Who on Earth Is “Mr. Cypher”: Automated Friend Injection Attacks on Social Networking Sites

Abstract

Abstract. Within this paper we present our novel friend injection attack which exploits the fact that the great majority of social networking sites fail to protect the communication between its users and their services. In a practical evaluation, on the basis of public wireless access points, we furthermore demonstrate the feasibility of our attack. The friend injection attack enables a stealth infiltration of social networks and thus outlines the devastating consequences of active eavesdropping attacks against social networking sites.

Social Networking Sites Security: Quo Vadis

“…In the most naive approach this means that the communication between the users and the social network uses encryption (e.g., HTTPS) to protect against eavesdropping. However, this from a technical standpoint simple, easy applicable and readily available protection instrument is not widely used by most of the SNSs [28]. XING is the exception, as it uses HTTPS for all client communication.…”

“…These are important features to improve the privacy issues of SNSs usage but once a closed network is infiltrated the protection is rendered useless. [7] showed that cloning of user profiles could be misused to infiltrate private networks, while [28] outlined yet another attack to infiltrate closed networks via HTTP cookie hijacking. c) Profile-squatting and Reputation Slander through ID Theft.…”

A survey on deceptions in online social networks

“…Another method of ICA attack is hijacking an existing user account through the OSN's session cookies hijacking [14]. Having control of the victim's account, the attacker impersonate the victim and retrieve the required information from the victim's friends, deceiving the trust between both parties.…”

A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks

“…Yet, although they provide flexible control over users and access to resources, Identity management systems are not dynamic in their mitigation mechanisms. With regards to the growing threat of SNS-based semantic attacks, Boshmaf et al [2012] have identified a range of AAA flavoured mechanisms that can provide some protection against automated sybil attacks [Huber et al 2010] and other current threats. Portable identities, with mutual verification and authentication between open systems (e.g.…”