syssec_red_book

5. Social Networksby such an application are then beyond the control of the social network site.Although online social networks such as Facebook have introduced coarsegrainedaccess-control mechanisms for third-party applications, there is a needfor more fine-grained mechanisms [163].Third-party websites can also use the social pluginsprovided by social network sites such as Facebook[174] in order to personalize their content, allowusers to write feedback for their sites, sharethe page content with their friends in the social networks,or even be authenticated by a social loginplugin. Unfortunately, these plugins also allow third-party websites to accessprivate user data, and allow the social network sites to track user activitiesoutside their platform [239].5.3 What Is the Worst That Can Happen?In the wrong hands, online social networks can be used to disseminate wronginformation, to perform political censorship [375], to bias public opinion [289],and influence users [281]. New types of attack are also emerging in socialnetworks. In a reverse social engineering attack, an adversary aims at trickingvictims into contacting the fake/compromised accounts that are under theattacker’s control, instead of contacting the victims directly [218].Information about people’s social interactions can be exploited as a sidechannelfor different types of attacks. It has been shown [358] that it is possibleto use the public social network data to conduct efficient de-anonymizationattacks against mobility data. One example is that by using the co-authorshipinformation from DBLP, the authors could generate a social network of conferenceattendees, and then leverage it to de-anonymize 80% of the nodes in theInfocom 2006 Bluetooth contact traces. In addition, highly sensitive personalinformation can be inferred from online social networks, even if the user doesnot explicitly like specific posts or pages. Kosinski et al. [241] have shownthat information related to users’ sexual orientation or political views can bepredicted from other activities with a high accuracy.5.4 State of the ArtAs mentioned in Chapter 3, a considerable amount of work has been devotedto the privacy of social network sites. More examples include Persona, whichuses attribute-based encryption and allows users to dictate policies regardingwho may view their information [89], and Safebook, a decentralized andprivacy-preserving online social network application [142].Multiple fake identity (Sybils) attacks on social networks have been usedfor forwarding spam and malware, out-voting honest users, and manipulating38