4.1.1. Social phishing and context-aware spam
Phishing is a widely-spread threat on the Internet and consists
of an attacker attempting to lure victims into entering sensitive
information like passwords or credit card numbers into a
faked website that is controlled by the attacker. It has been
shown that social phishing (Jagatic et al., 2007), where “social”
information specific to the victim is used, can be extremely
effective compared to regular phishing. Jagatic et al. (2007)
found that when phishing e-mails impersonated a target's
friend, the success rate increased from 16% to 72%. The social
graph is, therefore, not only of value for the social network
operator, but also for attackers. This is the case especially if it
contains additional information like a valid e-mail address or
recent communication between the victim and a friend whom
the attacker can impersonate. With automated data extraction
from social networks, a vast amount of further usable
data becomes available to spammers. Prior conversations
within the social network, such as private messages, comments
or wall posts, could be used to determine the language
normally used for message exchange between the victim and
his friends, as a phishing target might find it very suspicious to
receive a message in English from a friend with whom they
normally communicate in French. Context-aware spam