Cross-Device Tracking of Employees with Social Networks

Companies around the world spent millions of dollars purchasing state-of-the-art network intrusion detection system to protect their network infrastructure from cyberattacks. Yet, they often neglect to protect employees’ personal mobile devices (PMDs). Adversaries could hack employees’ PMDs when they are outside the protection of the company’s firewalls and potentially exploit them as trojan horses for indirect attacks: such as slipping in malware while employees charge their PMDs using office devices (ODs), or exploiting PMDs’ bluetooth or NFC connection to infiltrate the company’s network via vulnerable intermediaries, or using PMDs’ cameras and microphones as eyes and ears in the company. Given the potential cybersecurity risks that compromised PMDs pose, it will then be important to protect them from being hacked by adversaries and the most straightforward method is to prevent adversaries from even identifying the employees’ PMDs. Su et al. (2017) suggest the possibility of using social media feeds to de-anonymise web browsing traffic, and in this report, we show that this concept can also be exploited to cross track employees’ ODs and their PMDs. Similar to (Su et al., 2017), our approach is based on the idea that each person has a distinctive social network, and thus the links appearing in one’s social media feeds are also unique. But on top of that, we further study how such behaviour evolves when it happens to a group of people belonging to the same social circle. We found that over time, due to the process of snowballing directed triadic closure, members of a social circle are likely to share similar followees and feeds which are unique to that social circle. This allows us to exploit the formula in Su et al. (2017) to 1) deduce employees’ social media accounts using web browsing traffic observed from the company, and 2) verify if an anonymous PMD belongs to an employee using web browsing traffic observed from that PMD. We implement and evaluate our strategy on synthetic web browsing traffic constructed from social circles that are derived from the Twitter social circles dataset from the Stanford Large Network Dataset Collection, and show that accurate deductions (i.e. TPR > 0.8) and verifications (i.e. TPR and TNR > 0.8) are achievable using our strategy. We also explore how the limitations faced by adversaries in reallife applications affect the performance of our strategy. Finally, we demonstrate how to counter our strategy using four different measures and assess their pros and cons.