TY - GEN
T1 - The Koobface botnet and the rise of social malware?
AU - Thomas, Kurt
AU - Nicol, David M.
PY - 2010
Y1 - 2010
N2 - As millions of users flock to online social networks, sites such as Facebook and Twitter are becoming increasingly attractive targets for spam, phishing, and malware. The Koobface botnet in particular has honed its efforts to exploit social network users, leveraging zombies to generate accounts, befriend victims, and to send malware propagation spam. In this paper, we explore Koobface's zombie infrastructure and analyze one month of the botnet's activity within both Facebook and Twitter. Constructing a zombie emulator, we are able to infiltrate the Koobface botnet to discover the identities of fraudulent and compromised social network accounts used to distribute malicious links to over 213,000 social network users, generating over 157,000 clicks. Despite the use of domain blacklisting services by social network operators to filter malicious links, current defenses recognize only 27% of threats and take on average 4 days to respond. During this period, 81% of vulnerable users click on Koobface spam, highlighting the ineffectiveness of blacklists.
AB - As millions of users flock to online social networks, sites such as Facebook and Twitter are becoming increasingly attractive targets for spam, phishing, and malware. The Koobface botnet in particular has honed its efforts to exploit social network users, leveraging zombies to generate accounts, befriend victims, and to send malware propagation spam. In this paper, we explore Koobface's zombie infrastructure and analyze one month of the botnet's activity within both Facebook and Twitter. Constructing a zombie emulator, we are able to infiltrate the Koobface botnet to discover the identities of fraudulent and compromised social network accounts used to distribute malicious links to over 213,000 social network users, generating over 157,000 clicks. Despite the use of domain blacklisting services by social network operators to filter malicious links, current defenses recognize only 27% of threats and take on average 4 days to respond. During this period, 81% of vulnerable users click on Koobface spam, highlighting the ineffectiveness of blacklists.
UR - http://www.scopus.com/inward/record.url?scp=78651408354&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=78651408354&partnerID=8YFLogxK
U2 - 10.1109/MALWARE.2010.5665793
DO - 10.1109/MALWARE.2010.5665793
M3 - Conference contribution
AN - SCOPUS:78651408354
SN - 9781424493555
T3 - Proceedings of the 5th IEEE International Conference on Malicious and Unwanted Software, Malware 2010
SP - 63
EP - 70
BT - Proceedings of the 5th IEEE International Conference on Malicious and Unwanted Software, Malware 2010
T2 - 5th International Conference on Malicious and Unwanted Software, Malware 2010
Y2 - 19 October 2010 through 20 October 2010
ER -