Social Snapshots: Digital Forensics for Online Social Networks

1. Outline Brief background Design Results and Evaluation Concluding remarks References Social Snapshots Digital Forensics for Online Social Networks Markus Huber∗† , Martin Mulazzani∗ , Manuel Leithner∗ , Sebastian Schrittwieser∗ , Gilbert Wondracek‡ , Edgar Weippl∗ *SBA Research † Vienna PhD school of informatics ‡ Vienna University of Technology ACSAC 2011, Orlando (FL) Markus Huber SBA Research, mhuber@sba-research.org 1/23 Social Snapshots: Digital Forensics for Online Social Networks

2. Outline Brief background Design Results and Evaluation Concluding remarks References 1 Brief background Social Snapshots 2 Design Authentication Modules 3 Results and Evaluation Evaluation Results: information gathering 4 Concluding remarks Markus Huber SBA Research, mhuber@sba-research.org 2/23 Social Snapshots: Digital Forensics for Online Social Networks

3. Outline Brief background Design Results and Evaluation Concluding remarks References Brief Background Markus Huber SBA Research, mhuber@sba-research.org 3/23 Social Snapshots: Digital Forensics for Online Social Networks

4. Outline Brief background Design Results and Evaluation Concluding remarks References Online Social Networks (OSNs) Currently largest and fasted growing web services Personal data of hundreds of million people Facebook, LinkedIn, XING, etc. 1 Replace traditional means of digital storage, sharing, and communication Need for novel digital forensics data collection methods 2 Research on OSNs security issues Empirical studies [1, 2, 4, 3, 5] depend on initial data gathering Markus Huber SBA Research, mhuber@sba-research.org 4/23 Social Snapshots: Digital Forensics for Online Social Networks

5. Outline Brief background Design Results and Evaluation Concluding remarks References State-of-the-art information gathering methods Extraction of sensitive information poses non-trivial challenge Simple web crawlers (libwww etc.) Number of shortcomings 1 High network traﬃc 2 Additional or hidden data 3 Maintainability Markus Huber SBA Research, mhuber@sba-research.org 5/23 Social Snapshots: Digital Forensics for Online Social Networks

6. Outline Brief background Design Results and Evaluation Concluding remarks References Social Snapshots Main contributions Novel techniques to gather OSNs data Hybrid approach: Third-party application + crawling Social Snapshot prototype for Facebook Core framework released as open-source software First experimental evaluation Based on Facebook Markus Huber SBA Research, mhuber@sba-research.org 6/23 Social Snapshots: Digital Forensics for Online Social Networks

7. Outline Brief background Design Results and Evaluation Concluding remarks References Design Markus Huber SBA Research, mhuber@sba-research.org 7/23 Social Snapshots: Digital Forensics for Online Social Networks

8. Outline Brief background Design Results and Evaluation Concluding remarks References Design goals Simulate average user Limit network-traﬃc, gathering-duration Standard Web Browser Collection of meta-data Rely on rich data available through APIs Open-source software (OSS) Markus Huber SBA Research, mhuber@sba-research.org 8/23 Social Snapshots: Digital Forensics for Online Social Networks

9. Outline Brief background Design Results and Evaluation Concluding remarks References Social Snapshot Framework Social snapshot Third-party client application 6. API requests 7. social data 2. Shared secret Social Network Service Cloud 1. Authentication 3. Contact list (credentials / cookie) 4. Session secret 5. Crawler data Social data pool automated web browser Web server Web server Markus Huber SBA Research, mhuber@sba-research.org 9/23 Social Snapshots: Digital Forensics for Online Social Networks

10. Outline Brief background Design Results and Evaluation Concluding remarks References Authentication How-to gather the initial authentication token Consent Easiest case, preferred method for research Hijack social networking sessions WiFi, LAN Extraction from forensic image Stored authentication cookies from seized hard-drives Markus Huber SBA Research, mhuber@sba-research.org 10/23 Social Snapshots: Digital Forensics for Online Social Networks

11. Outline Brief background Design Results and Evaluation Concluding remarks References Modules Social Snapshot Framework modules Social snapshot client Automated web browser Third-party social snapshot application Hijack Digital image forensics Analysis Markus Huber SBA Research, mhuber@sba-research.org 11/23 Social Snapshots: Digital Forensics for Online Social Networks

12. Outline Brief background Design Results and Evaluation Concluding remarks References Results and Evaluation Markus Huber SBA Research, mhuber@sba-research.org 12/23 Social Snapshots: Digital Forensics for Online Social Networks

13. Outline Brief background Design Results and Evaluation Concluding remarks References Evaluation Evaluation based on Facebook Element Download social snapshot Contact details − !Crawler Evalation based on News feed − !Graph API Facebook Checkins − !Graph API Photo Tags − !Graph API At the time of writing: Video Tags − !Graph API largest online social Friends name onlya !Graph API network Likes name onlya !Graph API Movies name onlya !Graph API Support for third-party Music name onlya !Graph API applications Books name onlya !Graph API Graph API enables access Groups name onlya !Graph API Proﬁle feed (Wall) limitedb !Graph API great majority of account Photo Albums limitedb !Graph API content Video Uploads limitedb !Graph API Messages limitedb !Graph API Markus Huber SBA Research, mhuber@sba-research.org 13/23 Social Snapshots: Digital Forensics for Online Social Networks

14. Outline Brief background Design Results and Evaluation Concluding remarks References Evaluation Graph API Result example {” i d ” : ” 12345678 ” , ”name” : ” John Doe” , ” f i r s t n a m e ” : ” John ” , ” l a s t n a m e ” : ”Doe” , ” l i n k ” : ” h t t p : //www. f a c e b o o k . com/ j o h n d o e ” , ” username ” : ” j o h n d o e ” , ” b i r t h d a y ” : ” 04/01/1975 ” , ” hometown ” : {” i d ” : ” ” , ”name” : n u l l } , ” q u o t e s ” : ” s o c i a l s n a p s h o t y o u r a c c o u n t ! . n” , ” g e n d e r ” : ” male ” , ” e m a i l ” : ” j o h n d o e @ e x a m p l e . com” , ” t i m e z o n e ” : 2 , ” l o c a l e ” : ” en US ” , ” v e r i f i e d ” : t r u e , ” u p d a t e d t i m e ” : ”2011−05−15 T 1 3 : 0 5 : 1 9 +0000”} Markus Huber SBA Research, mhuber@sba-research.org 14/23 Social Snapshots: Digital Forensics for Online Social Networks

15. Outline Brief background Design Results and Evaluation Concluding remarks References Evaluation Challenges Hijack module No direct support to set cookies in Selenium (patch for server) Graph API SDK Too slow (modiﬁed original lib) Crawling of contact details List of friends (via API) Plaintext emails replaced with images (image generation script) Emails get removed completely (address.yahoo.com) Recruiting test subjects Challenging (25 test subjects) Markus Huber SBA Research, mhuber@sba-research.org 15/23 Social Snapshots: Digital Forensics for Online Social Networks

16. Outline Brief background Design Results and Evaluation Concluding remarks References Results: information gathering Run-Time Third-party application 12.79min on average Crawler 14min on average Fetched elements Third-party required 9802 API requests on average Crawler processed 238 friend proﬁles on average After 162 plaintext email addresses we had to solve 85 email addresses with OCR Markus Huber SBA Research, mhuber@sba-research.org 16/23 Social Snapshots: Digital Forensics for Online Social Networks

17. Outline Brief background Design Results and Evaluation Concluding remarks References Results: information gathering Video/demo.avi Markus Huber SBA Research, mhuber@sba-research.org 17/23 Social Snapshots: Digital Forensics for Online Social Networks

18. Outline Brief background Design Results and Evaluation Concluding remarks References Results: information gathering Bob Dalton 7:44:50 AM 12:32:50 PM 3:20:32 PM 5:51:35 PM Uploaded digital picture Private Message Wall Post ID 123456789 ID 11111111 ID 77777777 Privacy: EVERYBODY Like Wall Post ID 1234567 ID 00000000 of User 123456 To Grat Dalton Privacy: ALL_Friends 1 Comments UTC-5 Matched Source Image: CIMG2216.JPG ID 333333 01:00 02:00 03:00 04:00 05:00 06:00 07:00 08:00 09:00 10:00 11:00 12:00 13:00 14:00 15:00 16:00 17:00 18:00 19:00 20:00 21:00 22:00 23:00 1/13/2011 12:00 AM 1/14/2011 12:00 AM User Bill Power ID 222222 Private Message Wall Post ID 1234567 ID 0000001 User Dick Broadwell ID 4444444 User Grat Dalton ID 333333 User Dick Broadwell ID 4444444 6:43:12 AM Posted video ID 1234567 Comment Wall Post ID 123456789 6:27:12 PM 10:56:50 AM 8:48:00 PM Markus Huber SBA Research, mhuber@sba-research.org 18/23 Social Snapshots: Digital Forensics for Online Social Networks

19. Outline Brief background Design Results and Evaluation Concluding remarks References Results: information gathering William H. Press Guy L. Steele, ... Srinidhi Varada... Guido van Rossum Daniel Mopati K... Yukihiro Matsum... G.M. Nijssen Amir Pnueli David H. D. War... Terry Winograd Gordon Plotkin Sophie Wilson Vinod Dham James Z. Wang Michael I. Schw... Adi Shamir Barbara J. Grosz Alan Perlis Joseph Weizenbaum Carl Kesselman Susan Dumais Philip-Emeagwali Cleve Moler Grady Booch James G. Nell Donald Firesmith Donald Knuth Janet L. Kolodner Larry Wall Stephen Muggleton James Gosling Frances E. Allen Alfred Aho Jack E. Bresenham Butler W. Lampson Sanjeev Arora James C. Beatty... David A. Huffman Joseph F Traub George Jeffrey D. Ullman Boole Per Brinch Hansen François Vernadat Ken Kennedy Wim Ebbinkhuijsen Richard Veryard Chris McKinstry Adriaan van Wij... Joseph Halpern Jie Wu Thomas Sterling Gordon Cormack Börje Langefors Michael Stonebr... Les Hatton Leonard Adleman Herman Hollerith Michael Garey Joseph Kruskal Marvin Minsky Edward H. Short... Kathleen R. McK... Bruce Schneier Andrew Herbert Ken Thompson Edwin Catmull John George Kem... Godfried Toussa... Edsger Dijkstra Fred B. Schneider Thomas E. Kurtz Jonathan James Douglas McIlroy Carl Sassenrath Marilyn A. Walker He Jifeng Robert Floyd Seinosuke Toda Edgar F. Codd Fernando J. Cor... Neil J. Gunther James H. Wilkin... Eric Horvitz David Liddle Christopher Ric... Bernard Galler Herbert W. Franke Zvi Galil Marco Dorigo Admiral Grace H... Ron Rivest Winston W. Royce Luis von Ahn William Kahan Frieder Nake Tim Berners-Lee Mihai Nadin John McCarthy Edmund M. Clarke David S. Johnson Gerrit Blaauw John L. Hennessy Jiawei Han Ole-Johan Dahl Charles E. Leis... Tom Gruber Bill Gropp Leonard Kleinrock Robin Milner Erik Demaine Steve Whittaker Dennis E. Wisno... Lambert Meertens Paul Dourish Ivar Jacobson Hector Garcia-M... Joyce K. Reynolds John Koza Alan Burns Douglas Lenat Stephen R. Bourne David A. Bader Stephen Wolfram Yuri Matiyasevich Tom Lane (compu... Paul Graham Michael Dertouzos Ian Goldberg Peter Wegner Michael L. Scott Brian Cantwell ... J.C.R. Licklider Martin Hellman William Wulf Andries van Dam Sjaak Brinkkemper Simon Colton Jonathan Bowen Zhou Chaochen Alan Turing Andrew Ng James Martin Andrew Appel Patrick Cousot Vinton Cerf Kurt Gödel Bert Bos Murray Turoff Christopher Str... Dragomir R. Radev Douglas T. Ross Joseph Sifakis Mark Overmars David Gelernter Amos Nuwasiima George Sadowsky Alexander Dewdney Alan Dix Emil Post Bertrand Meyer Adam Riese Jeff Rulifson John C. Reynolds Andrey Ershov Brian Randell Manindra Agrawal John Backus Jan Weglarz Gordon Moore Markus Huber SBA Research, mhuber@sba-research.org 19/23 Social Snapshots: Digital Forensics for Online Social Networks

20. Outline Brief background Design Results and Evaluation Concluding remarks References Results: information gathering Joel Moses Robert E. Kahn Andrew S. Tanenbaum David Liddle 2011-07-15T13:08:14 2011-07-05T15:30:17 2011-07-05T15:30:17 os question ssl broken unix problem James Martin 2011-07-15T14:11:55 Gerald Jay Sussman phd students party Robert Sproull 2011-07-15T14:11:55 2011-07-15T14:11:55 Tom DeMarco 2011-07-15T14:11:55 2011-07-05T15:30:17 2011-07-01T11:48:10 2011-07-15T14:11:55 social snapshot 2011-07-22T07:40:08 2011-07-17T19:59:48 2011-07-15T14:11:55 book chapter 2011-06-28T14:26:55 2011-07-15T14:11:55 2011-07-15T14:11:55 2011-07-03T14:36:45 2010-06-22T14:10:23 south africa Raj Reddy fs carving Kristen Nygaard 2011-07-17T21:12:02 Wil van der Aalst 2011-07-17T21:15:16 Peter Bernus Stephen C. 2011-07-15T14:11:55 Johnson 2011-07-17T21:12:02 Bruce Schneier 2011-08-30T05:56:36 2011-06-30T16:27:33 2011-07-01T08:39:14 2011-07-15T14:11:55 2011-08-19T13:38:04 pyflag fb forensics sha vs. ripedm 2011-06-25T13:35:56 Jonathan Schaeffer Madhu Sudan 2011-09-09T11:52:35 2011-06-30T09:15:31 2011-08-30T05:56:36 2011-07-17T21:14:17 Karen Sparck-Jones Leslie Valiant 2011-08-22T08:55:15 2010-05-26T10:21:06 2011-08-22T09:02:05 business plan privacy glitch 2011-06-28T08:48:32 Joseph Halpern IFIP meeting 2011-09-13T15:04:50 John Krogstie 2011-07-20T18:32:41 ACSAC florida digital forensics preprint ifip12 Gordon Moore Ronald Stamper Andrew Herbert 2011-09-09T09:08:13 CCS 2012 Arne Sølvberg Michael O. Rabin 2011-08-26T15:07:21 2011-07-17T21:14:17 whitebox crypto 2010-05-26T10:21:06 2011-08-22T09:02:05 Roland Carl Backhouse Nello Cristianini presentation Bruce Schneier Jon Postel T. V. Raman Bert Sutherland Yukihiro Matsumoto bbq tomorrow social graph paper reviews Marilyn A. Walker 2011-09-13T15:04:50 2011-07-20T18:32:41 Sheila Greibach Gordon Cormack Alonzo Church Markus Huber SBA Research, mhuber@sba-research.org 20/23 Social Snapshots: Digital Forensics for Online Social Networks

21. Outline Brief background Design Results and Evaluation Concluding remarks References Concluding remarks Markus Huber SBA Research, mhuber@sba-research.org 21/23 Social Snapshots: Digital Forensics for Online Social Networks

22. Outline Brief background Design Results and Evaluation Concluding remarks References Social Snapshot tool extracts Facebook data in less than 15 minutes Malicious social snapshots FiTM attacks[3] Privacy surveys Data liberation Markus Huber SBA Research, mhuber@sba-research.org 22/23 Social Snapshots: Digital Forensics for Online Social Networks

23. Outline Brief background Design Results and Evaluation Concluding remarks References Thank you for your time! Questions? mhuber@sba-research.org http://socialsnapshot.nysos.net Participate in our survey and get your social snapshot: http://is.gd/snapshotsurvey Markus Huber SBA Research, mhuber@sba-research.org 23/23 Social Snapshots: Digital Forensics for Online Social Networks

24. Outline Brief background Design Results and Evaluation Concluding remarks References L. Bilge, T. Strufe, D. Balzarotti, and E. Kirda. All your contacts are belong to us: automated identity theft attacks on social networks. In Proceedings of the 18th international conference on World wide web, pages 551–560. ACM, 2009. H. Gao, J. Hu, C. Wilson, Z. Li, Y. Chen, and B. Zhao. Detecting and characterizing social spam campaigns. In Proceedings of the 10th annual conference on Internet measurement, pages 35–47. ACM, 2010. M. Huber, M. Mulazzani, E. Weippl, G. Kitzler, and S. Goluch. Friend-in-the-middle attacks: Exploiting social networking sites for spam. Internet Computing, 2011. Markus Huber SBA Research, mhuber@sba-research.org 23/23 Social Snapshots: Digital Forensics for Online Social Networks

25. Outline Brief background Design Results and Evaluation Concluding remarks References T. Jagatic, N. Johnson, M. Jakobsson, and F. Menczer. Social phishing. Communications of the ACM, 50(10):94–100, 2007. G. Wondracek, T. Holz, E. Kirda, and C. Kruegel. A Practical Attack to De-Anonymize Social Network Users. In Proceedings of the IEEE Symposium on Security and Privacy, 2010. Markus Huber SBA Research, mhuber@sba-research.org 23/23 Social Snapshots: Digital Forensics for Online Social Networks

Social Snapshots: Digital Forensics for Online Social Networks

Vous êtes en train de lire un aperçu.

Consultez-les par la suite

Social Snapshots: Digital Forensics for Online Social Networks

Plus De Contenu Connexe

Les utilisateurs ont également aimé (17)

Similaire à Social Snapshots: Digital Forensics for Online Social Networks (20)

Plus récents (20)