Dialing Back Abuse on Phone Verified Accounts

Thomas, Kurt; Iatskiv, Dmytro; Bursztein, Elie; Pietraszek, Tadek; Grier, Chris; McCoy, Damon

doi:10.1145/2660267.2660321

Cited by 30 publications

(17 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To maximize profits, fraudsters have to share/multiplex different resources (e.g., fake accounts, IP addresses, and device IDs) over multiple frauds. For example, [13] found that many users are associated with a particular group of followers on Twitter; [36] identified that many cases of phone number reuse; [4] observed that the IP addresses of many spam proxies and scam hosts fall into a few uniform ranges; and [38] revealed that fake accounts often conduct fraudulent activities over a short time period.…”

Section: Background 21 Economics Of Fraudstersmentioning

confidence: 99%

No Place to Hide: Catching Fraudulent Entities in Tensors

Ban

Liu

Ling³

et al. 2019

The World Wide Web Conference

View full text Add to dashboard Cite

Many approaches focus on detecting dense blocks in the tensor of multimodal data to prevent fraudulent entities (e.g., accounts, links) from retweet boosting, hashtag hijacking, link advertising, etc. However, no existing method is effective to find the dense block if it only possesses high density on a subset of all dimensions in tensors. In this paper, we novelly identify dense-block detection with dense-subgraph mining, by modeling a tensor into a weighted graph without any density information lost. Based on the weighted graph, which we call information sharing graph (ISG), we propose an algorithm for finding multiple densest subgraphs, D-Spot, that is faster (up to 11x faster than the state-of-the-art algorithm) and can be computed in parallel. In an N-dimensional tensor, the entity group found by the ISG+D-Spot is at least 1/2 of the optimum with respect to density, compared with the 1/N guarantee ensured by competing methods. We use nine datasets to demonstrate that ISG+D-Spot becomes new state-of-the-art dense-block detection method in terms of accuracy specifically for fraud detection. CCS CONCEPTS• Information systems → Wrappers (data mining).

show abstract

Section: Background 21 Economics Of Fraudstersmentioning

confidence: 99%

No Place to Hide: Catching Fraudulent Entities in Tensors

Ban

Liu

Ling³

et al. 2019

The World Wide Web Conference

View full text Add to dashboard Cite

show abstract

“…We categorize related work into two categories: underground market studies and fraud detection approaches. Underground Markets: Prior works have shown the use of fake accounts for followers in social media [21], phone-verified email accounts [20], Facebook likes [3], etc. These accounts are often used to spread spam [8,7] and misinformation [9,10].…”

Section: Related Workmentioning

confidence: 99%

The Many Faces of Link Fraud

Shah

Lamba

Beutel

et al. 2017

2017 IEEE International Conference on Data Mining (ICDM)

View full text Add to dashboard Cite

Most past work on social network link fraud detection tries to separate genuine users from fraudsters, implicitly assuming that there is only one type of fraudulent behavior. But is this assumption true? And, in either case, what are the characteristics of such fraudulent behaviors? In this work, we set up honeypots, ("dummy" social network accounts), and buy fake followers (after careful IRB approval). We report the signs of such behaviors including oddities in local network connectivity, account attributes, and similarities and differences across fraud providers. Most valuably, we discover and characterize several types of fraud behaviors. We discuss how to leverage our insights in practice by engineering strongly performing entropy-based features and demonstrating high classification accuracy. Our contributions are (a) instrumentation: we detail our experimental setup and carefully engineered data collection process to scrape Twitter data while respecting API rate-limits, (b) observations on fraud multimodality: we analyze our honeypot fraudster ecosystem and give surprising insights into the multifaceted behaviors of these fraudster types, and (c) features: we propose novel features that give strong (>0.95 precision/recall) discriminative power on ground-truth Twitter data.

show abstract

“…Even though the latest version of Waze app requires SMS verification to register accounts, attackers can use older versions of APIs to create accounts without verification. Alternatively, accounts can be verified through disposable phone/SMS services [44].…”

Section: Factors Limiting Sybil Creationmentioning

confidence: 99%

Defending against Sybil Devices in Crowdsourced Mapping Services

Wang

et al. 2016

Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services

View full text Add to dashboard Cite

Real-time crowdsourced maps such as Waze provide timely updates on traffic, congestion, accidents and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. We propose a new approach to defend against Sybil devices based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, colocation edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and discuss how they can be used to dramatically reduce the impact of attacks against crowdsourced mapping services. of this attack against our own vehicles, quantifying the accuracy of the attack against GPS coordinates. Magnified by an army of ghost riders, an attacker can potentially track the constant whereabouts of millions of users, all without any risk of detection. Defenses.Prior proposals to address the location authentication problem have limited appeal, because of reliance on widespread deployment of specialized hardware, either as part of physical infrastructure, i.e., cellular base stations, or as modifications to mobile devices themselves. Instead, we propose a practical solution that limits the ability of Sybil devices to amplify the potential damage incurred by any single attacker. We introduce collocation edges, authenticated records that attest to the one-time physical proximity of a pair of mobile devices. The creation of collocation edges can be triggered opportunistically by the mapping service, e.g., Waze. Over time, collocation edges combine to form large proximity graphs, network structures that attest to physical interactions between devices. Since ghost riders cannot physically interact with real devices, they cannot form direct edges with real devices, only indirectly through a small number of real devices operated by the attacker. Thus, the edges between an attacker and the rest of the network are limited by the number of real physical devices she has, regardless of how many ghost riders are under her control. This reduces the problem of detecting ghost riders to a community detection problem on the proximity graph (The graph is seeded by a small number of trusted infrastructure locations).Our paper includes these key contributions:

show abstract

Dialing Back Abuse on Phone Verified Accounts

Cited by 30 publications

References 15 publications

No Place to Hide: Catching Fraudulent Entities in Tensors

No Place to Hide: Catching Fraudulent Entities in Tensors

The Many Faces of Link Fraud

Defending against Sybil Devices in Crowdsourced Mapping Services

Contact Info

Product

Resources

About