Automated Social Engineering Attacks in OSNs

Laboratory for Education and Research in Secure Systems Engineering (LERSSE)

Networked Systems Laboratory (NetSysLab)

Department of Electrical & Computer Engineering

Automated Social Engineering Automated Social Engineering Attacks in OSNsAttacks in OSNs

Yazan BoshmafYazan BoshmafKonstantin BeznosovKonstantin Beznosov

Matei RipeanuMatei Ripeanu

Laboratory for Education and Research in Secure Systems Engineering (LERSSE)Networked Systems Laboratory (NetSysLab)

The Not-So-Private Social Web.Or, Web 2.0

2


Facebook: Sharing

3

Facebook Archives. http//www.facebook.com

Social Attributes Demographics Preferences


Facebook: Sharing

4

Social Structure Friends Mutual Friends

Facebook Archives. http//www.facebook.com


Facebook: Public Access

5

Whoops!Whoops!

Sample!Sample!


Facebook: Privacy Evolution

6

MCKEON, M. The evolution of privacy in Facebook. http://mattmckeon.com.facebook-privacy



7




8




9




10




11



That’s Natural! People Want to Be Visible.

Or Not?

12


Automated Cross-Site ID Theft

13

Bilge, L., Strufe, T., Balzarotti, D., and Kirda, E. All your contacts are belong to us: automated identity theft attacks on social networks. In WWW ’09



14




15


From Facebook



16


Sample!Sample!

Why did it work?


Context-Aware Spam

17

Brown, G., Howe, T., Ihbe, M., Prakash, A., and Borders, K. Social networks and context-aware spam. In CSCW 2008


Social Phishing

18

Jagatic, T. N., Johnson, N. A., Jakobsson, M., and Menczer, F. Social phishing. Communications ACM 2007


Oh, Adversaries Like OSNs!

19


Web Applications Attacks

20

Evron, G. New Facebook worm warning: Wanna see somethong hot? http://darkreading.com/blog/archives/2009/11/new_facebook_wo.html


Can be Turned into a Botnet!

21

Anthanasopolous, E., Makridakias, A., Antonatos, S., Antoniades, D., Ioannidis, S., Anagnostakis, K. G., and Markatos, E. P. Antisocial networks: Turning a social network into a botnet. In ISC ’08


Koobface Botnet

22

TrendMicro. The real face of koobface. Technical report 2009


Social Engineering Exploits Relationships and Trust

23


Research Questions

24

Mwahaha!Mwahaha!


How Many Attacker Did You Befriend Today?

25


The Attack - Before

26


The Attack - Crawling

27

TargetAdversary


The Attack - Ranking

28

TargetAdversary

6

2

8

5

1

7 4

3


The Attack - Infiltrating

29

TargetAdversary

6

2

8

5

1

7 4

3



30

TargetAdversary

6

2

8

5

1

7 4

3



31

TargetAdversary

6

2

8

5

1

7 4

3



32

TargetAdversary

6

2

8

5

1

7 4

3


The Attack - After

33

6

2

8

5

1

7 4

3

TargetAdversary


The Attack - After

34

TargetAdversary


What Does The Adversary Have?

35


A Network of “Trust”

36

TargetAdversary


Surveillance

37

TargetAdversary


Global Surveillance

38


Amplified Social Engineering

39

TargetAdversary

Sarah, the Pool event last week was

awesome!

Sarah, the Pool event last week was

awesome!

Yeah, I posted the picture! Will send you a

link soon.

Yeah, I posted the picture! Will send you a

link soon.

Aha!Aha!


Mitigation: The Wisdom of Crowd

40


Towards Social Collaborative Security

41

Hey Kosta, check out this link

http://www.malicous.com



Looks malicious!

Looks malicious!


Towards Social Collaborative Security

42

Social Network Collaboration Network





Hey all, this link is malicious


Hey all, this link is malicious


?Looks

malicious!Looks

malicious!


The Big Picture

• Vulnerability: Authenticity of online relationships + public

information• Things to evaluate:

The attack in real-settings (Now, simulation-only). Usability and expressiveness of privacy controls vs.

privacy implications realized by users.• Identified issues:

How can social networking sites, or OSNs, distinguish between fake and real online identities (Social Sybil Nodes)?

• Future work: Social Collaborative Security (threat identification,

opinion mining, reasoning, alert diffusion, etc.)

43


lersse.ece.ubc.ca

44


Backup

45


Evaluation (Simulation)

46


47

Automated Social Engineering Attacks in OSNs

Documents

Transcript of Automated Social Engineering Attacks in OSNs