Could the AP Twitter hack have been prevented?

Twitter hacks can cause a lot of damage. It is news of this week that the Associated Press Twitter account got compromised, and sent a tweet announcing that the White House had been hit by a terrorist attack, and that President Obama was injured. The dynamics of the hack are not clear yet, even though some sources claim that the AP people might have been victim of a spearphishing attack.

What is sure is that the hack had a huge, unprecedented effect on the stock market. Right after the malicious tweet was sent, the New York stock exchange suddenly fell more than 150 points. The market recovered short afterwards (after it was clear that the announcement was a hoax), but somebody could definitely have made a lot of money from this event.

This is the first time that people realize that Tweets can have a large effect on financial institutions. The question that people are asking is: could this compromise have been avoided? The answer is maybe. At the last NDSS Symposium we presented a paper titled "COMPA: Detecting Compromised Accounts on Social Networks." The goal of the paper is to detect, and block, messages that are sent by compromised social network accounts, just like the AP one. Our system leverages a simple observation: people develop habits when using social networks. These habits include connecting to the network at specific times, using certain applications / clients to interact with the network, including links to specific domain in their messages, and so on. When an account gets compromised, the malicious messages that are sent are likely to show differences from this behavior. We developed a system, called COMPA, that learns the typical behavior of users on social networks, and raises an anomaly if a user sends a message that does not comply with the learned behavior.

We ran COMPA on the offending Tweet sent by the AP account. More precisely, we learned the historical behavior of the account, and we checked the malicious tweet against it. COMPA detected the tweet as anomalous. In particular, the tweet was sent from the web, while the AP operators typically use the SocialFlow app. In addition, the tweet does not include a URL, which is something that pretty much every news tweet contains. This is not a surprise to us. When the Fox News Politics account got hacked in 2011, COMPA was able to detect the offending tweet as anomalous too.

We think that the type of behavioral modelling that we ran in COMPA is the way in which social networks should implement their detection of compromised accounts algorithms, and we hope to see this type of techniques deployed in the wild in a near future.

A new strategy for social network spammers?

As is obvious to whoever surfs in the social media world, Spam on social networking sites is on the rise. As we show in our latest paper, malicious users leverage the ease of reaching thousands of users these platforms provide to deliver their messages to as many people as possible. In addition, the personal information that's available through social networks allows spammers to target their campaigns to those users that are more likely to fall for them. In our paper, we show how adult dating spam on Facebook mostly targets male users. However, most spam campaigns, both on Twitter and on Facebook, are pretty easy to detect, and the profiles that carry them out get shut down fast. The reasons are mainly two: the first one is that spammers activity differs quite a lot from human one, and this make detection of spam profiles possible. The second one is that spam bots generally target their victims randomly, and this produces social graphs that are very different from the ones of real people (that, in general, have a very dense "core" of mutual friends in their graph).

Of course, spammers are coming up with smarter solutions, that make detection harder. Since a few months, I noticed spam profiles on Twitter contacting only people that are linked together. This can easily resemble a real social graph, and from one side makes detection harder. On the other hand, this technique attracts more victims, since people are more likely to befriend somebody if this person is already friend with many of their friends (expecially if it is a cute girl... you get it.). Given these observations, I started wondering how much effort it would take for somebody to create a profile, "merge" into a real social network by contacting people that are linked together, and, after having a few hundreds friends, start spamming. 

To check this, I created a fake Facebook profile, and started contacting some people that were connected together. A boost to this process is given by the fact that some people will accept any request they receive, and this would not only increase the number of friends the bot has, but would also attract friend requests, since the fake profile will start appearing in others' profiles as a suggestion. After having collected a decent amount of friends, say 30, it has been enough to sit down and wait for a while. People started asking friendship on their own, and all the bot had to do was accepting these requests. In a bit more than one month, the bot collected 375 friendships on Facebook. This is an order of magnitude higher than the number of friends reached, on average, using random targeting by the spammers we monitored for our previous paper. Needless to say, the spam or automatic activity detection algorithms of Facebook failed. Time for better anti-spam techniques?