Laboratory Design For Demonstrating Phishing

Hands-on laboratory exercises are a very important component of computer security and information assurance education. This paper reports the laboratory exercises we designed to demonstrate two ways of conducting phishing attack: 1) Embedding a hyperlink in a fake email which redirects the victim to a fake website; 2) Using ARP cache poisoning to redirect web access to a fake website. The two ways of carrying out phishing are compared and the defense techniques against phishing attacks are discussed. The laboratory exercises are designed to be used in an undergraduate-level introductory computer security course. The laboratory exercises have been used in a Computer System Security course with very positive results.