Towards Automating Social Engineering Using Social Networking Sites

Abstract

A growing number of people use social networking sites to foster social relationships among each other. While the advantages of the provided services are obvious, drawbacks on a users' privacy and arising implications are often neglected. In this paper we introduce a novel attack called automated social engineering which illustrates how social networking sites can be used for social engineering. Our approach takes classical social engineering one step further by automating tasks which formerly were very time-intensive. In order to evaluate our proposed attack cycle and our prototypical implementation (ASE bot), we conducted two experiments. Within the first experiment we examine the information gathering capabilities of our bot. The second evaluation of our prototype performs a Turing test. The promising results of the evaluation highlight the possibility to efficiently and effectively perform social engineering attacks by applying automated social engineering bots.

Who on Earth Is “Mr. Cypher”: Automated Friend Injection Attacks on Social Networking Sites

“…The findings of [6] have furthermore been confirmed by the experiments of [7]. Social engineering is yet another attack where information on a future target forms the starting point for attackers and because of the emerging SNSs usage the whole attack might eventually be automated [8]. Existing attempts to extract information from SNSs focus on the application layer and can thus be mitigated by adapting a specific social networks' application logic.…”

The Social Engineering Personality Framework

“…Concerning sensitive information gathered via social networks, Huber et al [11] introduce an attack called "automated social engineering", where bots are used to collect information freely available in a social network, and to directly contact people via social networks to elicit information. Technique propagation [12] can be applied on automated SE attacks as well taking the attack frequency to a new level.…”

Social engineering in social networking sites: Affect-based model

“…Because of the lack of users' awareness, social engineering is considered a low-cost and effective form of attack [16]. Moreover, some researchers have started investigating in automating social engineering, hijacking, and phishing in social networking sites [17,18].…”