SOCIAL NETWORKSTHREATS AND TRENDS

ALEXANDRU CATALIN COSOIALEXANDRU CATALIN COSOIHEAD OF ONLINE THREATSHEAD OF ONLINE THREATS

ACOSOI@BITDEFENDER.COMACOSOI@BITDEFENDER.COM

Viruses

Email worms

Exploit worms

Rootkits

Backdoor Trojans

Sources of Attack

RemovableMedia

Instant Messaging

Clients

Types of Threats Proliferation Mediums

Email AttachmentsScript Kiddies

Threat landscape – Past Threat landscape – Past

2

3

Viruses

Email worms

Exploit worms

P2P worms

IM worms

Rootkits

Backdoor Trojans

Spyware

Adware

Greyware

Sources of Attack

Legitimate, Compromised Multi-media Websites

RemovableMedia

MobileDevices

Public WiFi Networks

Instant Messaging

Clients

Hackers

Web 2.0 Applications

Types of Threats

SPAM Email Attachments

Legitimate Businesses

P2P NetworksPhishingOrganized Crime

Foreign Governments

THREAT LANDSCAPE – PRESENT THREAT LANDSCAPE – PRESENT

Proliferation Mediums

What Urls Am I Talking About?What Urls Am I Talking About?

Where Do Urls Come From?Where Do Urls Come From?

SLIDE 2

Web 2.0Web 2.0

Nice Blue Birdie

SLIDE 3

TwitterTwitter

• Huge growth in the last years• Approximately 7 mil tweets / hour• In Sept 2008, Twitter had a growth of 343%

o (sept 2007 vs sept 2008. according to Nielsen-Online)

In Feb 2009, the growth was of 1382% (feb 2008 – feb 2009, according to Nielsen-Online)

SLIDE 4

Time on Site Time on Site

SLIDE 5

Types of Twitter SpamTypes of Twitter Spam

• Following Spam• Tweet Spam• Direct Message Spam• Trending Subject Spam• Reply/Trackback Spam• ReTweet Spam

SLIDE 16

Scale Free Networks Scale Free Networks

Social Connections are not random.Nodes with many connections will attract new connections easier than nodes with fewer connections

“The rich get richer and the poor get poorer”. Proverb provided by wikipedia

SLIDE 24

Imagine a malware URL from these guysImagine a malware URL from these guys

SLIDE 7

Facebook in NumbersFacebook in Numbers

• More Then 400 million active users• 5.14 % from total word population• 20.18% from worldwide internet users• Over 700 000 bussiness

SLIDE 8

Social Games on FacebookSocial Games on Facebook

SLIDE 9

Facebook’s “Russian Bride”Facebook’s “Russian Bride”

SLIDE 10

Facebook E-mail SpamFacebook E-mail Spam

SLIDE 12

Haiti Hoaxes and scamsHaiti Hoaxes and scams

SLIDE 13

Phishing for FacebookPhishing for Facebook

SLIDE 14

Phishing & Malware on FacebookPhishing & Malware on Facebook

• Facebook blocked an important number of phishing and malware attacks

• Facebook worms use short, provocative and catchy messages

The ads worm (this Tuesday)The ads worm (this Tuesday)

The ads worm (this Tuesday)The ads worm (this Tuesday)

The ads worm (this Tuesday)The ads worm (this Tuesday)

SLIDE 15

User AcceptanceUser Acceptance

• To see how many people accept connect with unknown users

• To see how many people follow unknown links from unknown users

• To see how many people really block unknown connections request

• 3 honeypot users: one profile without picture and containing as few details as possible(1st profile), another profile with a picture and a few details(2nd profile) and yet another profile with a large amount of details and pictures(3rd profile).

SLIDE 16

User Acceptance – SetupUser Acceptance – Setup

• 3 honeypot users• one profile without picture and containing as few

details as possible• one profile with a picture and a few details• one profile with a large amount of details and

pictures

SLIDE 18

User Acceptance - ResultsUser Acceptance - Results

The august study – user acceptanceThe august study – user acceptance

The august study – personal information lossThe august study – personal information loss

The august study – confidential information lossThe august study – confidential information loss

SafegoSafego

Questions?Questions?

Alexandru Catalin COSOIHead of Online Threats Lab

eMail: acosoi@bitdefender.com