Most web users cannot recognise fake popup messages

 

Gallery

Posted on 25 Sep 2008 at 15:16

Most internet users cannot distinguish genuine popup messages from false warnings generated by malware - even after repeated mistakes, security experts have warned.

Research carried out at the North Carolina State University found that the physical differences between real and the fake messages were very subtle, and most participants did not discern them.

Participants were fooled by the fake messages 63 per cent of the time, despite being warned that some of the popups would be false.

The study, entitled 'Failure to Recognize Fake Internet Popup Warning Messages', warned that this widespread inability to recognise bogus warnings is leaving users open to malware and virus attacks. Safer options, such as simply closing the message box, were infrequently chosen, the researchers found.

For the research the responses of undergraduate students to real and fake warning messages was recorded while they did a series of search tasks on a personal computer connected to the internet. The real warning messages simulated local Windows operating system warnings, whereas fake messages were popup messages emanating from an exterior source via the internet.

"This study demonstrates how easy it is to fool people on the web,"
said study co-author Dr Michael S. Wogalter, professor of psychology at NC State. The study was led by psychology graduate student David Sharek and co-authored by undergraduate Cameron Swofford.

Wogalter suggested that additional unique features should be added to real messages to allow people to differentiate between genuine warning messages and fake popups. However, he added: "I don't know if you could develop a legitimate message that could not be duplicated and used illegitimately."

Author: Robert Jaques