2009 Eighth International Conference on Networks 1 Speaker : Chang, Kun-Hsiang

Outline Abstract APPLICATION TRUST ATTACK PROFILING SECURITY LEAKS 2

Abstract We created a Facebook application for demonstration purposes that on the surface is a simple application, but on the background it collects useful data, making it easy to attack against the user with malicious programs, showing the risks that these platform scan expose their users to. 3

4 NIELSEN’S TOP TEN SOCIAL NETWORKS (USA), APRIL 2008

APPLICATION TRUST application can spread through hundreds of users, attacker could easily take ad-vantage of. 5

ATTACK PROFILING In our work, we used the Attack API [2], which can be used very easily in order to scan open ports of a host and it provides the following function to scan hosts returning the open/closed status of the port being scanned. 6

ATTACK PROFILING At t a ckAPI. P o r t S c a n n e r. s c a n P o r t ( c a l l b a c k, t a r g e t, p o r t s [ i n d e x ], t ime o u t ) ; 7

ATTACK PROFILING 8

SECURITY LEAKS was because it is written in Javascript which is executed by the client, not the server doesn’t show his identityand the attack is made by an approved and authenticated application using Javascript less malicious traffic is made by the server, lowering its payload as well as the hiding the fingerprint of a possible attack 9

10