Evaluating Attack Amplification in Online Social Networks

Many online social networking websites allow arbitrary Web users to easily add popular users, such as famous celebrities and musicians, into their circle of friends. Such popular users, or “hubs,” have a large number of connections in the social network. However, most online social networks treat such hubs in much the same way as they do ordinary users in terms of security and privacy. In this paper, we experimentally demonstrate the dangers of not differentiating between hubs and ordinary users. In particular, we show how malicious social network users can leverage their connections with hubs to amplify misdeeds, such as small-scale DDoS attacks and botnet command and control. While instances of these attacks can readily be detected and prevented using previously proposed techniques, the ease with which a social networking user can abuse connections with hubs is a worrisome attack vector. This work also underscores the need for online social networks to have better access control policies for such hubs, e.g., in how users can interact with such hubs. We conclude with design requirements for online social networking websites that would protect against amplicification attacks and yet preserve the freedom of Web users and the openness of social networks.