Protecting Organizations from Cyber Attacks Originating from Social Media

Today, organizations are exposed to numerous security risks and attacks on online social networks (OSNs). Advanced persistent threats (APTs) are sophisticated attacks that incorporate advanced methods; the reconnaissance phase is the first phase of these attacks. In this phase, attackers look for “appropriate” organizational entry points in order to perform initial penetration, often using the open Web to obtain a large amount of information about organizations. OSNs are among the most fertile information sources for attackers seeking entry points into an organization. Attackers use OSNs to extract details about the organizational structure, positions, locations, and other pieces of information.

Attackers employ artificial, machine-operated social network profiles called socialbots in order to achieve these details. Moreover, using OSNs and targeted socialbots, attackers may establish a foothold in the organization by selecting employees that can be exploited to penetrate the organization. 

The ease with which OSN users accept friend requests from strangers plays into the hands of attackers who exploit this user vulnerability by sending friend requests to employees. OSN connections with the employees form a solid base for initial penetration and subsequent stages of an attack; after obtaining a  foothold in an organization, an attacker is well-positioned to gain access to essential assets by sending phishing emails or private messages with a malicious attachment or URL.

In this research, we proposed methods attempt to detect intelligent socialbots targeting organizations as early as possible, detecting such socialbots by intelligently selecting an organization’s member profiles or honeypot profiles and monitoring their activity. In addition, we propose a framework for the management of OSN honeypots to aid in the detection of APTs in the reconnaissance phase. The framework supports the deployment process, automatic creation of artificial profiles, and management of the social honeypots. The efficacy of the methods is demonstrated by showing that it is possible to significantly reduce the foothold of attackers that use intelligent targeted socialbots in OSNs.