All Your Contacts Are Belong to Us: Automated Identity Theft Attacks on Social Networks Export

@inproceedings{www200956, abstract = {Social networking sites have been increasingly gaining popularity. Well-known sites such as Facebook have been reporting growth rates as high as 3\% per week [5]. Many social networking sites have millions of registered users who use these sites to share photographs, contact long-lost friends, establish new business contacts and to keep in touch. In this paper, we investigate how easy it would be for a potential attacker to launch automated crawling and identity theft attacks against a number of popular social networking sites in order to gain access to a large volume of personal user information. The ?rst attack we present is the automated identity theft of existing user pro?les and sending of friend requests to the contacts of the cloned victim. The hope, from the attacker?s point of view, is that the contacted users simply trust and accept the friend request. By establishing a friendship relationship with the contacts of a victim, the attacker is able to access the sensitive personal information provided by them. In the second, more advanced attack we present, we show that it is effective and feasible to launch an automated, cross-site pro?le cloning attack. In this attack, we are able to automatically create a forged pro?le in a network where the victim is not registered yet and contact the victim?s friends who are registered on both networks. Our experimental results with real users show that the automated attacks we present are effective and feasible in practice.}, author = {Bilge, Leyla and Strufe, Thorsten and Balzarotti, Davide and Kirda, Engin}, booktitle = {18th International World Wide Web Conference}, citeulike-article-id = {4416811}, citeulike-linkout-0 = {http://www2009.eprints.org/56/}, keywords = {facebook, social-networking}, pages = {551--560}, posted-at = {2009-04-28 20:55:43}, priority = {0}, title = {All Your Contacts Are Belong to Us: Automated Identity Theft Attacks on Social Networks}, url = {http://www2009.eprints.org/56/}, year = {2009} }

TY - CONF ID - www200956 L3 - citeulike-article-id:4416811 N2 - Social networking sites have been increasingly gaining popularity. Well-known sites such as Facebook have been reporting growth rates as high as 3% per week [5]. Many social networking sites have millions of registered users who use these sites to share photographs, contact long-lost friends, establish new business contacts and to keep in touch. In this paper, we investigate how easy it would be for a potential attacker to launch automated crawling and identity theft attacks against a number of popular social networking sites in order to gain access to a large volume of personal user information. The ?rst attack we present is the automated identity theft of existing user pro?les and sending of friend requests to the contacts of the cloned victim. The hope, from the attacker?s point of view, is that the contacted users simply trust and accept the friend request. By establishing a friendship relationship with the contacts of a victim, the attacker is able to access the sensitive personal information provided by them. In the second, more advanced attack we present, we show that it is effective and feasible to launch an automated, cross-site pro?le cloning attack. In this attack, we are able to automatically create a forged pro?le in a network where the victim is not registered yet and contact the victim?s friends who are registered on both networks. Our experimental results with real users show that the automated attacks we present are effective and feasible in practice. EP - 560 TI - All Your Contacts Are Belong to Us: Automated Identity Theft Attacks on Social Networks T2 - 18th International World Wide Web Conference SP - 551 KW - facebook KW - social-networking AU - Bilge, Leyla AU - Strufe, Thorsten AU - Balzarotti, Davide AU - Kirda, Engin PY - 2009/// UR - http://www2009.eprints.org/56/ ER -