4.1.2. Fake profiles
At the time of writing, the only requirement for the creation of
a social networking account is a valid e-mail address, which
makes it rather easy for attackers to create fake accounts. A
study by Sophos published in 2007 with randomly chosen
Facebook users showed that approximately 41% of social
networking users accepted friendship requests from a fake
profile (Sophos, 2007). Ryan and Mauch (The Robin Sage
Experiment) further showed that fake profiles can be misused
to infiltrate social networks: they set up a profile for a
fictional American cyber threat analyst, called “Robin Sage”,
and were able to gain access to sensitive information in the
military and information security community. Bilge et al.
(2009) outlined two sophisticated fake profile attacks that
could be used to infiltrate the trusted circles of social
networking users: profile cloning attacks, where attackers
clone existing user profiles and attempt to “reinvite” their
friends, and cross-profile cloning attacks, where attackers
create a cloned profile on an online social network where the
target user does not yet have a profile and then contact the
targets' friends. If a user, for example, has a Facebook account
but no LinkedIn account, an attacker could clone the Facebook
profile to create a LinkedIn profile and then contact the target's
Facebook friends who are also on LinkedIn. Bilge et al. showed
that their attacks can be fully automated and are feasible in
practice. If an attacker is able to create fake accounts on a
large scale, Sybil attacks on OSNs are possible. OSN providers
therefore use various protection mechanisms to limit the
creation of large amounts of fake accounts (Stein et al., 2011).
Boshmaf et al. (2011) however found that OSNs can be infiltrated
on a large scale. They evaluated how vulnerable OSNs
are to a large-scale infiltration by socialbots e computer programs
that control OSN accounts and mimic real users. The
authors created a Socialbot Network (SbN): a group of adaptive
socialbots that are orchestrated in a command-and-control
fashion on Facebook. The authors used 102 fake profiles to
send friendship requests to 5053 randomly selected Facebook
users. 19.3% of these users accepted the friendship requests.
Next, the SbN tried to infiltrate the circle of friends of the users