Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label...
Transcript of Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label...
![Page 1: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/1.jpg)
Fifteen Minutes of Unwanted Fame: Detecting and Characterizing
Doxing Peter Snyder* – Periwinkle Doerfler+ – Chris Kanich* – Damon McCoy+
1
* +
![Page 2: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/2.jpg)
Overview
• Doxing is a targeted form of online abuse
• Prior work is qualitative or on defensive techniques
• We don't understand the scale or targets of problem
• This work is the first quantitative, large scale measurement of doxing
2
![Page 3: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/3.jpg)
Outline•Problem area
•Measurement methodology
•Results and findings
•Discussion and conclusions
3
![Page 4: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/4.jpg)
Outline•Problem area
•Measurement methodology
•Results and findings
•Discussion and conclusions
4
![Page 5: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/5.jpg)
What is Doxing? (1/2)• Method of targeted online abuse
• Attackers compile sensitive information about the target
• Personal: Name, addresses, age, photographs, SSN
• Relationships: Family members, partners, friends
• Financial: Work history, investments, CCN
• Online: Email, social network accounts, passwords, IPs
5
![Page 6: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/6.jpg)
What is Doxing? (2/2)• Information is compiled into plain text files
• Released "anonymously"
• Text sharing sites (e.x. pastebin.com, skidpaste.com)
• Online forums (e.x. 4chan, 8chan)
• Torrents
• IRC, Twitch, social networks, etc.
6
![Page 7: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/7.jpg)
====================================================Full Name: █████ ██████Aliases> ████████████
Age: ██DOB: ██/██/████
Address: ██ ███████ █████ ███████████, ███████ ██████ // ConfirmedMobile Number: +█ (███) ███-████ // ConfirmedEmail: ██████████@███████.███ // Confirmed
Illness: Asthma====================================================ISP Records>ISP: Rogers Cable // PreviousIP Address: ███.███.███.███ // Previous====================================================Parental Information> Father: █ █ ██████Age: ██
7
![Page 8: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/8.jpg)
Aliases) ███████████, ███████████, █████Name) ██████ ████
DOB █/██/██
Address) ██ █ ████ █, ██████, ██ █████
Cell Phone) ███-███-████ – Sprint, MobileCaller ID) ██████ ████Old Home Phone) ███-███-████ – CenturyLink, Landline
Last 4 of Mastercard) ████
Emails) ██████████████@█████.███, ████████@█████.███
Snapchat) ███████████Twitter) @███████████Facebook) https://facebook.com/█████████, ███████████Skype) █████████, ████████
8
![Page 9: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/9.jpg)
Doxing Harms
9
![Page 10: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/10.jpg)
Frequency, Targets and Effects
• Prior work is based in qualitative or preventative / risk management approaches
• Research Questions:
1. How frequently does doxing happen?
2. What information is shared in doxes? Who is targeted?
3. What is knowable about the large scale effects and harms?
4. Are anti-abuse tools effective?
10
![Page 11: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/11.jpg)
Outline•Problem area
•Measurement methodology
•Results and findings
•Discussion and conclusions
11
![Page 12: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/12.jpg)
Steps to Protect Victims
• Worked closely with IRBs; multiple rounds of study design
• Only recorded publicly available data, careful to not use it to record data
• Careful data storage / analysis methods: only recorded high level summary data
• Data protection best practices (key based encryption, single data store, strict access controls)
12
![Page 13: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/13.jpg)
General Measurement Strategy
• Find places online where doxes are frequently shared
• Train a classifier to determine how much activity is doxing
• Measure extracted doxes to determine contained information
• Watch the OSN accounts of doxing victims for abuse
13
![Page 14: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/14.jpg)
1.73m files Not Dox
1,002 files Duplicate
4,328files
5,330files
Dox De-Duplication - Sec 3.1.4
748 345 245117 328 127
5,330files
138k
4Chanb
144k
4Chanpol
3.4k
8Chpol
512
8Chbaphomet
Dox Classifier - Sec 3.1.2
1.45m
Pastebin
OSN Extractor - Sec 3.1.3
Social Network Account Verifier & Scraper - Sec 3.1.5
552 Acct 228 Acct 305 Acct 200 Acct
Dox Collection Pipeline
• Fully automated
• Single IP at the University of Illinois at Chicago
• Two recording periods:
• Summer of 2016
• Winter of 2016
14
![Page 15: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/15.jpg)
1.73m files Not Dox
1,002 files Duplicate
4,328files
5,330files
Dox De-Duplication - Sec 3.1.4
748 345 245117 328 127
5,330files
138k
4Chanb
144k
4Chanpol
3.4k
8Chpol
512
8Chbaphomet
Dox Classifier - Sec 3.1.2
1.45m
Pastebin
OSN Extractor - Sec 3.1.3
Social Network Account Verifier & Scraper - Sec 3.1.5
552 Acct 228 Acct 305 Acct 200 Acct
Text File Collection• Data recorded from
• pastebin.com
• 4chan.org (pol, b)
• 8ch.net (pol, baphomet)
• Selected because:
• "Original" sources of doxes
• Anecdotal reputation for doxing
15
![Page 16: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/16.jpg)
1.73m files Not Dox
1,002 files Duplicate
4,328files
5,330files
Dox De-Duplication - Sec 3.1.4
748 345 245117 328 127
5,330files
138k
4Chanb
144k
4Chanpol
3.4k
8Chpol
512
8Chbaphomet
Dox Classifier - Sec 3.1.2
1.45m
Pastebin
OSN Extractor - Sec 3.1.3
Social Network Account Verifier & Scraper - Sec 3.1.5
552 Acct 228 Acct 305 Acct 200 Acct
Text File Classification
• Scikit-learn, TfidfVectorizer, SGDClassifier
• Training Data:
• Manual labeling of Pastebin crawl
• "proof-of-work" sets
16
![Page 17: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/17.jpg)
Text File ClassificationLabel Precision Recall # Samples
Dox 0.81 0.89 258
Not 0.99 0.98 3,546
Avg / Total 0.98 0.98 3,804
17
![Page 18: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/18.jpg)
1.73m files Not Dox
1,002 files Duplicate
4,328files
5,330files
Dox De-Duplication - Sec 3.1.4
748 345 245117 328 127
5,330files
138k
4Chanb
144k
4Chanpol
3.4k
8Chpol
512
8Chbaphomet
Dox Classifier - Sec 3.1.2
1.45m
Pastebin
OSN Extractor - Sec 3.1.3
Social Network Account Verifier & Scraper - Sec 3.1.5
552 Acct 228 Acct 305 Acct 200 Acct
Social Networking Account Extractor
• Extract social networking accounts
• Custom, heuristic-based identifier
• Evaluated on 125 labeled doxes
18
![Page 19: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/19.jpg)
Social Networking Account Extractor
% Doxes Including Extractor Accuracy
Instagram 11.2 95.2
Twitch 9.7 95.2
Google+ 18.4 90.4
Twitter 34.4 86.4
Facebook 48.0 84.8
YouTube 40.0 80.0
19
![Page 20: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/20.jpg)
1.73m files Not Dox
1,002 files Duplicate
4,328files
5,330files
Dox De-Duplication - Sec 3.1.4
748 345 245117 328 127
5,330files
138k
4Chanb
144k
4Chanpol
3.4k
8Chpol
512
8Chbaphomet
Dox Classifier - Sec 3.1.2
1.45m
Pastebin
OSN Extractor - Sec 3.1.3
Social Network Account Verifier & Scraper - Sec 3.1.5
552 Acct 228 Acct 305 Acct 200 Acct
Dox De-duplication
• Similar doxes, identical target
• Hash based comparison fragile to marginal updates
• Compare referenced OSN accounts
• ~14.2% of doxes were duplicates
20
![Page 21: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/21.jpg)
1.73m files Not Dox
1,002 files Duplicate
4,328files
5,330files
Dox De-Duplication - Sec 3.1.4
748 345 245117 328 127
5,330files
138k
4Chanb
144k
4Chanpol
3.4k
8Chpol
512
8Chbaphomet
Dox Classifier - Sec 3.1.2
1.45m
Pastebin
OSN Extractor - Sec 3.1.3
Social Network Account Verifier & Scraper - Sec 3.1.5
552 Acct 228 Acct 305 Acct 200 Acct
Social Network Status Watcher
• Repeatedly visit referenced OSN accounts
• After 1, 2, 3, 7, 14… days
• Only record the status of the account:
• public, private, inactive
• Single IP @ UIC
21
![Page 22: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/22.jpg)
Manual Dox Labeling• Randomly selected 464 doxes
• Manually label each dox to understand the contents.
• Did it include name, address, phone #, email, etc.?
• Age and gender of the target (if included)
• Categorization of the victim
• Categorization of the motive of attacker
22
![Page 23: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/23.jpg)
Collection StatisticsStudy Period Summer 2016 Winter 2016-17 Combined
Text Files Recorded 484,185 1,253,702 1,737,887
Classified as Dox 2,976 2,554 5,530
Doxes w/o Duplicates 2,326 2,202 4,528
Manually Labeled 270 194 464
23
![Page 24: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/24.jpg)
Outline•Problem area
•Measurement methodology
•Results and findings
•Discussion and conclusions
24
![Page 25: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/25.jpg)
Outline
•Results and findings
•Doxing targets
•Doxing perpetuators
•Effects on social networks25
![Page 26: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/26.jpg)
Doxing Targets
26
![Page 27: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/27.jpg)
Victim Demographics
• Taken from the 464 manually labeled doxes
• Only based on data in doxes
• Careful to avoid further harm (e.g. not taking demographic data from OSN accounts)
Min Age 10 years old
Max Age 74 years old
Mean Age 21.7 years old
Gender, Female 16.3%
Gender, Male 82.2%
Gender, Other 0.4%
Located in USA64.5%
(of 300 files thatincluded address)
27
![Page 28: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/28.jpg)
Types of Data in Doxes
Category # of Doxes % of Doxes*
Address 422 90.1%
Phone # 284 61.2%
Family Info 235 50.6%
Email 249 53.7%
Zip Code 227 48.9%
Date of Birth 155 33.4%
Frequently Occurring Data Highly Sensitive Data
*All numbers from 464 manually labeled doxes
Category # of Doxes % of Doxes*
School 48 10.3%
ISP 100 21.6%
Passwords 40 8.6%
Criminal Record 6 1.3%
CCN 20 4.3%
SSN 10 2.6%
28
![Page 29: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/29.jpg)
Doxing Victims by Community
• Categorization of victim based on listed OSN accounts
• 16.2% of victims categorizable into 3 categories
Category Criteria # of Labeled
% of Labeled
Hacker 2 or more OSN accounts on hacking sites(e.g. hackforums.net) 17 3.7%
Gamer 2 or more OSN accounts on gaming sites(e.g. twitch.tv, minecraftforum.net) 53 11.4%
Celebrity Labelers recognized target independent of doxing(e.g. Donald Trump, Hillary Clinton) 5 1.1%
Total 75 16.2%29
![Page 30: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/30.jpg)
Doxing Perpetrators
30
![Page 31: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/31.jpg)
Doxer Motivations• Categorization of doxers based on "why I did it" suffixes
• 28.4% of dox motivations categorizable into 4 categories
Category Criteria # of Labeled
% of Labeled
Competitive Demonstrating attacker's capabilities /victim's weaknesses 7 1.5%
Revenge Because of doxee's actions against doxer(e.g. "you cheated in counterstrike.") 52 11.2%
Justice Because of doxee's actions against third party(e.g. "you ripped off my friend") 68 14.7%
Political Because of larger political goal(attacking KKK members or child pornographers) 5 1.1%
Total 132 28.4%
31
![Page 32: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/32.jpg)
Doxer Networks
• Looked for doxer networks based on "credit lines"
• ex: "by Alice and @Bob, thx to Charlie (@Charlie for SSN)"
• 251 aliases given, 213 twitter handles
• Undirected graph from doxes and twitter network
32
![Page 33: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/33.jpg)
Doxer Networks• 61 (of 251) aliases appear in cliques of 4 or more
• 34 Twitter accounts were private
33
![Page 34: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/34.jpg)
Harms from Doxing
34
![Page 35: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/35.jpg)
Effects on OSN Accounts1. Are OSN accounts in dox files more likely to increase
privacy settings?
• 13,392 "background" vs "doxxed" OSN accounts
2. Does OSN abuse filtering reduce the impact of doxing on OSN accounts?
• Before and after increased OSN abuse filtering
35
Fall 2016Facebook and Instagram
add abuse filtering
Summer 2016First recording
period
Winter 2016Second recording
period
![Page 36: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/36.jpg)
Doxed vs. Non-Doxed Accounts
Account Condition % More Private
% MorePublic
% AnyChange Total #
Instagram default 0.1 0.1 0.2 13,392
Instagram doxed,pre-filtering 17.2 8.1 32.2 87
Instagram doxed,post-filtering 5.7 1.4 9.9 141
Facebook doxed,pre-filtering 22.0 2.0 24.6 191
Facebook doxed,post-filtering 3.0 <0.1 3.3 361
36
![Page 37: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/37.jpg)
Facebook accounts that changed status, Pre-filtering (22.5%)
Facebook accounts that changed status, Post-filtering (1.7%)
Facebook Statues after Doxing
37
![Page 38: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/38.jpg)
Instagram accounts that changed status, Pre-filtering (13.8%)
Instagram accounts that changed status, Post-filtering (5.0%)
Instagram Statues after Doxing
38
![Page 39: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/39.jpg)
Outline•Problem area
•Measurement methodology
•Results and findings
•Discussion and conclusions
39
![Page 40: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/40.jpg)
• Notification of doxing victims"Have I Been Pwned" style service
• OSN Account protectionNotify social networks of doxing, for defenses
• Anti-SWAT-ing ListAdditional information for law enforcement to evaluates
• Anti-Abuse Policies From Dox Distributing Sites Working with Pastebin to increase automated takedowns
Using Data to Help Victims
40
![Page 41: Fifteen Minutes of Unwanted Fame: Detecting and Characterizing … · 2020. 9. 2. · Label Precision Recall # Samples Dox 0.81 0.89 258 Not 0.99 0.98 3,546 Avg / Total 0.98 0.98](https://reader033.fdocuments.us/reader033/viewer/2022060807/608c6f2ed24b7358664633ce/html5/thumbnails/41.jpg)
Take Aways
• Automatic dox measurement and classification pipeline
• 1.7m text files, 4,328 doxes, manual labeling of 464
• First quantitative analysis of frequency, targets and contents of doxing online
• Measurement of harm of doxing, via OSN account change
41