Untitled Document
The World Wide Web is rapidly evolving into a "social Web" that is
dominated by user-generated content and user-centric social interactions. For
example, the most popular social Web site, Facebook, currently has more than
175 million active users who are spending more than 3 billion minutes on the
site every day. This unprecedented growth has prompted enterprises to accept
and even encourage the use of the social Web in the workplace to promote business
activities and facilitate work-related communications.
Although this evolution enhances the value and usability of the Web, it also
presents a number of security challenges for consumers and enterprise users.
These challenges can be broadly categorized into three distinct classes:
- Traditional attacks
- Socially enhanced attacks
- Social Web-specific attacks
Traditional attacks
First, traditional attacks that have plagued Internet users for many years
have been adapted to take advantage of the unique properties of the social Web.
Due to the massive size of social Web sites, their tightly connected nature,
and their relatively naive user bases, these sites are prime targets for malware
propagation. One of the most famous incidents of malware propagation in the
social Web was the "Samy worm." This worm was launched within the
MySpace community, and it compromised more than one million profiles over the
course of a single day by sending fake "friend requests." Fortunately,
the victimized profiles were eventually restored, but the worm's propagation
rate and overall infiltration into the site clearly illustrate the amount of
damage that worms can inflict in the social Web.
Socially enhanced attacks
In addition to propagating malware, attackers are bombarding the social Web
with spam and deceiving users with phishing attacks. However, these new spam
and phishing campaigns are more dangerous than traditional attacks against email
systems because they are far more personalized. By leveraging the social Web
to identify sensitive information about targeted users (e.g., demographics,
friendships, etc.), attackers can generate user-specific content to maximize
the potency of their attacks. Thus, the second social Web attack class consists
of "socially enhanced" attacks that are more difficult to counter
due to this additional layer of deception.
-1-