Using social networks to harvest email addresses
Using social networks to harvest email addresses
复制标题
使用社交网络收集电子邮件地址
DOI：
--
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
E. Markatos
中科院分区：
文献类型：
--
作者：
Iasonas Polakis;Georgios Kontaxis;S. Antonatos;Eleni Gessiou;Thanasis Petsas;E. Markatos
社交网络是最受欢迎的互联网活动之一，拥有来自世界各地的数百万会员。然而，用户并没有意识到其中涉及的隐私风险。即使他们保护自己的私人信息，他们的名字也足以被用于恶意目的。在本文中，我们演示和评估如何从社交网络中提取的名称可以用来收获电子邮件地址作为个性化网络钓鱼活动的第一步。我们的盲采集技术使用从Facebook和Twitter网络收集的名称作为Google搜索引擎的查询词，并能够采集近900万个独特的电子邮件地址。我们比较我们的技术与其他收获的方法，如爬行万维网和字典攻击，并表明我们的方法是更可扩展性和效率比其他技术。我们还提出了三个有针对性的收获，旨在收集电子邮件地址加上个人信息，以创建个性化的网络钓鱼电子邮件的技术。通过使用Twitter中的可用信息来缩小搜索空间，并利用Facebook的电子邮件搜索功能，我们能够成功地将43.4%的用户配置文件映射到他们的实际电子邮件地址。此外，我们还从Google Buzz收集个人资料，其中40%的人提供了有效Gmail地址的直接映射。
Social networking is one of the most popular Internet activities with millions of members from around the world. However, users are unaware of the privacy risks involved. Even if they protect their private information, their name is enough to be used for malicious purposes. In this paper we demonstrate and evaluate how names extracted from social networks can be used to harvest email addresses as a first step for personalized phishing campaigns. Our blind harvesting technique uses names collected from the Facebook and Twitter networks as query terms for the Google search engine, and was able to harvest almost 9 million unique email addresses. We compare our technique with other harvesting methodologies, such as crawling the World Wide Web and dictionary attacks, and show that our approach is more scalable and efficient than the other techniques. We also present three targeted harvesting, techniques that aim to collect email addresses coupled with personal information for the creation of personalized phishing emails. By using information available in Twitter to narrow down the search space and, by utilizing the Facebook email search functionality, we are able to successfully map 43.4% of the user profiles to their actual email address. Furthermore, we harvest profiles from Google Buzz, 40% of whom provide a direct mapping to valid Gmail addresses.