Cyber Crime — Phishing, Malware, Sybil Attacks

🎯 Learning Objectives

• Identify different types of phishing attacks on social media
• Explain how malware propagates through social networks
• Analyze Sybil attacks and their impact on network trust
• Design defense mechanisms against social media cyber crimes
• Evaluate real-world case studies of social media attacks

1. Phishing in Social Media

1.1 Intuition

1.2 Types of Social Media Phishing

1.3 Anatomy of a Phishing Attack

1.4 Detection Features

python
Run Inline
import re
from urllib.parse import urlparse
def check_phishing_indicators(message):
    flags = []
    scores = {
        'suspicious_url': 0,
        'urgency_language': 0,
        'sensitive_request': 0
    }
    # 1. Check for suspicious URLs
    urls = re.findall(r'http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+])+', message)
    for url in urls:
        parsed = urlparse(url)
        domain = parsed.netloc.lower()
        # Check for common tricks
        if 'google' in domain and 'google.com' not in domain:
            scores['suspicious_url'] += 0.6
            flags.append(f"Suspicious domain: {domain}")
        if any(tld in domain for tld in ['.tk', '.ml', '.ga', '.cf']):
            scores['suspicious_url'] += 0.4
    # 2. Check urgency language
    urgency_words = ['urgent', 'immediately', 'act now', 'limited time',
                     'account suspended', 'verify now', 'click here']
    for word in urgency_words:
        if word in message.lower():
            scores['urgency_language'] += 0.2
            flags.append(f"Urgency language: '{word}'")
    # 3. Check for sensitive requests
    sensitive = ['password', 'credit card', 'ssn', 'social security',
                 'login', 'bank account', 'verify your account']
    for word in sensitive:
        if word in message.lower():
            scores['sensitive_request'] += 0.3
            flags.append(f"Sensitive request: '{word}'")
    total_score = sum(scores.values())
    is_phishing = total_score >= 0.5
    return {
        'is_phishing': is_phishing,
        'confidence': min(total_score, 1.0),
        'flags': flags,
        'detail_scores': scores
    }
# Test
messages = [
    "Hey, check out this cool video! https://youtube.com/watch?v=abc",
    "URGENT: Your account will be suspended! Verify now at http://google-login.tk",
    "What time is the meeting tomorrow?"
]
for msg in messages:
    result = check_phishing_indicators(msg)
    print(f"Phishing: {result['is_phishing']} (confidence: {result['confidence']:.2f})")

2. Malware Propagation

2.1 Intuition

2.2 Propagation Model

2.3 Types of Social Media Malware

2.4 Worked Example: Koobface Worm

• S (Susceptible): 1000 users in a network
• I (Infected): 1 initial victim
• R (Recovered): Users who installed antivirus

3. Sybil Attacks

3.1 Intuition

3.2 The Attack Model

3.3 Sybil Defense Mechanisms

3.4 Graph-Based Sybil Detection

python
Run Inline
import networkx as nx
import random
def detect_sybil_nodes(graph, honest_seeds, beta=0.5):
    """
    Detect Sybil nodes using random walk approach.
    Honest seeds are known legitimate users.
    """
    sybil_scores = {}
    for node in graph.nodes():
        # Run short random walks from honest seeds
        walks = 100
        sybil_count = 0
        for _ in range(walks):
            current = random.choice(honest_seeds)
            for step in range(10):  # walk length
                if current == node:
                    sybil_count += 1
                    break
                neighbors = list(graph.neighbors(current))
                if not neighbors:
                    break
                current = random.choice(neighbors)
        sybil_scores[node] = sybil_count / walks
    # Nodes rarely reached from honest seeds are likely Sybil
    return [n for n, s in sybil_scores.items() if s < beta]

4. Defense Strategies

4.1 Multi-Layer Defense

4.2 Best Practices for Social Media Users

5. Common Pitfalls

Pitfall 1: Assuming Phishing is Obvious

Pitfall 2: Underestimating Sybil Attack Reach

Pitfall 3: Ignoring the Human Element

6. Key Concepts Reference

7. 📝 Practice Questions

Q1: A message says "Your Facebook account has been compromised. Click here to secure it: faceb00k-security.com/login". What type of attack is this?

Answer: This is a link phishing attack using URL typosquatting. "faceb00k" uses a zero instead of 'o' to create a lookalike domain. The urgency ("compromised") and call to action (click to secure) are classic phishing triggers. The attacker hopes the user won't notice the misspelled domain. Q2: How does account cloning differ from a Sybil attack?

Answer: Account cloning targets a specific existing user by copying their profile information (photos, bio, friends) and sending friend requests to their connections. It's precision impersonation. A Sybil attack creates many fake accounts from scratch (not copying anyone) to manipulate the network at scale. Cloning is for targeted fraud; Sybil attacks are for algorithmic manipulation. Q3: In the Koobface worm, why was the social graph so effective for propagation?

Answer: The social graph is effective because of trust: people are far more likely to click a link sent by a friend than by a stranger. By compromising a user's account, Koobface inherited their trust network. Each infected user became a new attack vector to their entire friend list, creating exponential propagation. This is the same mechanism that makes social media phishing so dangerous — trust is the transmission vector. Q4: A new social network has 10,000 users. An attacker creates 2,000 Sybil accounts. What percentage of the network is controlled by the attacker?

Answer: Percentage = 2000 / (10000 + 2000) × 100 = 2000/12000 × 100 = 16.67%. With 16.67% of accounts under their control, the attacker can significantly influence trending topics, voting systems, and recommendation algorithms, especially during coordinated actions. Q5: Compare CAPTCHA with graph-based Sybil detection.

Answer: CAPTCHA is a preventive control applied at account creation — it's hard to bypass but can be outsourced to captcha-solving farms ($0.001 per solve). Graph-based detection is a detective control that works post-creation — it's free to run but sophisticated Sybils can evade it by slowly building legitimate-looking connections. Best practice is to use both: CAPTCHA for initial filtering, graph analysis for ongoing monitoring. Q6: Why might a legitimate URL shortener (like bit.ly) be used in phishing attacks?

Answer: URL shorteners mask the destination URL. A bit.ly link could redirect to any website, and the victim can't verify the destination before clicking. This makes it harder for automated filters to detect malicious URLs. Additionally, shorteners are commonly used in legitimate social media posts (due to character limits), so blocking them entirely isn't feasible. Q7: What behavioral patterns might distinguish a Sybil bot from a real user?

Answer: Sybil bots often exhibit: (1) regular posting frequency (every exactly 30 min), (2) similar content across accounts (retweeting the same content), (3) rapid friend-request activity after creation, (4) primarily following accounts that follow back, (5) no real conversational engagement (replies are generic), (6) activity 24/7 with no sleep cycle, (7) accounts created in batches with similar timestamps. Q8: Explain the concept of "trust transitivity" in phishing defense.

Answer: Trust transitivity means: if A trusts B, and B trusts C, should A trust C? In social media defense, this concept is used for Sybil detection — you trust accounts that are connected through chains of trust from known-honest users. However, transitivity has limits: A might not want to trust C just because B does. Graph-based detection algorithms (like SybilGuard) use this principle, assuming Sybil accounts can't form many trust edges to honest users. Q9: A clickjacking attack hides a "Like" button under a "Play Video" button. How does this work technically?

Answer: The attacker creates a transparent iframe containing the target website's Like button, positioned exactly over the "Play Video" button that the user sees. When the user clicks what they think is a play button, they actually click the invisible Like button underneath. This is prevented by the X-Frame-Options HTTP header (set to DENY or SAMEORIGIN) which prevents your site from being embedded in iframes on other domains. Q10: What is the most effective single defense against social media account takeover?

Answer: Two-Factor Authentication (2FA), particularly using an authenticator app (TOTP) or hardware key (FIDO2). Even if a phishing attack steals the user's password, the attacker cannot log in without the second factor. 2FA stops the vast majority of automated account takeover attacks. SMS-based 2FA is better than nothing but vulnerable to SIM-swapping attacks.

8. 🔗 Cross-References

• Week 5 - Case Studies: Real-world cyber crime cases
• Week 6 - Fake News: Malware and misinformation overlap
• Week 8 - Privacy: Anonymity vs. accountability
• BSCS4022 (OS): Access control, security fundamentals Join Discord PreviousWeb TrackingNextCryptography Basics