Measuring and Mitigating OAuth Access Token Abuse by Collusion Networks.
We uncovered a thriving ecosystem of large-scale reputation manipulation services on Facebook that leverage the principle of collusion. Collusion networks collect OAuth access tokens from colluding members and abuse them to provide fake likes or comments to their members. We carried out a comprehens...
| Publicado en: | Communications of the ACM Vol. 63; no. 5; pp. 103 - 112 |
|---|---|
| Autores principales: | , , , |
| Formato: | Artículo |
| Publicado: |
Association for Computing Machinery
May2020
|
| Materias: | |
| Acceso en línea: | Ver este registro en EBSCOhost |
| fields | @attributes: recordID: 1 pdfLink: plink: https://search.ebscohost.com/login.aspx?direct=true&db=hlh&AN=144780557&site=ehost-live header: @attributes: shortDbName: hlh uiTerm: 144780557 longDbName: Humanities International Complete uiTag: AN controlInfo: bkinfo: jinfo: jid: 00010782 ACM jtl: Communications of the ACM issn: 00010782 maglogo: N pubinfo: dt: May2020 vid: 63 iid: 5 pid: 68 pub: Association for Computing Machinery artinfo: ui: 144780557 10.1145/3387720 ppf: 103 ppct: 9 formats: tig: atl: Measuring and Mitigating OAuth Access Token Abuse by Collusion Networks. aug: au: Farooqi, Shehroze Zaffar, Fareed Leontiadis, Nektarios Shafiq, Zubair affil: The University of Iowa, Iowa City, IA, USA Facebook, Washington, D.C., USA Lahore University of Management Sciences, Lahore, Pakistan su: Facebook (Web resource) Collusion Application software Reputation Fraud Likes & dislikes sug: subj: Facebook (Web resource) Collusion Application software Reputation Fraud Likes & dislikes ab: We uncovered a thriving ecosystem of large-scale reputation manipulation services on Facebook that leverage the principle of collusion. Collusion networks collect OAuth access tokens from colluding members and abuse them to provide fake likes or comments to their members. We carried out a comprehensive measurement study to understand how these collusion networks exploited popular third-party Facebook applications with weak security settings to retrieve OAuth access tokens. We infiltrated popular collusion networks using honeypots and identified more than one million colluding Facebook accounts by "milking" these collusion networks. We disclosed our findings to Facebook and collaborated with them to implement a series of countermeasures that mitigated OAuth access token abuse without sacrificing application platform usability for third-party developers. pubtype: Periodical doctype: Article src: R language: English refInfo: copyright: @attributes: flag: Y dt: @attributes: year: 2020 holdings: @attributes: islocal: N |
|---|