Title: "LeakedOut: the Social Networks You Get Caught In"
Presenter: J. Orlicki
Date: Sept. 30/Oct. 1
Abstract:
The proliferation of social network services like LinkedIn,
Facebook and Twitter, among many others, has produced an extensive leakage of private information. Individual and organizational data leaked in this fashion can greatly empower attackers in deploying their campaigns, such as client-side attacks, (e.g., targeted fishing), network attacks or Web application attacks. Therefore, professional security audits (e.g., penetration tests) must take this into account.
In this context, social network infiltration or engineering can be applied to social-network computer systems to break into an organization, social circle or group of individuals, and asses the effective security of these groups or organizations. We will present an interactive-shell prototype called Exomind, including several novel ideas for crawling, indexing, analysis and interaction with social networks.
Some of the ideas demonstrated will be:
- Multiple simultaneous social network crawling. Targeting medium size
1000-10000 social/computer systems, it can simulaneously crawl using pre-defined subsets of "expanders" like "Twitter::friends" or
"SearchEngine::name_to_mails", etc. A bag of tags is indexed for
each node to collect general information plus any specific information,
e.g. YouTube alias or DNS resolutions.
- Blind social network reconstruction using search engine distance measures. Some concepts of text-mining and AI will be incorporated to estimate distances using search engines or the parcels of information collected. Given a list of people, you can estimate the structure of the social network.
- Personalized chatbots testing identity theft using the information gathered, search engines and a thesaurus. One you have located your preferred network spot to infiltrate you can deploy chatbots that interact with ubiquitous systems to leverage attacks via trust relationships. Novel ideas include automatic chat generation using search engines, combined with vocabulary impersonation using a thesaurus (aka. synonym dictionary).
