As millions of users flock to online social networks, sites such as Facebook and Twitter are becoming increasingly attractive targets for spam, phishing, and malware. The Koobface botnet in particular has honed its efforts to exploit social network users, leveraging zombies to generate accounts, befriend victims, and to send malware propagation spam. In this paper, we explore Koobface's zombie infrastructure and analyze one month of the botnet's activity within both Facebook and Twitter. Constructing a zombie emulator, we are able to infiltrate the Koobface botnet to discover the identities of fraudulent and compromised social network accounts used to distribute malicious links to over 213,000 social network users, generating over 157,000 clicks. Despite the use of domain blacklisting services by social network operators to filter malicious links, current defenses recognize only 27% of threats and take on average 4 days to respond. During this period, 81% of vulnerable users click on Koobface spam, highlighting the ineffectiveness of blacklists.
[1]
Andreas Terzis,et al.
A multifaceted approach to understanding the botnet phenomenon
,
2006,
IMC '06.
[2]
Stefan Savage,et al.
Spamscatter: Characterizing Internet Scam Hosting Infrastructure
,
2007,
USENIX Security Symposium.
[3]
Chris Kanich,et al.
On the Spam Campaign Trail
,
2008,
LEET.
[4]
Arvind Krishnamurthy,et al.
Studying Spamming Botnets Using Botlab
,
2009,
NSDI.
[5]
Chris Kanich,et al.
Spamalytics: an empirical analysis of spam marketing conversion
,
2009,
CACM.
[6]
Leyla Bilge,et al.
Automatically Generating Models for Botnet Detection
,
2009,
ESORICS.
[7]
Christopher Krügel,et al.
Your botnet is my botnet: analysis of a botnet takeover
,
2009,
CCS.
[8]
Ryan Flores,et al.
The Heart of KOOBFACE C&C and Social Network Propagation
,
2009
.
[9]
Chris Kanich,et al.
Botnet Judo: Fighting Spam with Itself
,
2010,
NDSS.