Information Attacks on Online Social Networks

Abstract

Online social networks have changed the way people interact, allowing them to stay in touch with their acquaintances, reconnect with old friends, and establish new relationships with other people based on hobbies, interests, and friendship circles. Unfortunately, the regrettable concurrence of the users' carefree attitude in sharing information, the often sub-par security measures from the part of the system operators and, eventually, the high value of the published information make online social networks an interesting target for crackers and scammers alike. The information contained can be used to trigger attacks to even more sensible targets and the ultimate goal of sociability shared by the users allows sophisticated forms of social engineering inside the system. This work reviews some typical social attacks that are conducted on social networking systems, carrying real-world examples of such violations and analysing in particular the weakness of password mechanisms. It then presents some solutions that could improve the overall security of the systems.

Strong password? Not with your social network data!

“…As it was demonstrated in the experiment, the use of personal information collected from the Facebook accounts of the participants, allowed to increase highly the possibility to decipher the passwords, accepting H2, and saying that the use of custom dictionaries based on personal information collected from social networks enhance the success rate of the password deciphering. These results fit with previous research (Franchi et al, 2014;Halevi et al, 2013;Haque et al, 2013;Madejski et al, 2012).…”

“…Social networks allow users to present themselves through a profile, connect with others, and publish social content (Franchi, Poggi, & Tomaiuolo, 2014). Due to the vast amount of information users publish on social networks, these platforms both aggregate and display a wealth of valuable information about users and their activity including location, social circles, political positions, and even sexual preferences that can be exploited by various hostile and malicious players (Beato, De Cristofaro, & Rasmussen, 2014).…”

“…Due to the vast amount of information users publish on social networks, these platforms both aggregate and display a wealth of valuable information about users and their activity including location, social circles, political positions, and even sexual preferences that can be exploited by various hostile and malicious players (Beato, De Cristofaro, & Rasmussen, 2014). Seemingly, trivial information such as name, location, and age are enough for a hacker to locate the personal profile of more than half the American population (Franchi et al, 2014). They found, that although users are aware of the fact that their profiles and information are public, most tighten their security settings only after a problem occurs, often ignoring the potential future damage that might be caused by their published information.…”

“…Social engineering has always been a security threat, employing psychological manipulation to drive victims to take actions that are harmful to themselves. This is very much like traditional fraud, only in this case attackers exploit the virtual space to gain access to confidential information (Franchi et al, 2014). The proliferation of social networks and the tremendous amount of users' personal information found there makes these an attractive target for malicious users interested in this sort of attack.…”

“…H1 -Because of the need to remember the passwords, users tend to embed in their password personal information, which they know and it is easy to recall (Al-Wehaibi et al, 2011;Franchi et al, 2014;Madejski, Johnson, & Bellovin, 2012).…”