Data Privacy and Security

A Survey of Security Vulnerabilities in Social Networking
Media – The Case of Facebook
Elizabeth Fokes
Department of Information Technology
Southern Polytechnic State University
1100 South Marietta Pkwy
Marietta GA 30060
01-678-915-4292
efokes@spsu.edu
Lei Li
Department of Information Technology
Southern Polytechnic State University
1100 South Marietta Pkwy
Marietta GA 30060
01-678-915-3915
lli3@spsu.edu
ABSTRACT
This paper conducted a survey study on the security
vulnerabilities in one of most popular social networking site,
Facebook. We divide the vulnerabilities into two main categories:
platform-related and user-related. For each vulnerability, we
present its origin, description and remedy if there is any. Our
work not only increases users’ awareness of those vulnerabilities,
but also provides a comprehensive view to the researchers who
are interested in improving security measures of social media
services.
Categories and Subject Descriptors
A.1 [General Literature]: Introductory and Survey.
General Terms
Documentation, Security
Keywords
Security; Vulnerability; Facebook; Social Media.
1. INTRODUCTION
The statistics regarding use of social networking media are
staggering. According to Statistic Brain in 2012, 58% of the
population in US used any social network; 56% used Facebook;
14% used Linked in, 11% used Twitter; 9% used Google+. [18]
Social media has also become a platform for a very large number
of businesses. In 2011, 77% of Fortune Global 100 Companies
use Twitter, and 61% have a Facebook page. [15]
Social media sites, in particular are the focus of vulnerabilities,
because of their large user base and the instant attention that is
brought about by the attack. Social networking sites have
databases of user activities, their email addresses, potentially
financial information, ISP addressing information, and some have
authorized location tracking. These are all items that can be
potentially utilized for great harm against users.
There are many different types of vulnerabilities that users may
encounter. Vulnerabilities cause a disruption in the integrity,
confidentiality and availability of services. Some are seen directly,
and others are not seen at all by the user. Attacks can be launched
against users and against the social networking media services
individually. There are many motivations behind attacks: financial
gain, social hacking, activism, or intentional harm against
someone or a company that the attackers do not like. Attackers go
after a user’s account for financial gain, social hacking, activism,
and intentional harm against someone or a company that the
attackers do not like to name a few.
The rest of the paper is organized as follows: section two
describes the research method used. Section three presents the
security vulnerabilities specific to Facebook. Section four
concludes the paper.
2. RESEARCH METHOD
We conducted extensive literature search on the vulnerabilities of
Facebook. We collected information not only from academic
sources but also Internet sources due to the topic our paper. We
then created a categorization scheme to sort the sources into
different categories and sub categories. For each source, we
recorded the description of the vulnerability and potential remedy
to it if there is any.
There are two major categories for vulnerabilities: platformrelated and user-related. The platform-related vulnerability is
divided into four sub categories: SMS verification, social
authentication, applications, and general web-based
vulnerabilities. For user-related category, there are three sub
categories: fake profile, Sybil-type vulnerability, identify theft and
access to user account.
The detail of each security vulnerability is described in the next
section.
3. FACEBOOK SECURITY
VULNERABILITIES
3.1 Technical Background of Facebook
Facebook has an extremely large user base. The company has had
to come up with solutions to handle data at a rapid pace and to be
able to keep up with the demands. As part of that initiative, in
2012, the company built Presto (a distributed SQL query engine
that supports ANSI SQL) that would enables the system to work
at a “petabyte scale.” This system is implemented in Java, as
Permission to make digital or hard copies of all or part of this work for personal
or classroom use is granted without fee provided that copies are not made or
distributed for profit or commercial advantage and that copies bear this notice
and the full citation on the first page. Copyrights for components of this work
owned by others than ACM must be honored. Abstracting with credit is
permitted. To copy otherwise, or republish, to post on servers or to redistribute
to lists, requires prior specific permission and/or a fee. Request permissions
from permissions@acm.org.
RIIT’14, October 15–18, 2014, Atlanta, Georgia, USA.
Copyright © 2014 ACM 978-1-4503-2711-4/14/10…$15.00.
http://dx.doi.org/10.1145/2656434.2656444
57
Facebook has used Java for the rest of the data infrastructure.
Hive/HDFS and Scribe (log server) are on the backend. [19]
3.2 Vulnerabilities Relating Spe