Jason Polakis and Sotiris Ioannidis, FORTH-ICS, Greece; Marco Lancini, Federico Maggi, and Stefano Zanero, Politecnico di Milano, Italia; Georgios Kontaxis and Angelos D. Keromytis, Columbia University, USA

Outline Introduction How Social Authentication Works Advantages and Shortcomings Attack Surface Estimation Breaking Social Authentication Face Recognition as a Service Experimental Evaluation Remediation and Limitations Conclusions

Introduction Facebook reports over 900 million active users as of March In 2011, Facebook has released a two-factor authentication mechanism, referred to as Social Authentication.

How Social Authentication Works Friend list A user must have at least 50 friends. Tagged photos The user’s friend must be tagged in an adequate number of photos. Face SA tests must be solvable by humans within the 5 minute (circa) time window enforced by Facebook. Triggering the user logs in from a different geographical location. uses a new device for the first time to access his account.

Advantages and Shortcomings Advantages Facebook’s SA is less cumbersome, especially because users have grown accustomed to tagging friends in photos. Shortcomings The number of friends can influence the applicability and the usability of SA. Their friends have erroneously tagged for fun or as part of a contest which required them to do so. Bypass the SA test by providing their date of birth.

Attack Surface Estimation The attacker has compromised the user’s credential. Facebook designed SA as a protection mechanism against strangers. we provide an empirical calculation of the probabilities of each phase of our attack. P(F) = 47% of the user’s have their friends list public. P(P) = 71% of them (236,752) exposed at least one public photo album. Attacker can try to befriend the friends of his victim to gain access to their private photos with a chance of P(B) ≃ 70% to succeed.

Attack Surface Estimation (Cont.)

Breaking Social Authentication Step 1: Crawling Friend List Python’s urllib HTTP library and regular expression MongoDB database GridFS filesystem Step 2: Issuing Friend Requests Step 3: Photo Collection/Modeling Photo collection Face Extraction and Tag Matching – OpenCV toolkit Facial Modeling – sklearn library Step 4: Name Lookup

Breaking Social Authentication

Face Recognition as a Service Face.com was recently acquired by Facebook. The service exposes an API through which developers can supply a set of photos to use as training data and then query the service with a new unknown photo for the recognition of known individuals. faces.detect – identify any existing faces tags.save - to label the good photos with the respective UIDs of their owners face.train faces.recongnize

Experimental Evaluation Overall Dataset

Experimental Evaluation (Cont.) Breaking SA: Determined Attacker shows the number of pages solved correctly out of 7.

Experimental Evaluation (Cont.) Breaking SA: Determined Attacker shows the CPU-time required to solve the full test

Breaking SA: Casual Attacker Implementation 11 dummy accounts play the role of victims. Selenium – login these account in a automated fashion. Tor - take advantage of the geographic dispersion of its exit nodes. face.com – solved SA test Result 22% (28/127) of tests solved 5-7 of the 7 test pages. 56% (71/127) of tests solved 3-4 of the 7 test pages. 44 seconds on average

Breaking SA: Casual Attacker (Cont.) In about 25% of the photos face.com was unable to detect a human face. in 50% of the photos face.com was able to detect a human face but marked it as unrecognizable. in the last 25% of the photos a face was detected but did not match any of the faces in our training set.

Ethical Consideration We never took advantage of accepted requests to collect photos or other private information otherwise unavailable; we solely collected public photos.

Compromise Prevention Users can add certain devices to a list of recognized, trusted devices. a user who fails to complete an SA challenge is redirected to an alert page, upon the next successful login, which reports the attempted login.

Slowing Sown Attacker CAPTCHAs may create a technical obstacle to automated attacks, but they should not be considered a definitive countermeasure. The presence of suggested names in SA tests is the major disadvantage of the current implementation as it greatly limits the search space for adversaries.

Conclusions on average, 42% of the data used to generate the second factor, thus, gaining the ability to identify randomly selected photos of the victim’s friends. Given that information, we managed to solve 22% of the real Facebook SA tests presented to us during our experiments and gain a significant advantage to an additional 56% of the tests with answers for more than half of pages of each test.