Exposing Impersonation Attacks in Online Social Networks

Today, users sign on to most online social networking sites like Facebook, Twitter, and Google+ via weak identities, i.e., unverified identities that do not require users to prove that their online identities match their offline (real world) personalities. Weak identities leave the sites vulnerable to a variety of fake identity or Sybil attacks. In this paper, we focus on identity impersonation attacks, a special class of Sybil (fake identity) attacks where the attacker spoofs (assumes) the identity of another real-world user. As more and more personal data about users becomes publicly available on the Web, impersonation attacks become easier to carry out. Identity impersonation attacks can be particularly damaging for the victim’s online reputation. As people’s online data is increasingly aggregated by search engines [1] and used for a variety of purposes including evaluating their suitability for employment [2], impersonation attacks, particularly those that go undetected, can have serious adverse consequences for the victims, even in the offline world. Further, social engineering attacks launched using impersonated identities can result in material and financial losses for the victim as well as the victim’s friends [3]. Despite the serious threat posed by impersonation attacks [4, 5] and the woeful state of defenses against the attacks, few research studies, to date, have systematically studied impersonation attacks in online social networks. We argue that the current state of affairs is largely due to the difficulty in gathering extensive ground truth data about impersonation attacks in the real-world. Beyond a few anecdotal examples that are reported in the popular press, we lack large datasets about impersonation attacks in online social networks that can be used to characterize and detect identities participating in such attacks. In this paper, we take the fist step toward understanding and detecting impersonation attacks by presenting a novel method that allows to gather extensive ground truth of impersonation attacks in current social networks. §2 gives the key idea behind our method and §3 presents some preliminary results on characterizing impersonation attacks.