Google research looked into root cause (pun intended) of account takeovers, good job. But is ranking threats a bad idea?
Google research reckons that somewhere between 12 and 25 percent of attacks using phishing or keyloggers on Google accounts will uncover a valid password. Both of these threat methods will attempt to get further information that might help in answering password reset questions: 82 percent of phishers and 74 percent of keyloggers looked for an IP and location, 18 percent of both hunted for phone numbers and device details.
So far so interesting for those of use who track threat intelligence matters. Here’s where it starts getting a little more fuzzy for me though. The Google research paper goes on to ‘rank’ the relative risk of phishing, keyloggers and third party breaches to user exposure to account hijacking. They placed phishing as the biggest threat, then keyloggers and third party breaches behind them.
