Using Social Networks to Harvest Addresses Reporter: Chia-Yi Lin Advisor: Chun-Ying Huang Mail: 9/14/2015 1

Reference I. Polakis, G. Kontaxis, S. Antonatos, E. Gessiou, T. Petsas, and E. P. Markatos, “Using social networks to harvest addresses,” in WPES ’10: Proceedings of the 9th annual ACM workshop on Privacy in the electronic society 9/14/2015 2

Outline Introduction Social network harvest Facebbok informaition Conclusions 9/14/2015 3

Introduction Social networking is one of the most popular Internet activities ▫Facebook has more than 400 million users ▫Twitter has more than 40 million users Privacy leakage is one of the biggest problems of social networking 9/14/2015 4

9/14/2015 5

Social network Used for malicious purposes ▫name, nickname  How names extracted from social networks ▫harvest addresses Names collected ▫Facebook and Twitter networks Query terms for the Google search engine ▫harvest almost 9 million unique 9/14/2015 6

Current Methodologies Give a brief overview of the current methodologies used by spammers to harvest addresses ▫Web crawling ▫Crawling mailing list archives sites ▫Malware ▫Malicious sites ▫Dictionary attacks 9/14/2015 7

Two approaches Present two different approaches to harvesting ▫Blind harvesting ▫Targeted harvesting Social network ▫Facebbok and Twitter Google search engine ▫gather addresses Facebook ▫personal information 9/14/2015 8

Find name and nickname Crawlers for extracting names ▫Facebook  fan pages ▫Twitter  crawled the accounts the user follows 9/14/2015 9

Google search engine Once the names have been harvested ▫8 different combinations  "term“, "term at “, ▫retrieve the first 50 results ▫parse the two-line summary provided 9/14/

Blind Harvesting (1/2) Able to harvest, on average ▫45 s per name for the Facebook names ▫25 s per name for the Twitter nicknames 9/14/

Blind Harvesting (2/2) Dictionary : Surnames: 9/14/

Targeted harvesting (1/3) Traditional phishing contain generic terms ▫“Dear user”, ”Dear customer”, ”Hello subscriber” Personalized phishing ▫ look like they originate from a friend 9/14/

Targeted harvesting (2/3) Use the harvested addresses in the Facebook search utility ▫gain profile The first technique ▫Uses information from the Facebook network  Successfully link 11.5% of the harvested names with their actual address The second technique ▫Uses information from the Twitter network  43.4% of the profiles returned 9/14/

Targeted harvesting (3/3) The third technique ▫collected from other social networks ▫harvest profiles from Google Buzz  40.5% valid Gmail addresses 9/14/

Fetch name Method ▫facebook app ▫friend 9/14/

Permissions Read Permissions Write Permissions Page Permissions 9/14/

Basic profile 9/14/

9/14/

Facebook profile 9/14/

Content categorization 9/14/

Conclusions We present how information, that is publicly available in social networking sites ▫for harvesting addresses ▫deploying personalized phishing campaigns We present two different approaches to harvesting ▫greatly enhance the efficiency of a spam campaign 9/14/

Thanks for Your Attention Q & A 9/14/