Tweet
SAN FRANCISCO--Twitter represents a relatively new frontier for spammers, malware creators, and all around bad guys, which in turn has created new opportunities for security researchers and vendors alike to figure out, and try to put a stop to their efforts.
Of course the first step is to get a handle on how attackers are using the popular social network, as well as understanding the scale of the problem. One such company is Barracuda Networks, which outlined some of the research it's been doing over the past two years during a talk at the RSA conference here that wraps up tomorrow.
Paul Judge, who is the chief research officer and VP of cloud services for Barracuda noted that what makes Twitter a particularly attractive target is that it's both a mix of a social network, and a search engine. This lets scammers send out their wares both to a public feed and their list of followers, as well as vying for new eyeballs by making use of trending keywords to show up in search results (more on that here).
But who would follow a scammer, you're wondering? It's more common than you'd think said Barracuda research scientist Daniel Peck. One such example the company tracked was Download-Heaven, a site that was pushing links to hosted shareware filled with malware and trojans through an account on Twitter.
"It was following one person, but somehow it got 445 followers," Peck said. "A lot of the behavior would be to follow up with someone it followed, and if they didn't follow them back, it would drop them off and try to get someone else in order to build up its followers."
That type of behavior, along with negative follower counts (an aggregate rating of those who have followed, then unfollowed over time), were two things Barracuda looked for as it tracked a raw stream of data from Twitter. The other part of the test was to figure out the behaviors of typical users, to see if the company could put together filters that would spot the bad ones.
The result was a reputation system that looked at the Twitter stream as a whole through the company's public API, as well as through a specially whitelisted account that could get an extra 20,000 queries per hour outside of the normal public stream. The test ran for 2 years, and evaluated everything from tweet to follower ratios, as well as the content of what users were sharing. What they found was that just 43 percent of the users on the service could be classified as "true" users. These were users that had more than 10 followers, friends and tweets. That was compared to the other 57 percent of the network, which fell into a bucket of questionables.
By analyzing the flow of accounts, Barracuda was also able to create a "crime rate," which gave a percentage to the number of accounts created per month that end up getting suspended by Twitter. These were not just accounts that had been deactivated, Peck said. This number would swing wildly based on real world events, like Oprah joining the network, or the World Cup, which would bring in big swells of new Twitter users, as well as new topical opportunities for attackers.
These topical items were another area the company had focused on during the test. Much like trying to game search engines to get new eyeballs, scammers were adding topic tags to tweets to get them to show up in trending results and higher up on the search engine pages. To track how widespread this was, the company began grabbing search terms every hour, and doing searches on them. It would then retrieve the results, and go the to the Web sites if there were any links contained, where it would then analyze them for malicious code.
A breakdown of malware found on each search engine over the course of five months. (click to enlarge)
(Credit: Josh Lowensohn/CNET)
What they found, after comparing Twitter to more traditional search engines like Google, Yahoo and Bing for five months were 34,627 samples of malware. Twitter pulled in just 8 percent of the total, with Google, Yahoo and Bing leading the pack respectively.
"It's interesting because we've been doing this work for probably nine months of a year now, and the last time we really examined it and looked back on this, it charted very differently," Judge said. "About 69 percent of the malware that we found was on Google at the time, only one percent was on Twitter."
"A couple things happened," Judge continued. "Google didn't necessarily get better--there was more malware--basically Bing, Twitter and Yahoo got worse. So as the amount of malware increased, Google pretty much stayed steady with the amount of malware that was found there, but the other engines we started to see become a little more equal opportunity."
To Twitter's credit, the company has made several efforts to keep this malware at bay. Back in March of last year, it began routing links through a filter that would scan for malware. It also employed its own link shortening service that scans links for malware and keeps them from being posted. The company also transitioned to using OAuth, which lets users authenticate their credentials without providing a username or password, potentially keeping users from having their credentials hijacked by rogue third-party applications.
Judge closed by noting that Barracuda Networks had put together its own tool that can help users see if they've accidentally befriended one of these spammy or scammy users, or posted one of their links. Profile Protector, which is free, scans both your Facebook and Twitter profiles and identifies users that are on the company's watch list.
Powered By WizardRSS
Of course the first step is to get a handle on how attackers are using the popular social network, as well as understanding the scale of the problem. One such company is Barracuda Networks, which outlined some of the research it's been doing over the past two years during a talk at the RSA conference here that wraps up tomorrow.
Paul Judge, who is the chief research officer and VP of cloud services for Barracuda noted that what makes Twitter a particularly attractive target is that it's both a mix of a social network, and a search engine. This lets scammers send out their wares both to a public feed and their list of followers, as well as vying for new eyeballs by making use of trending keywords to show up in search results (more on that here).
But who would follow a scammer, you're wondering? It's more common than you'd think said Barracuda research scientist Daniel Peck. One such example the company tracked was Download-Heaven, a site that was pushing links to hosted shareware filled with malware and trojans through an account on Twitter.
"It was following one person, but somehow it got 445 followers," Peck said. "A lot of the behavior would be to follow up with someone it followed, and if they didn't follow them back, it would drop them off and try to get someone else in order to build up its followers."
That type of behavior, along with negative follower counts (an aggregate rating of those who have followed, then unfollowed over time), were two things Barracuda looked for as it tracked a raw stream of data from Twitter. The other part of the test was to figure out the behaviors of typical users, to see if the company could put together filters that would spot the bad ones.
The result was a reputation system that looked at the Twitter stream as a whole through the company's public API, as well as through a specially whitelisted account that could get an extra 20,000 queries per hour outside of the normal public stream. The test ran for 2 years, and evaluated everything from tweet to follower ratios, as well as the content of what users were sharing. What they found was that just 43 percent of the users on the service could be classified as "true" users. These were users that had more than 10 followers, friends and tweets. That was compared to the other 57 percent of the network, which fell into a bucket of questionables.
By analyzing the flow of accounts, Barracuda was also able to create a "crime rate," which gave a percentage to the number of accounts created per month that end up getting suspended by Twitter. These were not just accounts that had been deactivated, Peck said. This number would swing wildly based on real world events, like Oprah joining the network, or the World Cup, which would bring in big swells of new Twitter users, as well as new topical opportunities for attackers.
These topical items were another area the company had focused on during the test. Much like trying to game search engines to get new eyeballs, scammers were adding topic tags to tweets to get them to show up in trending results and higher up on the search engine pages. To track how widespread this was, the company began grabbing search terms every hour, and doing searches on them. It would then retrieve the results, and go the to the Web sites if there were any links contained, where it would then analyze them for malicious code.
A breakdown of malware found on each search engine over the course of five months. (click to enlarge)(Credit: Josh Lowensohn/CNET)
What they found, after comparing Twitter to more traditional search engines like Google, Yahoo and Bing for five months were 34,627 samples of malware. Twitter pulled in just 8 percent of the total, with Google, Yahoo and Bing leading the pack respectively.
"It's interesting because we've been doing this work for probably nine months of a year now, and the last time we really examined it and looked back on this, it charted very differently," Judge said. "About 69 percent of the malware that we found was on Google at the time, only one percent was on Twitter."
"A couple things happened," Judge continued. "Google didn't necessarily get better--there was more malware--basically Bing, Twitter and Yahoo got worse. So as the amount of malware increased, Google pretty much stayed steady with the amount of malware that was found there, but the other engines we started to see become a little more equal opportunity."
To Twitter's credit, the company has made several efforts to keep this malware at bay. Back in March of last year, it began routing links through a filter that would scan for malware. It also employed its own link shortening service that scans links for malware and keeps them from being posted. The company also transitioned to using OAuth, which lets users authenticate their credentials without providing a username or password, potentially keeping users from having their credentials hijacked by rogue third-party applications.
Judge closed by noting that Barracuda Networks had put together its own tool that can help users see if they've accidentally befriended one of these spammy or scammy users, or posted one of their links. Profile Protector, which is free, scans both your Facebook and Twitter profiles and identifies users that are on the company's watch list.
Powered By WizardRSS