Wirtschaftsuniversität Wien Magisterarbeit - SemanticLab

jobs or friends can be monitored and compiled to a report. One not necessarily has
to actively monitor accounts to receive information about the users’ past - this,
at least in the case of Facebook, is already done for other users by the platform
itself. Another source of information are users’ pictures. Taking a look at the
pictures available often provides enough information if users have been registered
for a certain amount of time or pictures about users have been uploaded. Potential
employers could, for example, check out applicants by taking a look at their
pictures, reading posts of friends and so on.
• Spear phishing: [Jag07] highlights the issue of spear phishing or context aware
phishing. In such phishing attacks, personal information is used to adapt the
attack specifically to the phishing victim for example by using data available on
social networks. The study shows that when exploiting social network data, the
success rate of phishing attacks is four times higher than normal [Jag07]: social
networks such as Facebook or MySpace can easily be automatically crawled and
reliable data about social networks can be extracted and stored in a database.
This information can then be used to “personalize” phishing attacks for example
by spoofing e-mails to make them appear to be of a friend. As the phishing
victims recognize the (fake) sender (it looks like the e-mail has been sent of one
of his friends e.g. from Facebook), the user is more likely to click on the link and
provide sensitive information [Jag07]. The study also supports the statement that
there is a lack of understanding that data posted on social network sites is public
information - and how easily this information can be abused.
Just recently, Facebook tried to implement “changes to its contract with [its] users
that had appeared to give it perpetual ownership of their contributions to the service”
[NYT], including all personal data and status messages entered. After a huge outcry of
the Facebook community, these changes were reverted. However, it is a clear example
how data collected by such social network are potentially dangerous.
However, most of these very real threats to privacy are only made possible because
users are not aware about the above discussed consequences if they do not protect their
data by using existing privacy settings [Jon05]. This leads to an alarming discrepancy
between the perception of users (“nobody will ever find this information or is interested
in it”) and the reality: not do only other people actively search for information, also automatic
data collection about specific persons is taking place. By crawling the Internet,
search engines provide a basis for services such as 123people.at which displays publicly
existing data of specific users on the Internet. However, this issue is not only restricted
to social networks. Also other popular services like blogs can pose a huge threat to
privacy [Kha06].
All the above mentioned threats and application use certain technologies and methodologies
to fulfill their purpose. Especially the issues of cookies, Internet Service Providers,
profiling and logging is of interest and will be discussed in the next section.
13