網路釣魚被害類型及其成因

Phishing Victimization：Typologies and Causes

廖釗頡(Chao-Chieh Liao)

指導教授 ： 周愫嫻

國立臺北大學/社會科學學院/犯罪學研究所/碩士(2010年)

摘要

網路釣魚是一種目標為個人資料，例如帳號密碼或是其他個人資料的一種網路詐欺行為。其犯罪的方式可以是資訊技術層面的利用惡意程式、架設假網站，也可以是非資訊技術的方式。本研究以被害者角度探討網路釣魚被害的原因，並以被害者學中的日常活動理論、生活暴露理論、風險評估模式等相關被害者學理論來探討網路釣魚被害；同時由於網路釣魚可以在被害人與犯罪人完全沒有接觸的情況下達成，與一般被害者學理論有些不同，故研究除了用一般被害者學理論外，還援引了真實世界中的釣魚活動來補充被害理論的不足。
研究以網路問卷的方式施行，抽樣方式採用非隨機抽樣中的立意抽樣，由研究者在ptt問卷板、網拍板以及其他網站的討論區發文請網友填寫，以增加問卷曝光度，並搜尋的方式在網路中找尋有分享被害經驗者，請求其填寫問卷。研究以預試的方式檢驗信效度，經過兩次預試的修正才得到良好的信效度，最終正式問卷共回收了363份問卷。
結果顯示，被害人的特徵為年齡低、教育程度低、收入低、職業為學生、一周上網日數長、上網行為中較常玩線上遊戲與部落格，這部分呼應了生活暴露理論的假設。研究所選的理論在Logistic迴歸中，我們發現日常活動理論，特別是合適的標的物與網路釣魚被害有顯著的關係，代表越是避免自己個資成為理想標的物，將會減少網路釣魚被害。研究的其他發現與假設驗證如下：一、被害人出現被害恐懼，相對於沒有被害經驗者，對自己的個資特別注意。二、網路使用者都非常在意自己的個人資料安全。三、網路使用者信任大型公司。四、涉及金錢的帳號容易成為目標(網拍、線上遊戲)。五、信用卡反而較安全。
針對如何防範網路釣魚被害，本研究建議：一、利用宣導教育防治網路釣魚被害。二、動態密碼是資訊技術層面上有效防禦方式。三、信用卡較安全。四、網路使用者必須時時注意自己個人資料。五、大型公司有資訊安全的能力，並要負起一定的責任。建議未來研究者，可以針對各類型的網路釣魚進行獨立的研究，減少網路釣魚定義龐雜的問題、改以網路釣魚釣客的角度進行研究；以實際釣魚活動去解釋網路釣魚犯罪是本研究一項嘗試，建議未來研究可以繼續擴張、創新、並找出解釋力更加的理論。建議未來的研究，研究設計中應加入時間的因素，如此才能讓網路釣魚被害的因果關係更清晰。

關鍵字

網路釣魚被害 ； 個人資料 ； 被害者學 ； 釣魚行為

並列摘要

Phishing targets personal information such as account password or other personal information. It is a form of internet fraud. The method of the crime may be uses of malicious programs, false internet sites or non-technical methods. This research discussed phishing from a victim viewpoint and discusses Routine Activity Theory, Lifestyle-Exposure Theory, Risk Assessment in Victimology to explore phishing. Phishing can be done without any contact between the convict and the victim. It is different from the usual Victimology. Thus, the research uses general Victimology and real case fishing from the real world to make up for the insufficiency of the Victimology theory.
The research was done as online surveys with purposive sampling of nonrandom sampling. The researchers put up postings on ptt survey forum, internet auction forum, and discussion forum on other websites for people to fill out to increase publicity. They also searched for victims that shared their experiences online and ask them to fill out the survey. The research used a pre-test method for validity. It went through two modifications to get a decent validity. The final sample was 363.
The researched showed the victims have a few characteristics. They were young, with low education, with low income, students, spent more days online during the week, played online games and blog. This conformed to the Lifestyle-Exposure Theory. The theories chosen in this research showed regression in logistic. We found that in Routine Activity Theory, suitable targets and phishing had a significant relationship. It meant the more one avoid having personal information as the ideal target, the less likely he/she would become a victim of phishing. The research also had other findings and hypothesis-testing as following: (1) victims showed fear of crime, comparing to those with no victim experience, they pay more attention to their personal information. (2). Most internet users value the security of their personal information. (3). Internet users trust large companies. (4). Accounts and password involved money are more likely to become targets (internet auction, online games). (5). Credit cards are safer.
This research suggests prevention for phishing: (1). Educate phishing prevention. (2). One-Time Password (OTP) is an effective method on information technology level. (3). Credit cards are safer. (4). Internet users must watch out for their personal information at all times. (5). Large companies have the ability to secure information and be responsible for the safety.The research advices future researchers to target different types of phishing which reduce the problems on defining phishing. Studies done from a phisher point of view and use actual fishing activities to explain phishing is an attempt of this research. It is recommended to continue to expand and innovate and find a stronger explanatory theory, and recommendations for future studies. The design of the studies should incorporate time factor in order to clarify the cause and effect of phishing victimology.

並列關鍵字

phishing victimization ； personal information ； victimology ； fishing

參考文獻

邱萬敦，2004，《漁法初論》。臺中：翠柏林企業股份有公司。

蘇健華，2007，〈Web2.0發展介紹〉。《資訊社會研究》，13：頁1-124。

李政忠，2004，〈網路調查所面臨的問題與解決建議〉。《資訊社會研究》，6： 1-24。

傅仰止，2001，〈網路人口的樣本特性：比較網頁調查追蹤方法與個人網路抽樣方法〉。《調查研究》，9：35-72。

林逢慶， 2005，〈建立我國通資訊基礎建設安全機制計畫推動現況與展望〉。《研考雙月刊》，29（1）： 35-45。