PT...?
    ... trying to attack a Web based application: ... Instructor-Led and Online formats is the most concentrated exam prep ... Comprehensive course materials and an expert instructor means ... Information Assurance Certification Review Board ...
    (Pen-Test)
  • Re: Nmap
    ... Information Assurance Certification Review Board ... Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. ...
    (Pen-Test)