The Tweet Advantage: An Empirical Analysis of 0-Day Vulnerability Information Shared on Twitter

Abstract

In the last couple of years, the number of software vulnerabilities and corresponding incidents increased significantly. In order to stay up-to-date about these new emerging threats, organizations have demonstrated an increased willingness to exchange information and knowledge about vulnerabilities, threats, incidents and countermeasures. Apart from dedicated sharing platforms or databases, information on vulnerabilities is frequently shared on Twitter and other social media platforms. So far, little is known about the obtainable time advantage of vulnerability information shared on social media platforms. To close this gap, we identified 709,880 relevant Tweets and subsequently analyzed them. We found that information with high relevance for affected organizations is shared on Twitter often long before any official announcement or patch has been made available by vendors. Twitter is used as a crowdsourcing platform by security experts aggregating vulnerability information and referencing a multitude of public available webpages in their Tweets. Vulnerability information shared on Twitter can improve organizations reaction to newly discovered vulnerabilities and therefore help mitigating threats.

Follow the Blue Bird: A Study on Threat Data Published on Twitter

“…To the best of our knowledge, Sauerwein et al performed the most similar study to the one present on this paper [55]. For two years, the authors collected all tweets with a CVE-ID in its text.…”

“…As the NVD is considered a standard for consulting vulnerability data, many research works use only the NVD as their vulnerability database (e.g., [42,47,50,55]). This is a natural choice since the NVD includes multiple resources for further understanding of the issue at hand.…”

A Demand-Side Viewpoint to Software Vulnerabilities in WordPress Plugins

“…3 visualizes the second-level (2LD) and top-level (TLD) domain names extracted from the uniform resource locators (URLs) present in the hyperlinks, using the so-called public suffix list for the comparisons [16]. Although social media has been suspected to play an increasingly important role [31,44], the illustration clearly indicates that plugin vulnerabilities are commonly disseminated through very traditional channels for communicating security issues in the OSS context. In fact, social media is hardly even present.…”

Setting the Optimum Time for a Special Audit to Improve the Enterprise's Cyber Security

“…The identification of characteristics of cyber-attacks is devoted to work [4,5,6]. The denial of service (DoS) cyber-attacks [7], the study of worms and botnet activity [8], the analysis of data on the number of cyber-attacks collected in a black hole [9] and in one-way motion [10] are investigated in the scientific literature. Studies [11,12] are devoted to classifying data into classes.…”