Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

DO YOU REALLY KNOW ALL YOUR LINKEDIN CONNECTIONS? IMPOSTERS IN SOCIAL NETWORKS175conduct in an academic setting or major noncommercial laboratory due to stringent ethicalrequirements those institutions have on studies dealing with human subjects. Hence, industryis normally where such efforts occur, and for obvious reasons, most firms would likelyprefer not to disclose the results. This is why the Robin Sage experiment is important: it isperhaps the only publically available study that clearly demonstrates how such transitivetrust relationships can propagate in a real-world online setting and thus shows how it couldsignificantly aid an adversary in intelligence gathering.On the other hand, though the “Robin Sage” experiment proved to be highly insightful, wehave to consider an important aspect of this trial that somewhat divorces it from reality.Thomas Ryan himself is an information security professional who regularly interacts (legitimately)with many of the individuals who befriended Robin Sage. In fact, Ryan initiallytargeted certain individuals in the security community 10 and personally interacted withmany of Sage’s “connections” under the assumed persona. 11 Effectively, Ryan introduceda potentially confounding variable into the mix: himself. His personal and expert knowledgeof the community that he was attempting to infiltrate through the Robin Sage identify madehim a formidable opponent. In the real world, an adversary would likely have to go throughsignificant initial intelligence collection in order to achieve knowledge close to Ryan’s.Another potentially confounding factor is the fact that Thomas Ryan would not allow thosewho discovered Robin Sage’s true identity to divulge the information to the greater community.For instance, Omachonu Ogali researched Robin Sage, found her to be a fraud, andposted this information to her Facebook wall. He was subsequently contacted by Ryanand told to keep the true identify a secret. 12 This is an important aspect to consider the weaknessof a social network exploited by Ryan—the ease at which individuals trust each other—may also be its strength—as an unknown party claiming that Robin Sage is untrustworthy (an“out-er”) may also be readily trusted by those in the community. Unfortunately, the extent atwhich individuals believe an unknown “out-er” versus a potential imposter, and what factorsaffect this race condition were not studied in the Robin Sage case due to Ryan’s experimentalsetup. However, this may be an interesting avenue for future work.Getting Your Personal Data Compromised While Trying to Impressthe Boss: The Case of the SACEUR ImposterAbout 2 years after the Robin Sage experiment, a real-world Facebook imposter was able tocollect a few high-level connections from NATO headquarters. In early 2012, several seniorBritish military officers accepted friend requests on Facebook from an account belonging toAmerican Admiral James Stavridis, the Supreme Allied Commander of European Forces(SACEUR) or NATO commander. However, it turned out that the account was a fake, andgranting the friend request made their accounts susceptible to harvesting personal data bythe imposter. Facebook quickly deactivated the bogus account. Representatives from theSupreme Headquarters of Allied Powers Europe (SHAPE) confirmed the incident but werequick to label it as mere “social engineering” and not “hacking” or “espionage.” 13It is likely that those who set up the fake Facebook account of the SACEUR were nottargeting Admiral Stavridis, but rather other higher-level individuals in the organization.If the goal was to quickly obtain some limited personal information about such individuals,