Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly...

49
SOCIAL ZOMBIES Your Friends Want to Eat Your Brains

Transcript of Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly...

Page 1: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

SOCIAL ZOMBIESYour Friends Want to Eat Your Brains

Page 2: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

STARRING...

Page 3: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

TOM ESTON

Page 4: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

KEVIN JOHNSON

Page 5: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Social Networks“The New Hotness”

Page 6: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the
Page 7: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

225 Million Users

Page 8: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the
Page 9: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

110 Million Users

Page 10: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the
Page 11: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Grew 752% in 2008!

Page 12: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

8 million visitors in march 2009

Page 13: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

“Social networks & Blogs are now the 4th most popular online activity, ahead of personal email.”

-Nielsen Online Report, March 2009

Page 14: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

How do socnets make $$?

Page 15: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

It’s in your Profile!

• More information you share...more $$ it’s worth!

• Targeted advertising

• Sell your Demographic Info

• Sketchy Privacy/ToS Policies....

Page 16: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

In Social networks we Trust...

Page 17: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Trust is Everything!

• It’s how social networks work

• More trust, the better for the socnet!

• Attackers LOVE trust relationships!

Page 18: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Fake Profiles

Page 19: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

It’s built to Exploit Trust

• Who is the person behind the account?

• Bots are Everywhere

• Accounts are easy to create

• Socnet User Verification = FAIL

• Connections based on other “friends”

Page 20: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Privacy Concerns

Page 21: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

25 Random Things About You...

• I’m your friend, I want to know more about you!

• Innocent?

• These are PASSWORD RESET QUESTIONS people!!

Page 22: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Corporate Espionage?

• Very effective in a Penetration test

• Socnet Information = GOLD

• Information Leakage on a Mass Scale!

Page 23: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Default Privacy Settings

• Wide Open for a reason!• Facebook has very good

controls...but...

• Do you know where they are?

• Do your Friends/Family?

• Do They Care?

Page 24: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Security Concerns

• Socnets are #1 Target for Malware

• Spam

• Disinformation

• XSS, CSRF and more!

Page 25: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Twitter Clickjacking & XSS

Page 26: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Return of Koobface

• Recycled ExploitS

• Exploits Trust

• STILL EFFECTIVE!

Page 27: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Social Network Bots

Page 28: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Delivery VIA Socnet API

• Twitter Bots (n0tab0t, Realboy)

• Automated tools and scripts...

Page 29: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Automated Tools

Page 30: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Pay Services

Page 31: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Social Network Botnets?

Page 32: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Facebot POC

• Malicious Facebook APplication (looks normal)

• Turns your PC into a Bot used for DDOS!

Page 33: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Introducing...Kreios C2

Page 34: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Kreios C2 Demo

Page 35: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Browser Based Bots

Page 36: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Browsers and Features... Oh My!

• Browsers are getting more feature-rcih

• Read that as more vulnerable!

• Forget exploiting vulns

• Abuse the features we are provided

Page 37: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Browser Zombies

• JavaScript used to hook the browser

• Other technologies will work

• Many frameworks available

• BeEF

• BrowserRider

• Anehta

Page 38: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

SocNet Delivery

• Embedded applications can insert JavaScript

• Multiple options

• Hook scripts are pushed

• Users are redirected to hook sites

• Why would we allow this!?!?

Page 39: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Oh Yeah Mafia Wars

Page 40: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Server Side Information Collection

Page 41: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Information is Power

• Information gets us access

• Social networks are littered with info

• By how do we connect it together

Page 42: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Third party apps to the rescue

• Third party apps have access to everything

• Permissions are open by default

• Once a user says accept

Page 43: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

API’s FTW

• Myspace and facebook both provide access to an api

• These APIs provide the access we want

• Allows connecting different users

• Based on friends, groups, jobs or interests

Page 44: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Social Butterfly

• Social Butterfly is a third party application

• Runs on attacker controlled servers

• Collects the data from application users

• Crosses the line between different sites

• Fine line before violating TOS!

Page 45: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Social Butterfly DEMO

Page 46: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Prevention

• User Education

• End “opt-In” Socnet Developer Models

• Control API Usage

• Better Account verification

• SPAM Throttling

Page 47: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Conclusions

Page 48: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

MoRe Information

• Facebook Privacy & Security GuideSPYLOGIC.NET

• Kreios C2www.digininja.org

• New website dedicated to Social media security (announced at Defcon)

Page 49: Social Zombies: Your Friends Want to Eat Your Brains€¦ · Social Butterfly •Social Butterfly is a third party application •Runs on attacker controlled servers •Collects the

Questions for the Zombies?