Download as PDF, PPTX
![#SNAP_R
Selecting the
Best
Clustering
Model
19
! Many algorithms
! Many hyperparameters
! Max avg. score [-1,..,1]
! 0.5-0.7 reasonable structure](https://image.slidesharecdn.com/weaponizing-data-science-for-social-engineering-automated-e2e-spear-phishing-on-twitter-161124071059/85/Weaponizing-data-science-for-social-engineering-automate-E2E-spear-phishing-on-twitter-19-320.jpg)
Uploaded byPriyanka Aash
Weaponizing data science for social engineering: automate E2E spear phishing on twitter
The document discusses the use of automated data science techniques for spear phishing on Twitter, highlighting the effectiveness of these methods in phishing attacks with success rates of over 30% for fully automated approaches. It details the design and implementation of a machine learning tool that generates convincing tweets for phishing and analyzes target profiles for high engagement potential. The authors emphasize the implications for social engineering and the importance of security awareness, noting that while their work is intended for defense, similar tools could easily be weaponized by malicious actors.
More Related Content
Weaponizing data science for social engineering: automate E2E spear phishing on twitter
- 1. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter John Seymour | Philip Tully 1
- 2. #SNAP_R You care aboutphishing on social media 2
- 3.
- 4.
- 5. #SNAP_R #whoami 5 John Seymour @_delta_zero Philip Tully @phtully DataScientist at ZeroFOX Senior Data Scientist at ZeroFOX Ph.D. student at UMBC Ph.D. student at University of Edinburgh & Royal Institute of Technology Researches Malware Datasets Brain Modeling & Artificial Neural Nets
- 6. #SNAP_R A Novel PhishingCampaign Design 6 Level of Effort SuccessRate Our$#SNAP_R Fully+Automated >30%+Accuracy Spear$Phishing Highly+Manual 45%+Accuracy Phishing Mostly+Automated 5?14%+Accuracy Low High LowHigh
- 7. #SNAP_R Fooling Humans for50 Years 7 ! Microsoft AI ! Deep Neural Network 1966: ELIZA Chatbot 2016: @TayandYou ! Joseph Weizenbaum, MIT ! Parsing & keyword replacement
- 8. #SNAP_R InfoSec ML HistoricallyPrioritizes Defense 8
- 9. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter Machine Learning on Offense 9 Automated Target Discovery Automated Social Spear Phishing Evaluation and Metrics Results and Demo Wrap Up
- 10. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter 10 Machine Learning on Offense
- 11. #SNAP_R Why Twitter? 11 !Bot-friendly API !Colloquialsyntax !Shortened links !Trusting culture !Incentivized data disclosure
- 12.
- 13. #SNAP_R #SNAP_R Twitter Profiles Phishing Offense Techniques,Tactics and Procedures ! Our ML Tool... ! Shortens payload per unique user ! Auto-tweets at irregular intervals ! Triages users wrt value/engagement ! Prepends tweets with @mention ! Obeys rate limits ! We added... ! Post non-phishing posts ! Build believable profile 13
- 14. #SNAP_R Design Flow 14 is_target(user) get_timeline(depth) gen_markov_tweet() gen_nn_tweet() schedule_tweet_and_sleep()post_tweet_and_sleep() #SNAP_R Twitter Profiles Phishing Offense
- 15. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter 15 Automated Target Discovery
- 16. #SNAP_R Triage of HighValue Targets on Twitter 16 ! Accessible personal info ! Historical profile posts ! Heterogeneous data ! Text, images, urls, stats, dates
- 17. #SNAP_R Extracting Features from GETusers/lookup ! Engagement: following/followers ! #myFirstTweet ! Default settings ! Description content ! Account age 17
- 18. #SNAP_R Clustering Predicts HighValue Users 18 Eric+SchmidtEric+Schmidt 18
- 19. #SNAP_R Selecting the Best Clustering Model 19 ! Manyalgorithms ! Many hyperparameters ! Max avg. score [-1,..,1] ! 0.5-0.7 reasonable structure
- 20. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter 20 Automated Social Spear Phishing
- 21. #SNAP_R Recon and Footprintingfor Profiling ! Compute histogram of tweet timings (binsize = 1 hour) ! Random minute within max hour to tweet ! Bag of Words on timeline tweets ! Select most commonly occurring non- stopword ! We seed the neural network with topics that the user frequently posts about 21
- 22. #SNAP_R Leveraging Markov Models !Popular for text generation: see /r/SubredditSimulator, InfosecTalk TitleBot ! Calculates pairwise frequency of tokens and uses that to generate new ones ! Based on transition probabilities ! Trained using most recent posts on the user’s timeline 22 I don’t like ML infosec . 0.38 0.62 1 0.460.54 1 1 1 1
- 23. #SNAP_R Training a RecurrentNeural Network ! Hosted on Amazon EC2 ! Trained on g2.2xlarge instance (65¢ per hour) ! Ubuntu (ami-c79b7eac) ! Training set > 2M tweets ! Took 5.5 days to train ! 3 layers, ~500 units/layer 23 LSTM+=+Long+Short?Term+Memory Illustration: Chris Olah (@ch402) LSTMs: Hochreiter & Schmidhuber, 1997
- 24. #SNAP_R Tradeoffs and Caveats 24 LSTMMarkov Chain Training Speed Days Seconds Accuracy High Medium Availability Public Public Size Large Small Caveats • Deeper representation of natural language, generalizes well • Retraining required for new languages • Overfits to each user, can create temporally irrelevant tweets • Performs poorly on users with few tweets Metric Model
- 25. #SNAP_R Language and SocialNetwork Agnosticism ! Markov models only use content on user’s timeline, which means they can automatically generate content in other languages ! For neural nets, you’d only need to scrape data from the target language and retrain ! Both of these methods can also be applied to other social networks 25
- 26. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter 26 Evaluation and Metrics
- 27. #SNAP_R Here’s a maliciousURL... 27
- 28. #SNAP_R And, apparently goo.gllets us shorten it! 28
- 29. #SNAP_R goo.gl also givesus analytics 29
- 30. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter 30 Results and Demo
- 31.
- 32. #SNAP_R Pilot Experiment ! Via#SNAP_R we sent 90 “phishing” posts out to people using #cat ! After 2 hours, we had 17% clickthrough rate ! After 2 days, we had between 30% and 66% clickthrough rate ! Inside the Data ! goo.gl showed 27 clickthroughs (30%) came from a t.co referrer ! Unknown referrers might be caused by bots ! With unique locations, clickthrough rate may be as high as 66% 32
- 33. #SNAP_R Man vs. Machine2 Hour Bake Off 33 Person SNAP_R Total Targets ~200 819 Tweets/minute 1.67 6.85 Click-throughs 49 275 Observations • Copy/Pasting messages to different hashtags • Arbitrarily scalable with the number of machines Metric User
- 34.
- 35. #SNAP_R Weaponizing Data Science forSocial Engineering: Automated E2E Spear Phishing on Twitter 35 Wrap Up
- 36. #SNAP_R Potential Use Cases !Social media security awareness ! Social media security education ! Automated internal pentesting ! Social engagement ! Staff Recruiting 36 #SNAP_R Twitter Profiles Phishing Offense
- 37. #SNAP_R Mitigations ! Ofcourse, we’re white hats here… ! But machine learning is rapidly becoming automated, so black hats would have this capability soon. ! Protected accounts are immune to timeline scraping, which defeats the tool ! Bots can be detected ! Standard mitigations apply: ! Don’t click on links from people you don’t know ! Report! Twitter is pretty good at flagging spam accounts ! Maybe URL shorteners should be responsible for malware? 37 #SNAP_R Twitter Profiles Phishing Offense
- 38. #SNAP_R Black Hat SoundBytes ! Machine learning can be used offensively to automate spear phishing ! Machine-generated grammar is bad, but Twitter users DGAF ! Abundant personal data is publicly accessible and effective for social engineering 38 #SNAP_R Twitter Profiles Phishing Offense
- 39. #SNAP_R39 We’ll also beat the booth immediately after the presentation! John Seymour @_delta_zero Philip Tully @phtully ?