Re: phish war game

[blah <blah () blakogre com>]

> observations:
>
> 1. The model is over-simplified, in reality it's unlikely that BLUE
> would consistently achieve 80%.  However in reality it's also
> unlikely that RED would enjoy a linear relationship between
> obfuscation and success, specifically, the more RED obfuscates the
> less success it has.  Both teams might suffer diminishing returns
> from their efforts. (for the purposes of the above model, these
> effects have been allowed to cancel each other out)
>
> 2. The model has a constant 1% reduction in the victim rate, this is
> debatable, however it will never go upwards, eg., there is nothing
> RED can do to push that number back towards 100%.  Conversely,
> everything BLUE does pushes that number towards 0%.  In addition,
> other anti-phishing technologies will also be pushing the number
> towards 0%.  GREEN itself might even push the number down.

FLAWS:
1)  This also assumes that no new users ever start using the Internet that
may become new victims
2) It also assumes that all evolutions in phisher techniques are
predictable.  Anyone following the industry knows that all sorts of things
have been done so that their phishes seem more realistic/plausible.  And,
after using these new techniques, RED can push the number of victims back up
-- in direct contradiction of your statements, which do not reflect what
happens.

These 2 facts alone explain why phishing isn't the simple fix you have made
it out to be.  Your model is flawed, as it is based on flawed assumptions.

not interesting anymore.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/