The Koobface botnet and the rise of social malware
- 1 October 2010
- conference paper
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
Abstract
As millions of users flock to online social networks, sites such as Facebook and Twitter are becoming increasingly attractive targets for spam, phishing, and malware. The Koobface botnet in particular has honed its efforts to exploit social network users, leveraging zombies to generate accounts, befriend victims, and to send malware propagation spam. In this paper, we explore Koobface's zombie infrastructure and analyze one month of the botnet's activity within both Facebook and Twitter. Constructing a zombie emulator, we are able to infiltrate the Koobface botnet to discover the identities of fraudulent and compromised social network accounts used to distribute malicious links to over 213,000 social network users, generating over 157,000 clicks. Despite the use of domain blacklisting services by social network operators to filter malicious links, current defenses recognize only 27% of threats and take on average 4 days to respond. During this period, 81% of vulnerable users click on Koobface spam, highlighting the ineffectiveness of blacklists.Keywords
This publication has 3 references indexed in Scilit:
- Your botnet is my botnetPublished by Association for Computing Machinery (ACM) ,2009
- SpamalyticsPublished by Association for Computing Machinery (ACM) ,2008
- A multifaceted approach to understanding the botnet phenomenonPublished by Association for Computing Machinery (ACM) ,2006