Seeing is (Not) Believing: Practical Phishing Attacks Targeting Social Media Sharing Cards

Fuente: arXiv

Saved in:

Bibliographic Details
Main Authors:	Huang, Wangchenlu, Wang, Shenao, Zhao, Yanjie, Xu, Guosheng, Wang, Haoyu
Format:	Preprint
Published:	2024
Subjects:	Cryptography and Security
Online Access:	Acceder al recurso
Tags:	Add Tag No Tags, Be the first to tag this record!

_version_	1866917668839227392
author	Huang, Wangchenlu Wang, Shenao Zhao, Yanjie Xu, Guosheng Wang, Haoyu
author_facet	Huang, Wangchenlu Wang, Shenao Zhao, Yanjie Xu, Guosheng Wang, Haoyu
contents	In the digital era, Online Social Networks (OSNs) play a crucial role in information dissemination, with sharing cards for link previews emerging as a key feature. These cards offer snapshots of shared content, including titles, descriptions, and images. In this study, we investigate the construction and dissemination mechanisms of these cards, focusing on two primary server-side generation methods based on Share-SDK and HTML meta tags. Our investigation reveals a novel type of attack, i.e., Sharing Card Forgery (SCF) attack that can be exploited to create forged benign sharing cards for malicious links. We demonstrate the feasibility of these attacks through practical implementations and evaluate their effectiveness across 13 various online social networks. Our findings indicate a significant risk, as the deceptive cards can evade detection and persist on social platforms, thus posing a substantial threat to user security. We also delve into countermeasures and discuss the challenges in effectively mitigating these types of attacks. This study not only sheds light on a novel phishing technique but also calls for heightened awareness and improved defensive strategies in the OSN ecosystem.
format	Preprint
id	arxiv_https___arxiv_org_abs_2405_10758
institution	arXiv
publishDate	2024
record_format	arxiv
spellingShingle	Seeing is (Not) Believing: Practical Phishing Attacks Targeting Social Media Sharing Cards Huang, Wangchenlu Wang, Shenao Zhao, Yanjie Xu, Guosheng Wang, Haoyu Cryptography and Security In the digital era, Online Social Networks (OSNs) play a crucial role in information dissemination, with sharing cards for link previews emerging as a key feature. These cards offer snapshots of shared content, including titles, descriptions, and images. In this study, we investigate the construction and dissemination mechanisms of these cards, focusing on two primary server-side generation methods based on Share-SDK and HTML meta tags. Our investigation reveals a novel type of attack, i.e., Sharing Card Forgery (SCF) attack that can be exploited to create forged benign sharing cards for malicious links. We demonstrate the feasibility of these attacks through practical implementations and evaluate their effectiveness across 13 various online social networks. Our findings indicate a significant risk, as the deceptive cards can evade detection and persist on social platforms, thus posing a substantial threat to user security. We also delve into countermeasures and discuss the challenges in effectively mitigating these types of attacks. This study not only sheds light on a novel phishing technique but also calls for heightened awareness and improved defensive strategies in the OSN ecosystem.
title	Seeing is (Not) Believing: Practical Phishing Attacks Targeting Social Media Sharing Cards
topic	Cryptography and Security
url	https://arxiv.org/abs/2405.10758