creators_name: Bilge, Leyla creators_name: Strufe, Thorsten creators_name: Balzarotti, Davide creators_name: Kirda, Engin type: conference_item datestamp: 2009-04-06 19:10:05 lastmod: 2009-04-14 04:37:07 metadata_visibility: show title: All Your Contacts Are Belong to Us: Automated Identity Theft Attacks on Social Networks ispublished: pub full_text_status: public pres_type: paper abstract: Social networking sites have been increasingly gaining popularity. Well-known sites such as Facebook have been reporting growth rates as high as 3% per week [5]. Many social networking sites have millions of registered users who use these sites to share photographs, contact long-lost friends, establish new business contacts and to keep in touch. In this paper, we investigate how easy it would be for a potential attacker to launch automated crawling and identity theft attacks against a number of popular social networking sites in order to gain access to a large volume of personal user information. The first attack we present is the automated identity theft of existing user profiles and sending of friend requests to the contacts of the cloned victim. The hope, from the attacker’s point of view, is that the contacted users simply trust and accept the friend request. By establishing a friendship relationship with the contacts of a victim, the attacker is able to access the sensitive personal information provided by them. In the second, more advanced attack we present, we show that it is effective and feasible to launch an automated, cross-site profile cloning attack. In this attack, we are able to automatically create a forged profile in a network where the victim is not registered yet and contact the victim’s friends who are registered on both networks. Our experimental results with real users show that the automated attacks we present are effective and feasible in practice. date: 2009-04 pagerange: 551-551 event_title: 18th International World Wide Web Conference event_location: Madrid, Spain event_dates: April 20th-24th, 2009 event_type: conference refereed: TRUE citation: Bilge, Leyla and Strufe, Thorsten and Balzarotti, Davide and Kirda, Engin (2009) All Your Contacts Are Belong to Us: Automated Identity Theft Attacks on Social Networks. In: 18th International World Wide Web Conference, April 20th-24th, 2009, Madrid, Spain. document_url: http://www2009.eprints.org/56/1/p551.pdf