Guided socialbots: Infiltrating the social networks of specific organizations’ employees

Abstract

A dimension of the Internet that has gained great popularity in recent years is the platform of online social networks (OSNs). Users all over the world write, share, and publish personal information about themselves, their friends, and their workplaces within this platform of communication. In this study we demonstrate the relative ease of creating malicious socialbots that act as social network “friends”, resulting in OSN users unknowingly exposing potentially harmful information about themselves and their places of employment. We present an algorithm for infiltrating specific OSN users who are employees of targeted organizations, using the topologies of organizational social networks and utilizing socialbots to gain access to these networks. We focus on two well-known OSNs – Facebook and Xing – to evaluate our suggested method for infiltrating key-role employees in targeted organizations. The results obtained demonstrate how adversaries can infiltrate social networks to gain access to valuable, private information regarding employees and their organizations.

Keywords

Socialbots social networks security and privacy organization mining Facebook Xing

Get full access to this article

View all access options for this article.

References

[1]

Balduzzi,

Platzer,

Holz,

Kirda,

Balzarotti and

Kruegel, Abusing social networks for automated user profiling, in: Recent Advances in Intrusion Detection, Springer, 2010, pp. 422–441.

[2]

Baltazar,

Costoya and

Flores, The real face of KOOBFACE: The largest Web 2.0 botnet explained, Trend Micro Research 5(9) (2009), 10.

[3]

S.B.

Barnes, A privacy paradox: Social networking in the United States, First Monday 11(9) (2006).

[4]

Benevenuto,

Magno,

Rodrigues and

Almeida, Detecting spammers on Twitter, in: Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference (CEAS), Vol. 6, 2010, p. 12.

[5]

Bilge,

Strufe,

Balzarotti and

Kirda, All your contacts are belong to us: Automated identity theft attacks on social networks, in: Proceedings of the 18th International Conference on World Wide Web, ACM, 2009, pp. 551–560.

[6]

Bonneau,

Anderson and

Danezis, Prying data out of a social network, in: International Conference on Advances in Social Network Analysis and Mining, 2009, ASONAM’09, IEEE, 2009, pp. 249–254.

[7]

Boshmaf,

Muslukhov,

Beznosov and

Ripeanu, The socialbot network: When bots socialize for fame and money, in: Proceedings of the 27th Annual Computer Security Applications Conference, ACM, 2011, pp. 93–102.

[8]

Boshmaf,

Muslukhov,

Beznosov and

Ripeanu, Design and analysis of a social botnet, Computer Networks 57(2) (2013), 556–578.

[9]

D.M.

Boyd and

N.B.

Ellison, Social network sites: Definition, history, and scholarship, Journal of Computer-Mediated Communication 13(1) (2007), 210–230.

10.

[10]

Cao,

Sirivianos,

Yang and

Pregueiro, Aiding the detection of fake accounts in large scale social online services, in: Proc. NSDI, 2012.

11.

[11]

Cha,

Mislove and

K.P.

Gummadi, A measurement-driven analysis of information propagation in the Flickr social network, in: Proceedings of the 18th International Conference on World Wide Web, ACM, 2009, pp. 721–730.

12.

[12]

D.H.

Chau,

Pandit,

Wang and

Faloutsos, Parallel crawling for online social networks, in: Proceedings of the 16th International Conference on World Wide Web, ACM, 2007, pp. 1283–1284.

13.

[13]

Cheng,

Dale and

Liu, Statistics and social network of YouTube videos, in: 16th International Workshop on Quality of Service, 2008, IWQoS 2008, IEEE, 2008, pp. 229–238.

14.

[14]

Chu,

Gianvecchio,

Wang and

Jajodia, Who is tweeting on Twitter: Human, bot, or cyborg?, in: Proceedings of the 26th Annual Computer Security Applications Conference, ACM, 2010, pp. 21–30.

15.

[15]

J.A.

Diaz,

R.A.

Griffith,

J.J.

Ng,

S.E.

Reinert,

P.D.

Friedmann and

A.W.

Moulton, Patients’ use of the Internet for medical information, Journal of General Internal Medicine 17(3) (2002), 180–185.

16.

[16]

Elovici,

Fire,

Herzberg and

Shulman, Ethical considerations when employing fake identities in online social networks for research, Science and Engineering Ethics, 2013, pp. 1–17.

17.

[17]

Elyashar,

Fire,

Kagan and

Elovici, Organizational intrusion: Organization mining using socialbots, in: 2012 International Conference on Social Informatics, Lausanne, Switzerland, 2012.

18.

[18]

Elyashar,

Fire,

Kagan and

Elovici, Homing socialbots: Intrusion on a specific organization’s employee using socialbots, in: SNAA – Social Network Analysis in Applications 2013, Niagara Falls, ON, Canada, 2013.

19.

[19]Facebook, Newsroom – One billion – Key metrics, September 2013, available at: http://newsroom.fb.com/imagelibrary/downloadmedia.ashx?MediaDetailsID=4227&SizeId=-1; last accessed on 4 January, 2014.

20.

[20]Facebook Company Filings, June 2013, available at: http://www.sec.gov/Archives/edgar/data/1326801/000119312512325997/d371464d10q.htm.

21.

[21]Facebook Newsroom, September 2013, available at: http://newsroom.fb.com/Key-Facts/; last accessed on 2 May, 2014.

22.

[22]

Fire,

Goldschmidt and

Elovici, Online social networks: Threats and solutions survey, Communications Surveys & Tutorials, IEEE 16(4) (2014), 2019–2036.

23.

[23]

Fire,

Kagan,

Elyashar and

Elovici, Friend or Foe? Fake profile identification in online social networks, Social Network Analysis and Mining 4(1) (2014), 1–23.

24.

[24]

Fire,

Katz and

Elovici, Strangers intrusion detection – Detecting spammers and fake profiles in social networks based on topology anomalies, HUMAN 1(1) (2012), 26.

25.

[25]

Fire,

Puzis and

Elovici, Organization mining using online social networks, Preprint, 2013, available at: arXiv:1303.3741.

26.

[26]

Ghosh,

Viswanath,

Kooti,

N.K.

Sharma,

Korlam,

Benevenuto,

Ganguly and

K.P.

Gummadi, Understanding and combating link farming in the Twitter social network, in: Proceedings of the 21st International Conference on World Wide Web, ACM, 2012, pp. 61–70.

27.

[27]

E.F.

Gross, Adolescent Internet use: What we expect, what teens report, Journal of Applied Developmental Psychology 25(6) (2004), 633–649.

28.

[28]

Kostka,

Y.A.

Oswald and

Wattenhofer, Word of mouth: Rumor dissemination in social networks, in: Structural Information and Communication Complexity, Springer, 2008, pp. 185–196.

29.

[29]

Kwak,

Lee,

Park and

Moon, What is Twitter, a social network or a news media?, in: Proceedings of the 19th International Conference on World Wide Web, ACM, 2010, pp. 591–600.

30.

[30]

Lee,

Caverlee and

Webb, Uncovering social spammers: Social honeypots + machine learning, in: Proceedings of the 33rd International ACM SIGIR Conference on Research and Development in Information Retrieval, ACM, 2010, pp. 435–442.

31.

[31]

Lenhart,

Purcell,

Smith and

Zickuhr, Social media & mobile internet use among teens and young adults. Millennials, Pew Internet & American Life Project, 2010.

32.

[32]

Liben-Nowell,

Novak,

Kumar,

Raghavan and

Tomkins, Geographic routing in social networks, Proceedings of the National Academy of Sciences of the United States of America 102(33) (2005), 11623–11628.

33.

[33]

Lindamood,

Heatherly,

Kantarcioglu and

Thuraisingham, Inferring private information using social network data, in: Proceedings of the 18th International Conference on World Wide Web, ACM, 2009, pp. 1145–1146.

34.

[34]

Liu,

K.P.

Gummadi,

Krishnamurthy and

Mislove, Analyzing Facebook privacy settings: User expectations vs. reality, in: Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference, ACM, 2011, pp. 61–70.

35.

[35]

Mahmood, Online social networks: Privacy threats and defenses, in: Security and Privacy Preserving in Social Networks, Springer, 2013, pp. 47–71.

36.

[36]

Manning, The impacts of online social networking and internet use on human communication and relationships.

37.

[37]

Mislove,

H.S.

Koppula,

K.P.

Gummadi,

Druschel and

Bhattacharjee, Growth of the Flickr social network, in: Proceedings of the First Workshop on Online Social Networks, ACM, 2008, pp. 25–30.

38.

[38]

Mislove,

Viswanath,

K.P.

Gummadi and

Druschel, You are who you know: Inferring user profiles in online social networks, in: Proceedings of the Third ACM International Conference on Web Search and Data Mining, ACM, 2010, pp. 251–260.

39.

[39]

Nekovee,

Moreno,

Bianconi and

Marsili, Theory of rumour spreading in complex social networks, Physica A: Statistical Mechanics and Its Applications 374(1) (2007), 457–470.

40.

[40]

O’cass and

Fenech, Web retailing adoption: Exploring the nature of Internet users web retailing behaviour, Journal of Retailing and Consumer services 10(2) (2003), 81–94.

41.

[41]Our list of the World’s Largest Social Networks shows how video, messages, and China are taking over the social web, December 2013, available at: http://www.businessinsider.com/the-worlds-largest-social-networks-2013-12; last accessed on 3 June, 2014.

42.

[42]

Peterson and

K.A.

Siek, Analysis of information disclosure on a social networking site, in: Online Communities and Social Computing, Springer, 2009, pp. 256–264.

43.

[43]

Ratkiewicz,

Conover,

Meiss,

Gonçalves,

Flammini and

Menczer, Detecting and tracking political abuse in social media, in: Fifth International AAAI Conference on Weblogs and Social Media (ICSWM), 2011.

44.

[44]

Ratkiewicz,

Conover,

Meiss,

Gonçalves,

Patil,

Flammini and

Menczer, Truthy: Mapping the spread of AstroTurf in microblog streams, in: Proceedings of the 20th International Conference Companion on World Wide Web, ACM, 2011, pp. 249–252.

45.

[45]

Ryan, Getting in bed with Robin Sage, in: Black Hat Conference, 2010.

46.

[46]

Stein,

Chen and

Mangla, Facebook immune system, in: Proceedings of the 4th Workshop on Social Network Systems, ACM, 2011, p. 8.

47.

[47]

Stringhini,

Kruegel and

Vigna, Detecting spammers on social networks, in: Proceedings of the 26th Annual Computer Security Applications Conference, ACM, 2010, pp. 1–9.

48.

[48]

Stringhini,

Wang,

Egele,

Kruegel,

Vigna,

Zheng and

B.Y.

Zhao, Follow the green: Growth and dynamics in Twitter follower markets, in: Proceedings of the 2013 Conference on Internet Measurement Conference, ACM, 2013, pp. 163–176.

49.

[49]The Economic impact of cybercrime and cyber espionage, McAfee, 2013.

50.

[50]Tweaking Social Networks, August 2010, available at: http://tweakingsocialnetworks.wordpress.com/tag/bookmark-unconfirmed-contacts-in-xing/.

51.

[51]

Ugander,

Karrer,

Backstrom and

Marlow, The anatomy of the Facebook social graph, Preprint, 2011, available at: arXiv:1111.4503.

52.

[52]

Wagner,

Mitter,

Körner and

Strohmaier, When social bots attack: Modeling susceptibility of users in online social networks, 2012.

53.

[53]

R.E.

Wilson,

S.D.

Gosling and

L.T.

Graham, A review of Facebook research in the social sciences, Perspectives on Psychological Science 7(3) (2012), 203–220.

54.

[54]

Wolak,

Finkelhor,

K.J.

Mitchell and

M.L.

Ybarra, Online ‘predators’ and their victims, Psychology of Violence 1 (2010), 13–35.

55.

[55]Xing Corporate Pages, August 2013, available at: https://corporate.xing.com/no_cache/english/company/xing-ag/.

56.

[56]

M.L.

Ybarra and

K.J.

Mitchell, How risky are social networking sites? A comparison of places online where youth sexual solicitation and harassment occurs, Pediatrics 121(2) (2008), e350–e357.