Attackers use fake friends to blend into Facebook

A new Barracuda Labs study provides an example of an increasing number of attackers move to social networks to carry out their wares.

The study analyzes a random sampling of 2,884 active Facebook accounts to identify key differences between average real user accounts and fake accounts created by attackers and spammers.

Highlighted findings from the Barracuda Labs study include:

• Almost 60 percent of fake accounts claim to be bisexual, 10 times more than real users
• Fake accounts have six times more friends than real users, 726 versus 130
• Fake accounts use photo tags over 100 times more than real users, 136 tags per four photos versus one tag per four photos
• Fake accounts almost always (97 percent) claim to be female, as opposed to 40 percent for real users.

“Likes, News Feeds and Apps have helped lead Facebook to its social network dominance and now attackers are harnessing those same features to efficiently scale their efforts,” said Dr. Paul Judge, chief research officer at Barracuda Networks. “These fake profiles and apps give attackers a long-lived path to continuously present malicious links to innocent users.

“Also, researchers have shown how friending malicious accounts can lead to account takeover using Facebook’s trusted friend account recovery,” Judge continued. “We have analyzed thousands of fake accounts to determine features and patterns that distinguish them from real users, and created a feature-based heuristic engine to distinguish real users from fake profiles.”

The study analyzes data collected from Barracuda Profile Protector, a free tool that analyzes and blocks malicious activity on Facebook and Twitter, along with public data collected from streams and network crawling to demonstrate how users typically operate.

The study illustrates how attacks on Facebook are structured to exploit the “friendship” concept and trust of widely-used applications. A variety of machine learning techniques are used to analyze shared URLs, profile images, profile information, and connections with other users to reveal associations, weak and strong, between malicious users.